Open-source compliance-as-code — gap analysis, evidence collection, OSCAL emit.
Apache-2.0 · Python 3.12+

---

What is Evidentia?

Evidentia ingests NIST OSCAL catalogs and analyzes gaps against your evidence. Its Python library, CLI and REST API emit OSCAL Assessment Results, SARIF for CI gates, OCSF Compliance + Detection Findings for SIEMs, and CycloneDX VEX for supply-chain workflows.

Built for compliance engineers, GRC teams, and CISOs who want to:

• Ship audit-grade evidence with cryptographic provenance (Sigstore + PEP 740 + SLSA Provenance v1).
• Map controls across 106 bundled catalogs.
• Drive AI agents (Claude Desktop, Claude Code, Copilot CLI) deterministically via MCP tools with signed output envelopes.

Install

pip install evidentia

For the full workspace (AI risk-statements, REST API, all collectors, MCP server):

pip install 'evidentia[ai,api,collectors,mcp]'

Container: docker pull ghcr.io/polycentric-labs/evidentia:v0.12.1 (cosign keyless OIDC + SLSA Provenance v1 verified).

See the Getting Started wiki section for air-gapped install, virtualenv setup, and full extras matrix.

Quickstart (60 Seconds)

For evidentia gap analyze, --inventory supplies the controls you have and --frameworks selects catalogs to measure against. The wheel includes a sample inventory.

# 1. List bundled framework catalogs
evidentia catalog list

# 2. Locate the bundled sample inventory (maps to nist-800-53-rev5-moderate)
SAMPLE=$(python -c "import importlib.resources as r; print(r.files('evidentia.examples')/'sample-inventory.yaml')")

# 3. Run gap analysis against a framework
evidentia gap analyze \
  --inventory "$SAMPLE" --frameworks nist-800-53-rev5-moderate \
  --output gap-report.json

# 4. Emit OSCAL Assessment Results
evidentia gap analyze \
  --inventory "$SAMPLE" --frameworks nist-800-53-rev5-moderate \
  --output assessment-results.json --format oscal-ar

Full 5-minute walk-through: Quickstart wiki page.

Live Demo

See it first, no install — a self-hosted asciinema recording of the exact doctor → catalog list → gap analyze → oscal verify sequence on the Meridian Financial sample, plus a clickable, backend-free demo console:

▶ Watch the CLI demo · Click through the demo console

Features

• OSCAL-native end-to-end — Ingest NIST OSCAL catalogs (Catalog 1.2.1); emit OSCAL Assessment Results + Plan-of-Action-and-Milestones (POA&M) on the established FedRAMP Rev 5 package rail.
• FedRAMP CR26 machine-readable SDR emission — evidentia conmon ksi emits the CR26 Security Decision Record keySecurityIndicators block (10 families / 46 KSIs) conformant to FedRAMP's official 2026-06-24 schemas (vendored at pinned upstream SHAs, drift-watched weekly) — the first production-grade open-source emitter of the CR26 SDR format.
• Cryptographic evidence chain — Sigstore keyless signing on Assessment Results; PEP 740 attestations on every published wheel; SLSA Provenance v1 on the container; CycloneDX 1.7 SBOM on every GitHub Release.
• 106 framework catalogs + 16 crosswalks: 34 catalogs carry statement text for every non-withdrawn entry; 72 carry headings only. Coverage includes NIST 800-53 Rev 5 (full 1,196 controls + Low/Moderate/High/Privacy baselines), CSF 2.0, FedRAMP (Rev 5 baselines + CR26 Key Security Indicators + the 180 provider-facing CR26 Requirements), CMMC 2.0 L1/L2, OpenSSF OSPS Baseline (Maturity 1/2/3 + first public OSCAL serialization), ISO 27001:2022, EU AI Act, DORA, NIS2, GDPR, all 15 comprehensive US state privacy laws, FFIEC IT Examination Handbook booklets, CMS ARS 5.2 and the CJIS 6.1 requirements companion, OCC Bulletin 2026-13 / FRB SR 26-2.
• 19 credentialed evidence collectors: AWS; GitHub (OSPS conformance helpers); Postgres, MySQL, Oracle, SQLite, MS-SQL; Snowflake; Databricks; Okta; Google Workspace; Entra ID / Microsoft 365; storage retention (S3, Azure Blob, GCS); enterprise retention (Google Vault, Splunk Enterprise, Elasticsearch ILM); incident clocks (ServiceNow, Jira Cloud, PagerDuty); Vanta, Drata, BitSight and SecurityScorecard. Findings align with OCSF. Entra/M365 and retention preserve source coverage. Public registries offer 11 selectors with outcome, traversal and freshness; compliance stays unknown and SSL Labs live access is disabled. Incident clocks preserve native events and exact elapsed seconds under profile grants, without determining legal notification deadlines.
• SCAP imports: CLI, API and console preserve XCCDF/OVAL native results, source hashes, completion provenance and explicit artifact eligibility.
• OCSF-aligned findings — OCSF Compliance Finding (class_uid 2003) via --format ocsf; OCSF Detection Finding (class_uid 2004) via --format ocsf-detection. SARIF 2.1.0 for CI gates via --format sarif. CycloneDX 1.6 VEX via --format cyclonedx-vex.
• 14 MCP tools — Drive Evidentia from Claude Desktop, Claude Code, or any MCP host. Append-only tool contract per docs/api-stability.md (NORMATIVE). Signed output envelopes (CIMD) per docs/evidence-integrity.md.
• OSPS Baseline conformance — First public open-source project to ship a machine-readable per-control OSPS Baseline conformance attestation (OSPS-CONFORMANCE.md) with a CI gate that re-validates every evidence link on push/PR/cron.

