← The evidence ledger
Evidence row 209406
Observed , by probe.mcp/1.
- Kind
- mcp.tools
- About
- endpoint fd780c34-ee71-48b9-a334-c41ce2655953
- Recorded
- Previous row
- None: the first of its kind about this subject
- Body SHA-256
- afc9ee8dcdcafaab5eecdb04854bc6a3f17670aa868fdfda4fa82f195b1eaefb
- Leaf
- 0x513e2a7ede79c48f69134a1250c5c44c06049fc57bac5e8304a55eec7c4e4d62
What was observed
{
"count": 18,
"tools": [
{
"description": "Alert history for an agent: budget warnings (80% threshold) and spending spikes.\n\nRequires a credential: either the agent's own agent_secret or its\nworkspace's workspace_key (same rule as GET /v1/alerts).",
"inputSchema": {
"additionalProperties": false,
"properties": {
"agent_id": {
"description": "unique agent identifier",
"type": "string"
},
"agent_secret": {
"default": "",
"description": "the agent's own secret (either this or workspace_key)",
"type": "string"
},
"workspace_key": {
"default": "",
"description": "the owning workspace's key (either this or agent_secret)",
"type": "string"
}
},
"required": [
"agent_id"
],
"type": "object"
},
"name": "ledger_alerts"
},
{
"description": "Self-serve documentation for AgentLedger — quickstart, MCP tools, REST\nendpoints, budget caps, error codes, and idempotency usage, as markdown.",
"inputSchema": {
"additionalProperties": false,
"properties": {
"topic": {
"default": "",
"description": "\"quickstart\" | \"mcp\" | \"rest\" | \"budget\" | \"errors\" | \"idempotency\" | \"metering\" | \"events\" | \"all\"\n (default \"\" == \"all\"). Unknown topics fall back to the full docs.",
"type": "string"
}
},
"type": "object"
},
"name": "ledger_api_docs"
},
{
"description": "Approve or deny a pending spend permit — workspace owner only.\n\nThe agent's own agent_secret can REQUEST an approval but can never decide\none: a credential that can approve its own requests is not a control.\ndecision must be 'approve' or 'deny'; only pending permits can be decided.\nAn approved permit is consumed by the agent's next ledger_track within\nits amount — it is a one-shot exception, not a raised cap.",
"inputSchema": {
"additionalProperties": false,
"properties": {
"agent_id": {
"description": "the agent that requested the permit",
"type": "string"
},
"approval_id": {
"description": "the apr_ id from ledger_request_approval / ledger_approvals",
"type": "string"
},
"decision": {
"description": "'approve' or 'deny'",
"type": "string"
},
"workspace_key": {
"description": "the key of the workspace that owns the agent",
"type": "string"
}
},
"required": [
"agent_id",
"approval_id",
"decision",
"workspace_key"
],
"type": "object"
},
"name": "ledger_approval_decide"
},
{
"description": "List spend-approval permits — yours, or your whole workspace's.",
"inputSchema": {
"additionalProperties": false,
"properties": {
"agent_id": {
"default": "",
"description": "list this agent's permits (needs agent_secret or workspace_key)",
"type": "string"
},
"agent_secret": {
"default": "",
"description": "the agent's own secret (agent view)",
"type": "string"
},
"state": {
"default": "",
"description": "optional filter: pending | approved | denied | consumed | expired",
"type": "string"
},
"workspace_key": {
"default": "",
"description": "the owning workspace's key — lists ALL its agents'\n permits when given alone",
"type": "string"
}
},
"type": "object"
},
"name": "ledger_approvals"
},
{
"description": "Ask BEFORE you spend: may this agent spend this much right now?\n\nReturns allowed (true/false), a stable reason code (within_budget,\nover_monthly_cap, over_daily_cap, over_monthly_token_cap,\nover_daily_token_cap, no_budget_set, unpriced_model), a one-line message,\nthe cost estimate, the price used (with its source and as_of date) and\nevery budget window with cap, spent and remaining.\n\nSame decision the /proxy/{provider} gate enforces. Read-only: nothing is\nrecorded or reserved, so record the spend with ledger_track afterwards.\n\nGive exactly one spend shape: amount_cents (any rail, e.g. an x402\npurchase), OR model with tokens_in/tokens_out.",
