ProvenanceGuard: 86% Source Accuracy for MCP Agents

Executive Overview

Multiverse Computing has announced ProvenanceGuard, a post-generation verification layer designed to verify fact provenance in LLM agents built on the Model Context Protocol (MCP). The system is available via a research paper on Hugging Face and arXiv, was presented as a poster at the Agentic AI Summit 2026 at UC Berkeley, and has been integrated into NVIDIA NVFlow for its financial agent.

ProvenanceGuard addresses a specific failure mode in MCP agents that researchers call "Cross-Source Conflation": a correct claim exists somewhere in the aggregated tool outputs, but it is attributed to the wrong source. For example, a customer support agent might state, "According to the account record, this plan includes a 30-day refund window," when the window is actually mentioned in a policy document, not the account record. Source-blind verification systems pass this claim because the fact exists in the aggregate, while ProvenanceGuard detects the attribution mismatch.

Deep-Dive Features & Architecture

ProvenanceGuard operates as a post-generation verification layer that reads the captured MCP trace, including tool outputs and source identifiers, without retraining the agent. It executes five sequential steps: splitting the answer into specific claims, finding the most relevant source for each claim, verifying that the source supports the claim, comparing the source to the source cited or implied in the answer, and then issuing a judgment for each claim and an overall allow or block decision.

In the local setup used, MiniLM handles source identification, DeBERTa NLI verifies support, and a local language model splits claims. The system also verifies literal values: a number, date, or identifier absent from the source cannot pass merely because the sentence sounds plausible.

When an answer is blocked, a RARR-style repair loop can be run to attempt a source-grounded revision or a safe fallback text, after which the verifier rechecks it. In full operation, the system resolved all 173 blocked answers, but 144 of them ended with fallback text instead of a substantive rewrite, a deliberate choice to avoid an unverifiable answer rather than fabricate one.

Benchmark & Competitive Performance

In a test on 361 claims from 40 answers, human experts identified 139 claims that should be blocked. ProvenanceGuard caught 138 of them and allowed only one. It also blocked 67 claims that experts considered supported for review or repair purposes, reflecting the conservative policy in the tested setup. For claims with an identifiable source, the system chose the correct source 86% of the time.

In a comparison with other verification systems, ProvenanceGuard achieved the highest F1 score of 0.802, outperforming MiniCheck (0.783), RAGAS Faithfulness (0.758), AlignScore (0.662), and SummaC-ZS (0.436). It is also the only system that issues a source ID per claim (Claim-to-Source ID), while the four competing systems do not.

In a harder test with similar sources, accuracy dropped to 50.3% with F1=0.846. In a source-switching test of 50 cases, the system detected all 50 cases.

Industry Impact & Enterprise Adoption

ProvenanceGuard's integration into NVIDIA NVFlow for a financial agent signals enterprise interest in source-aware verification for high-stakes domains. The system's conservative decision policy and ability to maintain source identifiers across the pipeline make it suitable for sensitive data review, where attributing a correct fact to the wrong source can have compliance and trust implications.

The availability of the research paper and open-source local models on Hugging Face and arXiv lowers the barrier for developers to test and adapt the system. While the published tests focus on English texts, the architecture is theoretically adaptable to other languages when suitable NLI models are available.

Conclusion

ProvenanceGuard represents a significant step forward in fact-source verification for MCP agents, addressing the subtle but critical problem of cross-source conflation. With an F1 of 0.802, 99.3% detection of unsupported claims, and 86% source accuracy, it outperforms existing systems and offers a practical, open-source solution for enterprises deploying LLM agents in sensitive environments. Its integration into NVIDIA NVFlow and presentation at the Agentic AI Summit 2026 underscore its relevance to the evolving agentic AI landscape.

Media Source: Hugging Face | البيان الرسمي للشركة: المصدر الأصلي | Fact Verification & Analysis: AI Tools Oasis