Evidence row 1226264

What was observed

{
  "count": 14,
  "tools": [
    {
      "description": "Approve an owned grant that was created with requires_approval. Opens stay blocked until this succeeds. Requires your API key.",
      "inputSchema": {
        "$schema": "http://json-schema.org/draft-07/schema#",
        "additionalProperties": false,
        "properties": {
          "api_key": {
            "description": "Secret API key from signup. Prefer Authorization: Bearer <api_key>, the bare key in Authorization, or X-Handoff-Api-Key. Pass this only when you cannot set headers. Do not write it into a file you share.",
            "minLength": 1,
            "type": "string"
          },
          "grant_id": {
            "description": "grant_id returned when the share was created.",
            "minLength": 1,
            "type": "string"
          }
        },
        "required": [
          "grant_id"
        ],
        "type": "object"
      },
      "name": "approve_share"
    },
    {
      "description": "Create a controlled download link for a file you own. Use this when a person or another agent should fetch the file. The response includes url and token ONCE, plus expires_at and max_opens. Save the url immediately. Later status calls do not return it. When expires_in_hours is omitted, the link expires in 7 days. Download with GET on that url. Requires your API key.",
      "inputSchema": {
        "$schema": "http://json-schema.org/draft-07/schema#",
        "additionalProperties": false,
        "properties": {
          "api_key": {
            "description": "Secret API key from signup. Prefer Authorization: Bearer <api_key>, the bare key in Authorization, or X-Handoff-Api-Key. Pass this only when you cannot set headers. Do not write it into a file you share.",
            "minLength": 1,
            "type": "string"
          },
          "audience": {
            "description": "anyone_with_link: whoever has the saved url. agent: only the registered agent_id in audience_value.",
            "enum": [
              "anyone_with_link",
              "agent"
            ],
            "type": "string"
          },
          "audience_value": {
            "description": "Required for agent: the recipient's registered agent_id. Example: their-agent",
            "maxLength": 320,
            "type": "string"
          },
          "expires_in_hours": {
            "description": "Hours until the link expires. Default 168 (7 days) when omitted.",
            "exclusiveMinimum": 0,
            "maximum": 87600,
            "type": "number"
          },
          "file_id": {
            "description": "File id returned by save_file or list_files.",
            "minLength": 1,
            "type": "string"
          },
          "max_opens": {
            "description": "Successful downloads allowed. The next one is refused.",
            "exclusiveMinimum": 0,
            "maximum": 2147483647,
            "type": "integer"
          },
          "requires_approval": {
            "default": false,
            "description": "When true, downloads wait until the owner approves the grant.",
            "type": "boolean"
          }
        },
        "required": [
          "file_id",
          "audience"
        ],
        "type": "object"
      },
      "name": "create_share_link"
    },
    {
      "description": "Delete a file you own. The bytes are removed and existing share links stop working. Requires your API key.",
      "inputSchema": {
        "$schema": "http://json-schema.org/draft-07/schema#",
        "additionalProperties": false,
        "properties": {
          "api_key": {
            "description": "Secret API key from signup. Prefer Authorization: Bearer <api_key>, the bare key in Authorization, or X-Handoff-Api-Key. Pass this only when you cannot set headers. Do not write it into a file you share.",
            "minLength": 1,
            "type": "string"
          },
          "file_id": {
            "description": "File id returned by save_file, list_files, or share_file.",
            "minLength": 1,
            "type": "string"
          }
        },
        "required": [
          "file_id"
        ],
        "type": "object"
      },
      "name": "delete_file"
    },
    {
      "description": "Deny an owned grant. A denied grant stays blocked. Requires your API key.",
      "inputSchema": {
        "$schema": "http://json-schema.org/draft-07/schema#",
        "additionalProperties": false,
        "properties": {
          "api_key": {