"inputSchema": {
"additionalProperties": false,
"properties": {
"agent_id": {
"description": "the agent that would spend",
"type": "string"
},
"agent_secret": {
"default": "",
"description": "the agent's own secret (either this or workspace_key)",
"type": "string"
},
"amount_cents": {
"anyOf": [
{
"type": "integer"
},
{
"type": "null"
}
],
"default": null,
"description": "the spend in cents, if you already know it"
},
"model": {
"default": "",
"description": "model id to price from tokens (instead of amount_cents)",
"type": "string"
},
"tokens_in": {
"default": 0,
"description": "expected input tokens (with model)",
"type": "integer"
},
"tokens_out": {
"default": 0,
"description": "expected output tokens, e.g. your max_tokens (with model)",
"type": "integer"
},
"workspace_key": {
"default": "",
"description": "the owning workspace's key (either this or agent_secret)",
"type": "string"
}
},
"required": [
"agent_id"
],
"type": "object"
},
"name": "ledger_check_spend"
},
{
"description": "Complete, runnable Python recipe for a common AgentLedger integration\npattern.",
"inputSchema": {
"additionalProperties": false,
"properties": {
"pattern": {
"description": "\"python_tracking\" | \"budget_enforcement\" | \"weekly_report\" |\n \"retry_safe_writes\"",
"type": "string"
}
},
"required": [
"pattern"
],
"type": "object"
},
"name": "ledger_examples"
},
{
"description": "What will this call cost? Priced from the same table the caps use.\n\nExists because ledger_track requires the CALLER to supply amount_cents, so an\nagent whose spend is capped could under-report its own cost and stay under\nthe cap. This returns the number the enforcement path would use, so an agent\ncan report honestly (and plan before it spends).\n\nCost = (tokens_in * in_rate + tokens_out * out_rate) / 1_000_000. If the\nmodel has cache rates, the standard in-rate is used, which is the\nconservative direction for a spend cap.\n\nEvery price carries the source it came from and the date it was read, and\n`verified: false` means the number was NOT read off the provider's own\npricing page. Treat an unverified price as an estimate, not a measurement.",
"inputSchema": {
"additionalProperties": false,
"properties": {
"model": {
"description": "the model id you are about to call (e.g. gpt-4o, claude-sonnet-4)",
"type": "string"
},
"tokens_in": {
"default": 0,
"description": "expected input tokens",
"type": "integer"
},
"tokens_out": {
"default": 0,
"description": "expected output tokens, e.g. your max_tokens",
"type": "integer"
}
},
"required": [
"model"
],
"type": "object"
},
"name": "ledger_price"
},
{
"description": "Point your provider traffic at the proxy so budget caps are enforced\nBEFORE the provider is contacted, instead of being reported afterwards.\n\nThis closes the gap where the brake was unreachable from MCP: an agent\nconnected over MCP could record spend (ledger_track) but nothing could\nrefuse a call. With this, the cap is enforced on every LLM call.\n\nReturns the base_url to use, the two headers to send, and the exact change\nfor the OpenAI and Anthropic SDKs. Your provider credential is NOT part of\nthis: it stays in Authorization / x-api-key and is only forwarded, never\nstored.",
"inputSchema": {
"additionalProperties": false,
"properties": {
"agent_id": {
"description": "the agent whose budget the proxied calls are billed to",
"type": "string"
},
"agent_secret": {
"default": "",
"description": "the agent's own secret (either this or workspace_key)",
"type": "string"
},
"provider": {
"default": "openai",
"description": "which upstream to proxy: openai or anthropic",
"type": "string"
},
"workspace_key": {
"default": "",
"description": "the owning workspace's key (either this or agent_secret)",
"type": "string"
}
},
"required": [
"agent_id"
],
"type": "object"
},
"name": "ledger_proxy_attach"
},
{
