Vaara runs on your own machine — the client starts it, so there is no endpoint to ping. Last commit 30 Oct 2026.
Accountable autonomy proxy: gating, tamper-evident audit, time anchor for every action
What the code does
We read the source, 3 d ago · rules 995398eba69f
Things with no honest explanation: a promise that contradicts the code, code that runs at install time while hiding what it does, data leaving the machine.
"pattern": "bash\\s+-i\\s+>&?\\s+/dev/tcp/",
What this server is able to do. For an MCP server this is often the job itself — a terminal server runs commands because that is what it is for. Listed so you know what you are plugging in, not as an accusation.
"/etc/crontab", "/etc/cron.d/", "/etc/cron.hourly/", "/etc/cron.daily/",
let proc = Process()
result = subprocess.run([sys.executable, str(checker)])
hash_alg, size_of_select = struct.unpack_from(">HB", attest_bytes, off)
off += 3
if off + size_of_select > len(attest_bytes):
child = spawn(VAARA_BIN, ["hook", subcommand, "--client", "opencode"], {
return os.path.normpath(os.path.join(cwd, path))
"message": "Read of /etc/shadow or related privileged files."
$("settings").innerHTML = Object.entries(c.fields).map(([key, f]) => {
const DEMO = {"envelope": {"payload": "eyJfdHlwZSI6Imh0dHBzOi8vaW4tdG90by5pby9TdGF0ZW1lbnQvdjEiLCJwcmVkaWNhdGUiOnsiYWdlbnRfaWQiOiJhZ2VudDphY21lL2NoZWNrb3V0LWJvdC8xIiwiZGVjaWRlZF9hdCI6IjIwMjYtMDYtMjNUMTI6MDA6MDVaIiwiZGVjaXNpb24iOiJkZW55IiwicG9saWN5X2V2YWx1YXRpb25zIjpbeyJwb2xpY3lfa…
USER 0
env = dict(os.environ) if env is None else env
Is this your server and something here is wrong? Tell us — corrections are free and do not require a plan.
We found things in this code
Code changes quietly between releases, and nobody reads the diff of a dependency. We do, on every release — watch Vaara and you get told the day something new turns up.
Alternatives to Vaara
same job, measured the same wayAccountable autonomy MCP server: gating, tamper-evident audit for every action
Auditable memory for AI agents: provable deletion, tamper-evident audit, time-travel recall.
Bitcoin-anchored, tamper-evident audit log for AI agents — record, disclose and verify actions.
Pre-execution gate for AI-agent tool calls. Touch ID approval. Tamper-evident audit log.
Tamper-evident audit trail MCP server for EU AI Act & GDPR compliance.
Tamper-evident proof creation and verification for AI agents via MCP, A2A, and REST.
Verifiable cognition: prove a session ledger is tamper-evident; audit & import any agent's logs.
Tamper-evident decision audit trail and outcome-weighted memory for AI trading agents.
Vaara — questions
Answers built from our own checks of this server.