            "description": "Secret API key from signup. Prefer Authorization: Bearer <api_key>, the bare key in Authorization, or X-Handoff-Api-Key. Pass this only when you cannot set headers. Do not write it into a file you share.",
            "minLength": 1,
            "type": "string"
          },
          "grant_id": {
            "description": "grant_id of the share to deny.",
            "minLength": 1,
            "type": "string"
          }
        },
        "required": [
          "grant_id"
        ],
        "type": "object"
      },
      "name": "deny_share"
    },
    {
      "description": "Download a file from a share url or token. Use this when you were given a Handoff url and need the bytes. Honors expiry, open limits, approval, and agent audience. anyone_with_link needs no key. An agent audience uses your API key. Files up to 1048576 bytes return content_base64, plus content_text when the file is text. Larger files are not inlined: the error includes the byte size and tells you to GET the url. A successful inline return counts as an open. A file over the inline limit does not.",
      "inputSchema": {
        "$schema": "http://json-schema.org/draft-07/schema#",
        "additionalProperties": false,
        "properties": {
          "api_key": {
            "description": "Secret API key from signup. Prefer Authorization: Bearer <api_key>, the bare key in Authorization, or X-Handoff-Api-Key. Pass this only when you cannot set headers. Do not write it into a file you share.",
            "minLength": 1,
            "type": "string"
          },
          "url_or_token": {
            "description": "Share url returned by create_share_link, or the 64-character token.",
            "minLength": 1,
            "type": "string"
          }
        },
        "required": [
          "url_or_token"
        ],
        "type": "object"
      },
      "name": "fetch_shared_file"
    },
    {
      "description": "Read the latest 1000 access attempts for an owned grant, including refused downloads. Use this to see whether a share was opened. Requires your API key.",
      "inputSchema": {
        "$schema": "http://json-schema.org/draft-07/schema#",
        "additionalProperties": false,
        "properties": {
          "api_key": {
            "description": "Secret API key from signup. Prefer Authorization: Bearer <api_key>, the bare key in Authorization, or X-Handoff-Api-Key. Pass this only when you cannot set headers. Do not write it into a file you share.",
            "minLength": 1,
            "type": "string"
          },
          "grant_id": {
            "description": "grant_id of the share to audit.",
            "minLength": 1,
            "type": "string"
          }
        },
        "required": [
          "grant_id"
        ],
        "type": "object"
      },
      "name": "get_access_log"
    },
    {
      "description": "Read an owned grant: token_prefix (not the secret), audience, approval, expiry, revocation, and open_count. Does not download the file and does not return the share URL. Requires your API key.",
      "inputSchema": {
        "$schema": "http://json-schema.org/draft-07/schema#",
        "additionalProperties": false,
        "properties": {
          "api_key": {
            "description": "Secret API key from signup. Prefer Authorization: Bearer <api_key>, the bare key in Authorization, or X-Handoff-Api-Key. Pass this only when you cannot set headers. Do not write it into a file you share.",
            "minLength": 1,
            "type": "string"
          },
          "grant_id": {
            "description": "grant_id returned when the share was created.",
            "minLength": 1,
            "type": "string"
          }
        },
        "required": [
          "grant_id"
        ],
        "type": "object"
      },
      "name": "get_share_status"
    },
    {
      "description": "List this account's files, newest first, up to 1000. Use this to find a file_id before sharing. Returns metadata only, never bytes or download URLs. Requires your API key.",
      "inputSchema": {
        "$schema": "http://json-schema.org/draft-07/schema#",
        "additionalProperties": false,
        "properties": {
          "api_key": {
            "description": "Secret API key from signup. Prefer Authorization: Bearer <api_key>, the bare key in Authorization, or X-Handoff-Api-Key. Pass this only when you cannot set headers. Do not write it into a file you share.",
            "minLength": 1,
            "type": "string"
          }
        },
        "type": "object"
      },
      "name": "list_files"
    },
    {