"description": "Spend report for an agent over a rolling window.\n\nReturns total spend, breakdown by rail and by service, budget status\n(ok/warning/exceeded), detected anomalies, and entry count.\n\nRequires a credential: either the agent's own agent_secret or its\nworkspace's workspace_key (same rule as GET /v1/report).",
"inputSchema": {
"additionalProperties": false,
"properties": {
"agent_id": {
"description": "unique agent identifier",
"type": "string"
},
"agent_secret": {
"default": "",
"description": "the agent's own secret (either this or workspace_key)",
"type": "string"
},
"days": {
"default": 30,
"description": "report window in days (default 30)",
"type": "integer"
},
"workspace_key": {
"default": "",
"description": "the owning workspace's key (either this or agent_secret)",
"type": "string"
}
},
"required": [
"agent_id"
],
"type": "object"
},
"name": "ledger_report"
},
{
"description": "Ask your workspace owner for a one-shot spend exception before a\nledger_track that the cap would refuse.\n\nCreates a pending permit for exactly amount_cents on the given service.\nThe owner (a human, or a supervisor agent holding the workspace_key)\napproves or denies it with ledger_approval_decide. An APPROVED permit is\nconsumed by the next ledger_track for this agent whose amount fits inside\nit — the budget cap itself does not change. Permits expire after 1 hour\nundecided. Poll with ledger_approvals to see the decision.\n\nClaiming a brand-new agent_id requires workspace_key; otherwise pass the\nagent's agent_secret.",
"inputSchema": {
"additionalProperties": false,
"properties": {
"agent_id": {
"description": "the agent asking for the exception",
"type": "string"
},
"agent_secret": {
"default": "",
"description": "the agent's own secret (either this or workspace_key)",
"type": "string"
},
"amount_cents": {
"description": "the spend to be approved, in cents",
"type": "integer"
},
"reason": {
"default": "",
"description": "why, one line — shown to the approver",
"type": "string"
},
"service": {
"description": "what the money is for (e.g. \"openai:gpt-5 batch eval\")",
"type": "string"
},
"workspace_key": {
"default": "",
"description": "the owning workspace's key (either this or agent_secret)",
"type": "string"
}
},
"required": [
"agent_id",
"amount_cents",
"service"
],
"type": "object"
},
"name": "ledger_request_approval"
},
{
"description": "Invalidate an agent_id's agent_secret WITHOUT deleting its spend history.\n\nUse when a credential may have leaked, or to stop an agent writing.\nSubsequent writes to that agent fail with agent_secret_mismatch until you\nrotate a new secret in. The agent_id stays claimed, so no other workspace\ncan claim it and inherit the ledger. Requires the workspace_key that owns\nagent_id.\n\nReturns {\"agent_id\", \"revoked\": True, \"_note\"}, or {\"error\", \"error_code\"}.",
"inputSchema": {
"additionalProperties": false,
"properties": {
"agent_id": {
"type": "string"
},
"workspace_key": {
"type": "string"
}
},
"required": [
"agent_id",
"workspace_key"
],
"type": "object"
},
"name": "ledger_revoke_secret"
},
{
"description": "Mint a NEW agent_secret for an agent_id your workspace already owns, invalidating the old one.\n\nUse this to RECOVER an agent whose secret was lost: the previous credential\nstops working immediately. Requires the workspace_key that owns agent_id —\nan agent's own agent_secret cannot rotate itself, because a leaked agent\ncredential must not be able to lock its real owner out. Unlike ledger_track\nthis never claims a new agent_id: an unknown id returns agent_not_claimed.\n\nThe new secret is returned ONCE. Store it before you drop the response.\n\nReturns {\"agent_id\", \"agent_secret\", \"_note\"}, or {\"error\", \"error_code\"}.",
"inputSchema": {
"additionalProperties": false,
"properties": {
"agent_id": {
"type": "string"
},
"workspace_key": {
"type": "string"
}
},
"required": [
"agent_id",
"workspace_key"
],
"type": "object"
