claude-evidence

Auto-captures every Bash and MCP tool call in Claude Code as tamper-evident evidence for pentest / red-team reports — command + output, real screenshots, hash-chained, one command to a Markdown report.

v0.4.4 — CHANGELOG.md for release notes, tags for versions.

• Arm with /evidence-on, everything after is captured automatically. No copy-paste.
• Captures Bash + the AI tools you've declared — Playwright, Windows-MCP, HexStrike AI. Other MCP servers aren't captured by default (configurable, see Configuration).
• SHA-256 hash chain — any edit/delete/reorder of a step is detectable.
• Installed once globally; evidence stored per-project under <project>/.evidence/ (auto-gitignored, raw/unredacted — redact before the report leaves your hands).

git clone https://github.com/dn9uy3n/claude-evidence
cd claude-evidence
python install.py

Copies the engine + 9 /evidence-* commands to ~/.claude/, wires the capture hook into settings.json, installs Pillow + Pygments (for report rendering). Restart Claude Code after.

python install.py --dir /path/to/.claude   # different Claude dir
python install.py --no-deps                # skip Pillow/Pygments
python install.py --uninstall              # remove (keeps evidence)

Re-running the installer is the update — overwrites code/commands, re-merges the hook (no dupes), keeps your evidence.config.json.

python install.py --check    # compare installed vs. checkout version, changes nothing
python install.py --update   # git pull, then re-install

/evidence-on acme-corp-q1-2026        # arm capture for this project
   ... work — Bash + MCP calls captured automatically ...
/evidence-snap-web https://target/app --note "IDOR user 4412"
/evidence-note 7 "thick-client after exploit" --attack T1190
/evidence-status                      # armed? counts, chain OK?
/evidence-report                      # build the Markdown report
/evidence-off                         # verify chain, seal manifest, stop

Each captured step gets rendered like this in the report — just the command and its real output, nothing else:

A step that already has a real screenshot (Playwright, Windows-MCP) embeds that image directly instead — no PNG-of-text gets generated for it.

These are the only MCP servers captured by default — everything else (RedTech, WireMCP, Jadx, ILSpy, Binary Ninja, SSH, ...) is out of scope unless you widen allowed_mcp_servers.

claude mcp add playwright -- npx @playwright/mcp@latest
claude mcp add --transport stdio windows-mcp -- uvx windows-mcp serve
claude mcp add --transport stdio hexstrike-ai -- python3 hexstrike_mcp.py --server http://localhost:8888

<project>/.evidence/<engagement>/<session_id>/
├── log.jsonl          # source of truth — append-only, hash-chained
├── map.md             # auto-regenerated index (screenshots + full timeline)
├── annotations.json   # your labels/ATT&CK tags (mutable, outside the chain)
├── steps/             # raw text per step
├── artifacts/         # real screenshots
└── report/            # report.md + rendered PNGs (on /evidence-report)

~/.claude/evidence/evidence.config.json (global default, survives re-installs) — override per-project with <project>/.evidence/evidence.config.json. Main keys: capture (bash/mcp/screenshots on-off), allowed_mcp_servers (which MCP servers are evidence sources at all — default ["playwright*", "windows-*", "hexstrike*"]; empty/absent = every connected server), image_producing_tools, sensitive_hint_tools. Pattern keys match short tool names; prefix with mcp__ to scope to one server.

• Cross-platform (Windows/macOS/Linux). Optional hardening: chattr +a log.jsonl (Linux) or an icacls deny-write ACL (Windows).
• Not a replacement for git history — recover file contents from git, not this log.

MIT — see LICENSE.