      "description": "List grants you own. Pass file_id to limit the list to one file. Returns grant_id, status, open_count, max_opens, expires_at, and audience. Does not return tokens or download urls. Requires your API key.",
      "inputSchema": {
        "$schema": "http://json-schema.org/draft-07/schema#",
        "additionalProperties": false,
        "properties": {
          "api_key": {
            "description": "Secret API key from signup. Prefer Authorization: Bearer <api_key>, the bare key in Authorization, or X-Handoff-Api-Key. Pass this only when you cannot set headers. Do not write it into a file you share.",
            "minLength": 1,
            "type": "string"
          },
          "file_id": {
            "description": "Optional file id. Omit to list every grant on this account.",
            "minLength": 1,
            "type": "string"
          }
        },
        "type": "object"
      },
      "name": "list_shares"
    },
    {
      "description": "Permanently revoke an owned share. Later downloads fail. This cannot be undone and does not delete the file. Requires your API key.",
      "inputSchema": {
        "$schema": "http://json-schema.org/draft-07/schema#",
        "additionalProperties": false,
        "properties": {
          "api_key": {
            "description": "Secret API key from signup. Prefer Authorization: Bearer <api_key>, the bare key in Authorization, or X-Handoff-Api-Key. Pass this only when you cannot set headers. Do not write it into a file you share.",
            "minLength": 1,
            "type": "string"
          },
          "grant_id": {
            "description": "grant_id of the share to revoke.",
            "minLength": 1,
            "type": "string"
          }
        },
        "required": [
          "grant_id"
        ],
        "type": "object"
      },
      "name": "revoke_share"
    },
    {
      "description": "Save a private file for this account. Pass name and content_text or content_base64. Returns the file id and metadata. Does not share the file. Requires your API key.",
      "inputSchema": {
        "$schema": "http://json-schema.org/draft-07/schema#",
        "additionalProperties": false,
        "properties": {
          "api_key": {
            "description": "Secret API key from signup. Prefer Authorization: Bearer <api_key>, the bare key in Authorization, or X-Handoff-Api-Key. Pass this only when you cannot set headers. Do not write it into a file you share.",
            "minLength": 1,
            "type": "string"
          },
          "content_base64": {
            "description": "Standard or url-safe base64. A data:*;base64, prefix is stripped. Example: aGk=",
            "maxLength": 70000000,
            "type": "string"
          },
          "content_text": {
            "description": "UTF-8 text. Pass exactly one of content_text or content_base64.",
            "maxLength": 70000000,
            "type": "string"
          },
          "mime": {
            "description": "MIME type. Inferred from the file name when omitted.",
            "maxLength": 200,
            "pattern": "^[\\w.+-]+\\/[\\w.+-]+$",
            "type": "string"
          },
          "name": {
            "description": "File name with an extension. No slashes or control characters.",
            "maxLength": 255,
            "minLength": 1,
            "pattern": "^[^/\\\\\\x00-\\x1f]+$",
            "type": "string"
          }
        },
        "required": [
          "name"
        ],
        "type": "object"
      },
      "name": "save_file"
    },
    {
      "description": "Share a file in one call and get a download link. Pass name and content_text (or content_base64). Works without an API key: if none is sent, a new account is created and its api_key is returned once; save it to revoke the link or read the access log later. Default link: anyone with the link, expires in 7 days.",
      "inputSchema": {
        "$schema": "http://json-schema.org/draft-07/schema#",
        "additionalProperties": false,
        "properties": {
          "api_key": {
            "description": "Secret API key from signup. Prefer Authorization: Bearer <api_key>, the bare key in Authorization, or X-Handoff-Api-Key. Pass this only when you cannot set headers. Do not write it into a file you share.",
            "minLength": 1,
            "type": "string"
          },
          "audience": {
            "description": "Default anyone_with_link.",
            "enum": [
              "anyone_with_link",
              "agent"
            ],
            "type": "string"
          },
          "audience_value": {
            "description": "Required when audience is agent.",
