EVE AI Core
The Infrastructure of No.
EVE AI Core
The Infrastructure of No.
A tenant-isolated register of every model, application, agent, and third-party vendor in your estate — with deterministic, EU AI Act-aligned risk tiering (no LLM in the path), a live portfolio risk view, and each system linked to the signed CoreGuard decisions it produced. Not a spreadsheet: an inventory wired into the enforcement plane.
Models, applications, agents, vendor models, and pipelines are tracked as first-class, tenant-isolated records — each with a lifecycle stage, an owner, a deterministic risk tier, and a link to the signed decisions it has produced. Every mutation is written to an append-only audit log.
model · application · agent · vendor_model · pipeline — the whole estate, not just LLM endpoints.
intake → development → validation → production → retired, with an append-only audit trail per org.
Every read and write is scoped by org. One tenant’s inventory can never surface another’s systems.
Link any system to the CoreGuard decisions it produced — inventory that points at signed proof, not a static list.
Risk tier is a pure, deterministic function of declared inputs. The same inputs always yield the same tier, with the exact factors that drove it — auditable and reproducible, never a model’s opinion.
Lending, credit, insurance, employment / hiring, healthcare, biometrics, law enforcement and essential services raise the tier automatically.
Any prohibited practice — social scoring, subliminal manipulation, real-time remote biometric ID — pins the system to unacceptable.
Declared meaningful human oversight lowers the score — the framework’s mitigations are modeled, not ignored.
minimal · limited · high · unacceptable — mapped from a bounded 0–1 score.
The portfolio view rolls every registered system into a single org-scoped picture — counts by risk tier and by lifecycle stage, and the high-risk systems that need attention first — so a CISO, risk officer, or examiner sees the whole estate at a glance instead of chasing spreadsheets.
Catalog the third parties in your AI supply chain — LLM providers, cloud infrastructure, security tools, data processors, identity providers, monitoring, payment processors — each with a deterministic risk tier, the data categories it touches, a DPA reference, and tracked findings.
critical / high / medium / low — an LLM provider with data access tiers critical by default.
Track exactly what each vendor touches: PII, financial, health, conversation content, metadata, telemetry.
Open findings carry a severity and due date; close them as remediated or accepted — an auditable trail, not a slide.
Bind each vendor to its data-processing agreement for procurement and examiner review.
Most AI registries catalog systems and stop there. EVE’s register is wired into the enforcement plane: each system links to the signed, offline-verifiable CoreGuard decision certificates it produced, and its tier is computed deterministically. “What do we run, how risky is it, and can we prove how it behaved” becomes one connected record — not three disconnected tools.
No logo here implies bidirectional connectivity. Each connector is classified by its real, source-backed capability — a live authenticated API call, an outbound webhook, in-process governance with signed evidence, or an operator-declared configuration scaffold — and anything not implemented is labelled as such, not shown as available.
| Connector | Readiness | Category | Direction | Auth | Primary capability | Evidence produced | Source-backed limitation | Code reference |
|---|---|---|---|---|---|---|---|---|
| ServiceNow | Live API connector | ITSM | outbound | Basic auth | Creates governed-decision incidents via the ServiceNow Table API. | Signed decision certificate per incident. | Outbound incident creation only — not a bidirectional ServiceNow sync. | core/integrations/adapters/itsm.py:25 |
| Datadog | Live API connector | Observability | outbound | API key (DD-API-KEY) | Ships governed-decision logs to the Datadog Logs intake API. | Signed evidence per shipment. | One-way log delivery; no query-back from Datadog. | core/integrations/adapters/observability.py:28 |
| Splunk | Live API connector | Observability | outbound | HEC token | Ships governed-decision events to the Splunk HTTP Event Collector. | Signed evidence per shipment. | One-way delivery to HEC. | core/integrations/adapters/observability.py:78 |
