← The evidence ledger
Evidence row 1236950
Observed , by probe.mcp/1.
- Kind
- mcp.tools
- About
- endpoint b8b6b6bb-3800-48dd-9cbc-052940cd49b3
- Recorded
- Previous row
- #813386
- Body SHA-256
- ed0796a75f8a9d0f9a6ccc1b15d2fdcbf424227c36f0135c7fcbdc5c8960a2e3
- Leaf
- 0x65f9c955986b86bcfdeb9a512d497ae05c1e40a0d4c9ce01a6946bbd8a931789
What was observed
{
"count": 14,
"tools": [
{
"description": "Check up to 100 domains or IPv4 addresses at once against ThreatCluster's high-confidence 30-day IOC feed; each domain is resolved and its IPv4 matched too. IOC only (no ransomware-claim lookups; use threat_check for one domain). Stale feed returns an error and is not charged. Costs $0.50 USDC per call via x402 (payment goes in _meta[\"x402/payment\"]); invalid input or an upstream failure returns an error and is not charged.",
"inputSchema": {
"$schema": "https://json-schema.org/draft/2020-12/schema",
"properties": {
"items": {
"description": "Up to 100 domains/IPv4, comma or newline separated",
"maxLength": 20000,
"minLength": 1,
"type": "string"
}
},
"required": [
"items"
],
"type": "object"
},
"name": "bulk_threat_check"
},
{
"description": "Check the TLS certificate of one hostname: issuer, validity dates, days left, % of lifetime used, renewal cadence and a renewal-stall flag, plus a live HTTPS pass/fail probe. Use it when you only need certificate health; use site_health for cert + DNS + expiry together, or domain_grade for a scored A-F result. Certificate details come from public Certificate Transparency logs (Cert Spotter, crt.sh fallback), not from the live connection, so a brand-new cert may not show yet. Read-only; makes one HTTPS request to the host and one CT-log query, usually 1-5 s. Costs $0.01 USDC per call via x402 (payment goes in _meta[\"x402/payment\"]); invalid input or an upstream failure returns an error and is not charged.",
"inputSchema": {
"$schema": "https://json-schema.org/draft/2020-12/schema",
"properties": {
"domain": {
"description": "Hostname or URL, e.g. example.com or https://www.example.com/path",
"maxLength": 300,
"minLength": 1,
"type": "string"
}
},
"required": [
"domain"
],
"type": "object"
},
"name": "check_cert"
},
{
"description": "Look up the live DNS of a domain: NS, A/AAAA/CNAME, MX, SPF, DMARC, CAA (climbing to the parent zone) and DNSSEC status, with plain-English findings. Use it for a DNS inventory or to debug resolution; use check_email_auth for a deeper SPF/DMARC/DKIM/MTA-STS review. Queries Cloudflare DNS-over-HTTPS (1.1.1.1) at call time; read-only, nothing is stored. Costs $0.01 USDC per call via x402 (payment goes in _meta[\"x402/payment\"]); invalid input or an upstream failure returns an error and is not charged.",
"inputSchema": {
"$schema": "https://json-schema.org/draft/2020-12/schema",
"properties": {
"domain": {
"description": "Hostname or URL, e.g. example.com or https://www.example.com/path",
"maxLength": 300,
"minLength": 1,
"type": "string"
}
},
"required": [
"domain"
],
"type": "object"
},
"name": "check_dns"
},
{
"description": "Check when a domain registration expires: registrar, registered and expiry dates, days left, EPP status codes and nameservers, from the registry's RDAP server. Use it for renewal risk on the registered domain (not the certificate; use check_cert for that). Some TLDs publish no RDAP service, in which case found=false explains why. Read-only. Costs $0.01 USDC per call via x402 (payment goes in _meta[\"x402/payment\"]); invalid input or an upstream failure returns an error and is not charged.",