            "maxLength": 320,
            "type": "string"
          },
          "content_base64": {
            "description": "Standard or url-safe base64. A data:*;base64, prefix is stripped. Example: aGk=",
            "maxLength": 70000000,
            "type": "string"
          },
          "content_text": {
            "description": "UTF-8 text. Pass exactly one of content_text or content_base64.",
            "maxLength": 70000000,
            "type": "string"
          },
          "expires_in_hours": {
            "description": "Hours until the link expires. Default 168 (7 days).",
            "exclusiveMinimum": 0,
            "maximum": 87600,
            "type": "number"
          },
          "max_opens": {
            "description": "Successful downloads allowed. Omit for no limit.",
            "exclusiveMinimum": 0,
            "maximum": 2147483647,
            "type": "integer"
          },
          "mime": {
            "description": "MIME type. Inferred from the file name when omitted.",
            "maxLength": 200,
            "pattern": "^[\\w.+-]+\\/[\\w.+-]+$",
            "type": "string"
          },
          "name": {
            "description": "File name with an extension. No slashes or control characters.",
            "maxLength": 255,
            "minLength": 1,
            "pattern": "^[^/\\\\\\x00-\\x1f]+$",
            "type": "string"
          },
          "ref": {
            "description": "Optional attribution label. Lowercase letters, digits, dot, underscore, or hyphen. At most 64 characters.",
            "maxLength": 64,
            "minLength": 1,
            "pattern": "^[a-z0-9._-]+$",
            "type": "string"
          },
          "requires_approval": {
            "description": "Default false. When true, downloads wait until the owner approves.",
            "type": "boolean"
          }
        },
        "required": [
          "name"
        ],
        "type": "object"
      },
      "name": "share_file"
    },
    {
      "description": "Create a Handoff account and return an API key once. No Authorization header is required. Save api_key. On later calls send Authorization: Bearer <api_key>, the bare key in Authorization, or X-Handoff-Api-Key. Pass api_key only if you cannot set headers. share_file can create this key for you. The key is a secret. Do not put it in a file you share.",
      "inputSchema": {
        "$schema": "http://json-schema.org/draft-07/schema#",
        "additionalProperties": false,
        "properties": {
          "agent_id": {
            "description": "Optional label, unique across Handoff. Letters, numbers, underscore, and hyphen.",
            "maxLength": 80,
            "minLength": 1,
            "pattern": "^[a-zA-Z0-9_-]+$",
            "type": "string"
          },
          "ref": {
            "description": "Optional attribution label. Lowercase letters, digits, dot, underscore, or hyphen. At most 64 characters.",
            "maxLength": 64,
            "minLength": 1,
            "pattern": "^[a-z0-9._-]+$",
            "type": "string"
          }
        },
        "type": "object"
      },
      "name": "signup"
    },
    {
      "description": "Set when an owned share expires. expires_in_hours is measured from now. Example: 168 for 7 days. Does not return the token. Requires your API key.",
      "inputSchema": {
        "$schema": "http://json-schema.org/draft-07/schema#",
        "additionalProperties": false,
        "properties": {
          "api_key": {
            "description": "Secret API key from signup. Prefer Authorization: Bearer <api_key>, the bare key in Authorization, or X-Handoff-Api-Key. Pass this only when you cannot set headers. Do not write it into a file you share.",
            "minLength": 1,
            "type": "string"
          },
          "expires_in_hours": {
            "exclusiveMinimum": 0,
            "maximum": 87600,
            "type": "number"
          },
          "grant_id": {
            "minLength": 1,
            "type": "string"
          }
        },
        "required": [
          "grant_id",
          "expires_in_hours"
        ],
        "type": "object"
      },
      "name": "update_share"
    }
  ]
}

What the leaf hashes

{"body":"8cb5176948affe39f3e3d3c362071ed2b164da021db103bb38f33d972cdaed72","id":1226264,"kind":"mcp.tools","method":"probe.mcp/1","observed_us":1793332957059767,"prev":null,"subject":"9b838915-81f1-42ca-b960-36e47a1cd150","subject_kind":"endpoint"}

Proof

Its day has not closed yet. A day closes ten minutes after midnight UTC; the proof appears here then.