| CrowdStrike Falcon | Live API connector | Security / SIEM | outbound | Bearer token | Ships governed-decision logs to Falcon NG-SIEM (LogScale HEC). | Signed evidence per shipment. | One-way delivery. | core/integrations/adapters/security.py:24 |
| Microsoft Sentinel | Live API connector | Security / SIEM | outbound | Azure AD (DCE/DCR) | Ships governed-decision logs to the Sentinel Logs Ingestion API. | Signed evidence per shipment. | One-way delivery. | core/integrations/adapters/security.py:70 |
| Palo Alto Cortex XSIAM | Live API connector | Security / SIEM | outbound | Collector token | Ships governed-decision logs to the Cortex HTTP Collector. | Signed evidence per shipment. | One-way delivery. | core/integrations/adapters/security.py:123 |
| Slack (Integration Hub) | Outbound webhook | Collaboration | outbound | Incoming-webhook URL | Posts governed-decision notifications to Slack (Block Kit). | Notification payload only. | Incoming-webhook POST — not a Slack Web API client. | core/integrations/adapters/collaboration.py:22 |
| Microsoft Teams (Integration Hub) | Outbound webhook | Collaboration | outbound | Incoming-webhook URL | Posts governed-decision notifications to Teams (Adaptive Card). | Notification payload only. | Incoming-webhook POST — not a Graph/Teams API client. | core/integrations/adapters/collaboration.py:65 |
| Connector | Readiness | Category | Direction | Auth | Primary capability | Evidence produced | Source-backed limitation | Code reference |
|---|---|---|---|---|---|---|---|---|
| Slack (incident alerts) | Outbound webhook | Incident | outbound | Incoming-webhook URL | Delivers severity-colored incident alerts (Block Kit) with retry. | Alert delivery record. | Alert delivery only; distinct from the Integration Hub Slack tile. | core/governance/webhook_alerts.py:259 |
| Microsoft Teams (incident alerts) | Outbound webhook | Incident | outbound | Incoming-webhook URL | Delivers incident alerts (Adaptive Card) with retry. | Alert delivery record. | Alert delivery only; distinct from the Integration Hub Teams tile. | core/governance/webhook_alerts.py:317 |
| PagerDuty | Outbound webhook | Incident | outbound | Events API v2 routing key | Triggers PagerDuty Events API v2 incidents from governance alerts. | Alert delivery record. | Alert delivery only; NOT part of the 21-tile Integration Hub catalog. | core/governance/webhook_alerts.py:84 |
| Connector | Readiness | Category | Direction | Auth | Primary capability | Evidence produced | Source-backed limitation | Code reference |
|---|---|---|---|---|---|---|---|---|
| Anthropic | Live API connector | LLM Provider | outbound | Bearer | Real Claude inference (api.anthropic.com/v1/messages). | Governed by CoreGuard when routed through EVE. | Inference client; governance is applied by the routing layer, not this client alone. | core/llm_providers.py:322 |
| OpenAI | Live API connector | LLM Provider | outbound | Bearer | Real OpenAI chat/completions inference. | Governed by CoreGuard when routed through EVE. | Inference client. | core/llm_providers.py:232 |
| Google Gemini | Live API connector | LLM Provider | outbound | API key | Real Gemini inference (generativelanguage.googleapis.com). | Governed by CoreGuard when routed through EVE. | Inference client. | core/llm_providers.py:628 |
| Kimi / Moonshot | Live API connector | LLM Provider | outbound | Bearer | Real Moonshot (OpenAI-compatible) inference. | Governed by CoreGuard when routed through EVE. | Inference client. | core/llm_providers.py:708 |
| Ollama (local) | Live API connector | LLM Provider | outbound | none (local) | Real local inference via Ollama / LM Studio HTTP. | Governed by CoreGuard when routed through EVE. | Local inference client. | core/llm_providers.py:445 |
| AWS Bedrock | Live API connector | LLM Provider | outbound | AWS SigV4 | Real Bedrock InvokeModel (hand-rolled SigV4). | Governed by CoreGuard when routed through EVE. | Inference client; falls back to mock only when AWS credentials are absent. | core/interop/adapters/bedrock_adapter.py:32 |
| Azure OpenAI | Live API connector | LLM Provider | outbound | Azure AD / key | Real Azure OpenAI chat/completions inference. | Governed by CoreGuard when routed through EVE. | Inference client; falls back to mock only when the key is absent. | core/interop/adapters/azure_adapter.py:26 |
| Connector | Readiness | Category | Direction | Auth | Primary capability | Evidence produced | Source-backed limitation | Code reference |