"inputSchema": {
"$schema": "https://json-schema.org/draft/2020-12/schema",
"properties": {
"domain": {
"description": "Hostname or URL, e.g. example.com or https://www.example.com/path",
"maxLength": 300,
"minLength": 1,
"type": "string"
}
},
"required": [
"domain"
],
"type": "object"
},
"name": "check_domain_expiry"
},
{
"description": "Review the email authentication setup of a domain: SPF validity and DNS-lookup count (limit 10), DMARC policy, pct and reporting, DKIM on common selector names, MTA-STS mode, TLS-RPT and BIMI, with a rough 0-100 score and plain-English fixes. Use it before sending mail from a domain or when mail lands in spam. DKIM is only checked on common selectors, so \"not found\" is not proof DKIM is missing. Live DNS via Cloudflare DoH; read-only, no email is sent. Costs $0.01 USDC per call via x402 (payment goes in _meta[\"x402/payment\"]); invalid input or an upstream failure returns an error and is not charged.",
"inputSchema": {
"$schema": "https://json-schema.org/draft/2020-12/schema",
"properties": {
"domain": {
"description": "Hostname or URL, e.g. example.com or https://www.example.com/path",
"maxLength": 300,
"minLength": 1,
"type": "string"
}
},
"required": [
"domain"
],
"type": "object"
},
"name": "check_email_auth"
},
{
"description": "Check the HTTP security headers of a website with one live HTTPS GET: redirect chain (up to 5 hops), final status, HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy and COOP, with a simple A-F header grade and findings. Use it for web-hardening checks; it is not a vulnerability scan. The page body is not read or stored. Costs $0.01 USDC per call via x402 (payment goes in _meta[\"x402/payment\"]); invalid input or an upstream failure returns an error and is not charged.",
"inputSchema": {
"$schema": "https://json-schema.org/draft/2020-12/schema",
"properties": {
"domain": {
"description": "Hostname or URL, e.g. example.com or https://www.example.com/path",
"maxLength": 300,
"minLength": 1,
"type": "string"
}
},
"required": [
"domain"
],
"type": "object"
},
"name": "check_security_headers"
},
{
"description": "Grade a domain's security posture A-F in one call, for vendor-risk or due-diligence checks. Runs the TLS, DNS (DNSSEC, CAA), registration-expiry, email-auth and HTTP-header checks and returns one letter, a 0-100 score, points per category (TLS 25, email 25, headers 20, DNS 15, registration 15) and the top fixes. Use it when you want a verdict; use site_health or the single checks when you need raw data. Unavailable categories are left out of the percentage (partial=true). Read-only; takes about 3-10 s. Costs $0.03 USDC per call via x402 (payment goes in _meta[\"x402/payment\"]); invalid input or an upstream failure returns an error and is not charged.",
"inputSchema": {
"$schema": "https://json-schema.org/draft/2020-12/schema",
"properties": {
"domain": {
"description": "Hostname or URL, e.g. example.com or https://www.example.com/path",
"maxLength": 300,
"minLength": 1,
"type": "string"
}
},
"required": [
"domain"
],
"type": "object"
},
"name": "domain_grade"
},
{
"description": "Certificate and domain-registration expiry for 2 to 5 domains in one call: days left, expiry dates and an ok/warn/expired status per domain, plus the soonest date overall. Certificate dates come from CT logs, registration dates from RDAP. Partial results if some lookups fail; if every domain fails it returns an error and is not charged. Costs $0.04 USDC per call via x402 (payment goes in _meta[\"x402/payment\"]); invalid input or an upstream failure returns an error and is not charged.",