What's in the Box

Surface	Count
Workspace packages	9 (8 Python on PyPI + 1 TypeScript/Vite frontend)
Framework catalogs	106
Inter-framework crosswalks	16
Credentialed evidence collectors	19
MCP tools	14
OSCAL serializations	1 (OpenSSF OSPS Baseline; more on the roadmap)
Test suite	5,000+ tests; mypy strict; ruff clean

Documentation

• Wiki — Getting Started, Guides, Concepts, Reference, Compliance, Project meta (auto-synced from docs/wiki/ on every push to main)
• docs/api-stability.md — append-only contract; what's frozen vs evolving
• docs/architecture/ — system design + extension points
• OSPS-CONFORMANCE.md — OpenSSF OSPS Baseline self-attestation + CI gate
• docs/verification.md — consumer-side recipes for PEP 740 + cosign + osv-scanner + SLSA Provenance v1
• EOL.md — version support windows + cessation comms policy
• docs/engineering-practices.md — how Evidentia is built, tested, and shipped: the safeguard stack and the candid failures that shaped it

Recent Releases

v0.12.1 (2026-09-05) — Container rebuild on a fresh hardened base (day-N CVE response), carrying the v0.13 cycle's opening batch. Python 3.14 support (closes #212): requires-python lifted to >=3.12,<3.15 across the workspace after litellm 1.98.x raised its own ceiling (the documented removal trigger), with 3.13/3.14 trove classifiers and 3.14 pytest legs on all three OSes.

v0.12.0 (2026-08-22) — Pre-1.0 hardening — the project's promises become enforceable. conmon ksi now emits the SDR's fedRampRequirements block (SDR-CSO-FRR); new fedramp-frr-2026 catalog, 97 bundled catalogs. The v0.12 plan gated the "FRR statements" extra on a cheapness re-verify against the post-08-14 schema set.

v0.11.2 (2026-08-17) — Day-N dependency sweep on a fresh hardened base. README brand refresh, a Polycentric Labs family visual identity: a light/dark <picture> banner and purpose-tiered, federal-blue-accented badges, from the new Evidentia brand kit committed under docs/brand/.

Full release history: CHANGELOG.md | GitHub Releases

Community & Governance

• GOVERNANCE.md — project governance + decision-making
• CONTRIBUTING.md — how to contribute (issues, PRs, catalogs)
• SECURITY.md — vulnerability reporting policy (private via GHSA)
• Code of Conduct
• FAQ (wiki) — frequent operator questions

AI Assistance

This project was developed alongside AI platforms.

Custom infrastructure and integrations built in-house.

Details, including the tools used: docs/ai-assistance.md.

License

Apache-2.0 — embeddable in commercial products without copyleft.