|---|---|---|---|---|---|---|---|---|
| ElevenLabs | Live API connector | TTS | outbound | API key | Real ElevenLabs text-to-speech synthesis. | n/a | Cloud TTS client. | core/voice/tts_service.py:694 |
| Azure Speech (TTS) | Live API connector | TTS | outbound | API key | Real Azure Cognitive Services neural TTS. | n/a | Cloud TTS client. | core/voice/tts_service.py:750 |
| OpenAI TTS | Live API connector | TTS | outbound | Bearer | Real OpenAI audio/speech synthesis. | n/a | Cloud TTS client. | core/voice/tts_service.py:806 |
| Microsoft Edge TTS | Live API connector | TTS | outbound | none | Microsoft Edge neural TTS voices. | n/a | Edge neural TTS. | core/voice/tts_service.py:659 |
| Windows SAPI (local) | Declared-config / evidence scaffold | TTS | n/a | none (local) | Local Windows SAPI COM synthesis. | n/a | Local engine — no cloud vendor call. | core/voice/tts_service.py:657 |
| Piper / eSpeak (local) | Declared-config / evidence scaffold | TTS | n/a | none (local) | Local Piper neural / eSpeak formant synthesis. | n/a | Local engine — no cloud vendor call. | core/voice/piper_tts.py:1 |
| Connector | Readiness | Category | Direction | Auth | Primary capability | Evidence produced | Source-backed limitation | Code reference |
|---|---|---|---|---|---|---|---|---|
| LangChain | Governance-native | AI Framework | n/a | in-process | Governs each chain/agent step through CoreGuard and emits signed evidence. | Signed evidence per governed step. | In-process auto-hook attach is deployment-gated. | core/integrations/adapters/ai_frameworks.py:255 |
| LlamaIndex | Governance-native | AI Framework | n/a | in-process | Governs each retrieval/query step and emits signed evidence. | Signed evidence per governed retrieval. | SDK auto-attach is deployment-gated. | core/integrations/adapters/ai_frameworks.py:333 |
| Anthropic (Integration Hub gateway) | Governance-native | AI Provider | n/a | none (governs metadata) | Governs Claude invocation metadata and emits a signed decision certificate. | Signed decision certificate with reasoning-trace metadata. | The Hub tile does NOT call Anthropic; EVE's real Claude inference client lives in core/llm_providers.py. | core/integrations/adapters/ai_providers.py:42 |
| OpenAI (Integration Hub gateway) | Governance-native | AI Provider | n/a | none (governs metadata) | Governs OpenAI invocation metadata and emits signed evidence. | Signed decision certificate. | The Hub tile does NOT call OpenAI; the real inference client lives in core/llm_providers.py. | core/integrations/adapters/ai_providers.py:64 |
| AWS Bedrock (Integration Hub gateway) | Governance-native | AI Provider | n/a | none (governs metadata) | Governs Bedrock invocation metadata and emits signed evidence. | Signed decision certificate. | The Hub tile does NOT call Bedrock; the real SigV4 InvokeModel client lives in core/interop/adapters/bedrock_adapter.py. | core/integrations/adapters/ai_providers.py:86 |
| Azure OpenAI (Integration Hub gateway) | Governance-native | AI Provider | n/a | none (governs metadata) | Governs Azure OpenAI invocation metadata and emits signed evidence. | Signed decision certificate. | The Hub tile does NOT call Azure; the real client lives in core/interop/adapters/azure_adapter.py. | core/integrations/adapters/ai_providers.py:122 |
| Connector | Readiness | Category | Direction | Auth | Primary capability | Evidence produced | Source-backed limitation | Code reference |
|---|---|---|---|---|---|---|---|---|
| OIDC (SSO) | Supported via standard protocol | Auth | bidirectional | OAuth2 / PKCE | Real OIDC authorization-code + PKCE flow with JWT validation. | Session/attribution records. | Branded IdPs (Okta, Entra, Ping) are supported THROUGH this, not via per-vendor API clients. | saas/auth/sso_provider.py:296 |
| SAML 2.0 (SSO) | Supported via standard protocol | Auth | bidirectional | SAML2 | Real SAML2 ACS / SP metadata / SLO (python3-saml). | Session/attribution records. | Branded IdPs are supported THROUGH this standard. | saas/auth/sso_provider.py:519 |
| SCIM 2.0 (provisioning) | Supported via standard protocol | Auth | inbound | Bearer | Real SCIM 2.0 user/group provisioning endpoints. | Provisioning records. | Standards-based provisioning; branded IdPs provision through it. | saas/auth/scim_api.py:1 |
| Connector | Readiness | Category | Direction | Auth | Primary capability | Evidence produced | Source-backed limitation | Code reference |