"inputSchema": {
"$schema": "https://json-schema.org/draft/2020-12/schema",
"properties": {
"domains": {
"description": "2 to 5 comma-separated domains, e.g. example.com,example.org",
"maxLength": 2000,
"minLength": 1,
"type": "string"
}
},
"required": [
"domains"
],
"type": "object"
},
"name": "expiry_batch"
},
{
"description": "Full site audit report for one domain, for client reports, vendor reviews or a pre-launch check. Runs every check (TLS from CT logs + live probe, DNS/DNSSEC/CAA, registration expiry and transfer lock, SPF/DMARC/DKIM/MTA-STS, security headers) plus HTTP->HTTPS redirect, www/apex consistency, RFC 9116 security.txt, robots.txt and sitemap. Returns the A-F grade and score (same weights as domain_grade), an action plan sorted critical > high > medium > low where each item has the exact fix and effort, and every raw section. Use domain_grade for just the letter. Fails (not charged) if 3+ core checks fail. Read-only; about 5-15 s. Costs $2 USDC per call via x402 (payment goes in _meta[\"x402/payment\"]); invalid input or an upstream failure returns an error and is not charged.",
"inputSchema": {
"$schema": "https://json-schema.org/draft/2020-12/schema",
"properties": {
"domain": {
"description": "Hostname or URL, e.g. example.com or https://www.example.com/path",
"maxLength": 300,
"minLength": 1,
"type": "string"
}
},
"required": [
"domain"
],
"type": "object"
},
"name": "full_site_audit"
},
{
"description": "Free. Return the price of every paid tool, the payment network (Base) and the receiving address, so you can budget before calling. No input, no network request, no payment.",
"inputSchema": {
"$schema": "https://json-schema.org/draft/2020-12/schema",
"properties": {},
"type": "object"
},
"name": "pricing"
},
{
"description": "Run check_cert, check_dns and check_domain_expiry together and return their raw results plus a short summary, the renewal-stall flag and the Let's Encrypt 64-day certificate note (from 2027-02-10). Use it for a full data dump in one call; use domain_grade if you want a single scored A-F answer that also covers email auth and HTTP headers. If one or two sources fail you get partial=true with the rest. Read-only. Costs $0.03 USDC per call via x402 (payment goes in _meta[\"x402/payment\"]); invalid input or an upstream failure returns an error and is not charged.",
"inputSchema": {
"$schema": "https://json-schema.org/draft/2020-12/schema",
"properties": {
"domain": {
"description": "Hostname or URL, e.g. example.com or https://www.example.com/path",
"maxLength": 300,
"minLength": 1,
"type": "string"
}
},
"required": [
"domain"
],
"type": "object"
},
"name": "site_health"
},
{
"description": "Is this domain known-bad? Resolves the hostname (A/AAAA), matches the name, its parent domains and resolved IPv4 against ThreatCluster's high-confidence 30-day IOC feed (cached, refreshed about hourly), and looks up ransomware leak-site claims naming the domain (commercially reusable sources via Dragons Eye). Returns verdict listed, claimed, listed_and_claimed or no_known_threat with the matching reports. No match is not proof of safety; claims are unverified attacker assertions. Stale feed or source failure returns an error and is not charged. Costs $0.02 USDC per call via x402 (payment goes in _meta[\"x402/payment\"]); invalid input or an upstream failure returns an error and is not charged.",