|---|---|---|---|---|---|---|---|---|
| Hugging Face Hub | Declared-config / evidence scaffold | AI Provider | n/a | operator config | Inventories declared models (options['models']) and emits governance evidence. | Signed model-inventory snapshot. | No live Hugging Face Hub crawl or API sync. | core/integrations/adapters/ai_providers.py:151 |
| Microsoft Entra ID | Declared-config / evidence scaffold | Identity | n/a | operator config | Syncs RBAC groups from a declared directory snapshot and attributes decisions. | Signed RBAC/attribution evidence. | No live Microsoft Graph pull; live SSO is via EVE's OIDC/SAML implementation. | core/integrations/adapters/identity.py:136 |
| Okta (Integration Hub) | Declared-config / evidence scaffold | Identity | n/a | operator config | Syncs RBAC groups from a declared snapshot and attributes decisions. | Signed RBAC/attribution evidence. | No live Okta API call; Okta as an IdP is supported via EVE's OIDC/SAML. | core/integrations/adapters/identity.py:157 |
| Ping Identity (Integration Hub) | Declared-config / evidence scaffold | Identity | n/a | operator config | Syncs RBAC groups from a declared snapshot and attributes decisions. | Signed RBAC/attribution evidence. | No live Ping API call; Ping as an IdP is supported via EVE's OIDC/SAML. | core/integrations/adapters/identity.py:181 |
| Snowflake | Declared-config / evidence scaffold | Data Platform | n/a | operator config | Inventories declared datasets (options['datasets']) with classification + lineage evidence. | Signed data-asset inventory snapshot. | No live warehouse connection or query interception (deployment-gated). | core/integrations/adapters/data_platforms.py:128 |
| Databricks | Declared-config / evidence scaffold | Data Platform | n/a | operator config | Inventories declared datasets with classification + lineage evidence. | Signed data-asset inventory snapshot. | No live Databricks / Unity Catalog call (deployment-gated). | core/integrations/adapters/data_platforms.py:152 |
| Amazon S3 | Declared-config / evidence scaffold | Data Platform | n/a | operator config | Inventories declared data assets with classification + lineage evidence. | Signed data-asset inventory snapshot. | No live S3 access (deployment-gated). | core/integrations/adapters/data_platforms.py:176 |
| Microsoft Fabric | Declared-config / evidence scaffold | Data Platform | n/a | operator config | Inventories declared data assets with classification + lineage evidence. | Signed data-asset inventory snapshot. | No live OneLake/Fabric call (deployment-gated). | core/integrations/adapters/data_platforms.py:200 |
| Jira | Declared-config / evidence scaffold | Dev / MLOps | n/a | operator config | Emits governance evidence for Jira-tracked governance operations. | Signed governance evidence. | EvidenceNotifier scaffold — no live Jira REST call confirmed in source. | core/integrations/adapters/devtools.py:32 |
| MLflow | Declared-config / evidence scaffold | Dev / MLOps | n/a | operator config | Emits governance evidence for MLflow model-lifecycle events. | Signed governance evidence. | EvidenceNotifier scaffold — no live MLflow API call confirmed in source. | core/integrations/adapters/devtools.py:93 |
| Connector | Readiness | Category | Direction | Auth | Primary capability | Evidence produced | Source-backed limitation | Code reference |
|---|---|---|---|---|---|---|---|---|
| D-ID | Not implemented | Avatar | n/a | n/a | — | — | No source-backed adapter exists (only stale coverage artifacts). Not offered. | (no live source) |
| HeyGen | Not implemented | Avatar | n/a | n/a | — | — | No source-backed adapter exists. Not offered. | (no live source) |
| Unreal MetaHuman | Not implemented | Avatar | n/a | n/a | — | — | No source-backed adapter exists. Not offered. | (no live source) |
OpenAI, Anthropic, AWS Bedrock and Azure OpenAI have real inference clients elsewhere in EVE (governed model routing); their Integration Hub tiles are governance gateways over invocation metadata. Okta, Microsoft Entra ID and Ping are supported as identity providers through EVE’s OIDC / SAML implementation, not per-vendor API clients. Beyond the 7 primary providers, EVE ships 9 additional OpenAI-compatible inference clients (DeepSeek, Mistral, Groq, Together, Cohere, xAI, Perplexity, Fireworks, LM Studio).
Every system tiered, every vendor tracked, every decision provable — in a tenant-isolated register that examiners can follow end to end.
Book a 30-minute review