"inputSchema": {
"$schema": "https://json-schema.org/draft/2020-12/schema",
"properties": {
"domain": {
"description": "Hostname or URL, e.g. example.com or https://www.example.com/path",
"maxLength": 300,
"minLength": 1,
"type": "string"
}
},
"required": [
"domain"
],
"type": "object"
},
"name": "threat_check"
},
{
"description": "Free. Check that a domain or URL is well-formed and get the normalized hostname, before calling a paid check. Offline: no network request, no payment. Rejects IP addresses, single-label names and URLs with credentials.",
"inputSchema": {
"$schema": "https://json-schema.org/draft/2020-12/schema",
"properties": {
"domain": {
"description": "Hostname or URL to normalize, e.g. example.com or https://www.example.com/path",
"maxLength": 300,
"type": "string"
}
},
"required": [
"domain"
],
"type": "object"
},
"name": "validate_target"
},
{
"description": "Free. Status of a paid domain watch (created with HTTP POST /v1/watch): items, expiry, last check, current DNS/IOC/claim state, last webhook delivery. Needs the webhook_secret from creation.",
"inputSchema": {
"$schema": "https://json-schema.org/draft/2020-12/schema",
"properties": {
"watch_id": {
"description": "Watch id, e.g. ocw_abcdefghijklmnop",
"pattern": "^ocw_[a-z2-7]{16}$",
"type": "string"
},
"webhook_secret": {
"description": "The webhook_secret returned once when the watch was created (required to read status)",
"maxLength": 200,
"minLength": 8,
"type": "string"
}
},
"required": [
"watch_id",
"webhook_secret"
],
"type": "object"
},
"name": "watch_status"
}
]
}What the leaf hashes
{"body":"ed0796a75f8a9d0f9a6ccc1b15d2fdcbf424227c36f0135c7fcbdc5c8960a2e3","id":1236950,"kind":"mcp.tools","method":"probe.mcp/1","observed_us":1793350651631064,"prev":813386,"subject":"b8b6b6bb-3800-48dd-9cbc-052940cd49b3","subject_kind":"endpoint"}Proof
Fold these into the leaf in order, hashing each sorted pair with keccak256, to reach the root of (243099 rows).
- 0x65f970a9e358508281398a2c3f72f7ff8ccc66fb74cdeed7d2b2b59923b84f2b
- 0x5d4340dfe710eefdfa39c2960adad8492ccdd50aea78e9e12da0440568bc99ae
- 0x951aa56d19f54eb43ef6e2576516efdaa318e5dce943945b8592043b574661df
- 0x0c6af31bd4b7a3df18a425e0c0c4a52b76da42a531408e7294dd67f7b88cd04b
- 0x9bf9fc2710007986fd3ea1f35fd7d5008b8538005d5a62d143b86fa7afe08634
- 0x0f5a0aa94a32f54c5a9e366cd0e77b0068be88628d0e68cfe2366f748d82e812
- 0x0b052139d41475d0c154b4556019ce7e224f05498001411dfa7e3aed95d17c7b
- 0x470478713c66db427a73690e3998e99562711ed05630288b365fe6e24bd85229
- 0x6320ed9e0c1f3bf00cdca41762560feb6b9427ac89a1ade45a98fd55a53a48a1
- 0x551eab5fa788c1eb9ade1cc6d45d694ae1e94fb82d050d68ea7e6ecb1e2ebaf9
- 0x45b5fa20173e33b6efcfa5c61b7e4cdb9227ff5948688c2cd71b5b042c2dce47
- 0x159587e892da6eb5bedb2c98f52a2e67d73c1054bada2bc226e29532864a24ba
- 0x71866e46af973a0dfdc12482585dfcdbcf016f95832fc06f75f5454e82088a3e
- 0x863694f188c4b3bb5062c468823f130a2c1762c9b6bf2ce9a68fd27f465427d0
- 0x7ecc532de10b728de98de2eb2a81fbd8da2254ff32b38b6ffde14af9964fc470
- 0x910a91495535ac1a9e959d27d607e185616d2d41b45bc7071c6357f426f372d8
- 0xffe660edb9e5c6e3449a49454634c3e7b2f9fe703e5697f723b021735647ab7e
- 0x30a81d8fcef4e8f9e2877c62796cfc5612fc1b251127d531dee28f8dbd5c5147
- Day root
- 0x0826c7ad6039e06a2360ca0a4a3a4fe7f2626c6dc19f71a37599386f78b39875
- Chained
- 0x36b4c8a1063758f0b8765fa1bdf75fa92fb543cc183add3e261880ee2bd1f822
- Published
- On Arc Testnet, block 69923247: 0x8704744146c6967c8abc9e9a99de4db7283b29e840922ea83a69b6fe776e6861