},
"name": "ledger_rotate_secret"
},
{
"description": "Set spending caps for an agent. Warns at 80%, blocks spend when exceeded\n— enforced: a ledger_track call that would cross the cap is rejected.\n\nDollar caps (monthly_cents/daily_cents) and token caps (monthly_tokens/\ndaily_tokens) are independent dimensions: dollar caps only cover\nnon-\"tokens\" rails, token caps only cover rail=\"tokens\" bookkeeping rows\n(tokens_in/tokens_out). Set both if the agent uses both.\n\nMonthly cap is required; the rest are optional (0 = no limit).\nOverwrites any existing budget for the agent — with one rule: raising\nor removing an existing cap requires the workspace_key. An agent_secret\ncan tighten its own caps but never loosen them; to grow an allowance\nthe agent asks its owner (see ledger_request_approval). Claiming a\nbrand-new agent_id requires your workspace_key; that first call mints an\nagent_secret (returned once — save it); later calls for that agent_id\nmust pass the agent_secret back (no workspace_key needed again).",
"inputSchema": {
"additionalProperties": false,
"properties": {
"agent_id": {
"description": "unique agent identifier",
"type": "string"
},
"agent_secret": {
"default": "",
"description": "required for every call after the first for this agent_id",
"type": "string"
},
"daily_cents": {
"default": 0,
"description": "daily spending cap in cents (0 = no daily cap)",
"type": "integer"
},
"daily_tokens": {
"default": 0,
"description": "daily token-burn cap (0 = no cap)",
"type": "integer"
},
"monthly_cents": {
"description": "monthly spending cap in cents",
"type": "integer"
},
"monthly_tokens": {
"default": 0,
"description": "monthly token-burn cap (0 = no cap)",
"type": "integer"
},
"workspace_key": {
"default": "",
"description": "required when claiming a brand-new agent_id; not\n needed once the agent_id has been claimed",
"type": "string"
}
},
"required": [
"agent_id",
"monthly_cents"
],
"type": "object"
},
"name": "ledger_set_budget"
},
{
"description": "Get a FREE AgentLedger workspace with no credential and no arguments —\nthe MCP equivalent of opening POST /start in a browser.\n\nCall this FIRST if you have no credentials yet. Every other tool here\n(ledger_track, ledger_set_budget, ledger_report, ledger_alerts) needs a\nworkspace_key or an agent_secret, so a caller arriving with neither must\nstart here or it has nowhere to go.\n\nTakes NO arguments on purpose: the goal is zero friction. It returns a\n`workspace_key` (shown exactly once — it cannot be re-revealed, so store it\nbefore continuing) which you then send as `workspace_key` on your first\nledger_track for a NEW agent_id. That first write returns the agent's own\n`agent_secret`, which authenticates every write after it.\n\nThe free tier includes every rail, enforced budget caps, alerts, reports and\nthe MCP server, capped at 3 agents per workspace. Minting is rate-limited\nper caller IP, the same limit the human door uses.\n\nPrefer to pay? POST /v1/billing/x402 with a wallet-signed payment needs no\nhuman and buys 24h of Pro (agent allowance per the live pass tier — see\n/pricing.md).",
"inputSchema": {
"additionalProperties": false,
"properties": {},
"type": "object"
},
"name": "ledger_start"
},
{
"description": "Record a spend entry for an AI agent on any payment rail, with optional token counts.\n\nClaiming a brand-new agent_id requires your workspace_key (get one via\nx402 at POST /v1/billing/x402 — no human, no login — or at /start).\nThat first call mints an\nagent_secret and returns it in the response — save it, every later call\nfor that same agent_id must pass it back (no workspace_key needed again)\nor the write is rejected. Amounts are capped\nat $100,000/entry and must be >= 0. If a budget is set for this agent,\nan entry that would cross the monthly/daily cap is blocked, not just\nlogged. Caps here bind the AMOUNT YOU REPORT — a caller that lies to\namount_cents lies to the cap. The only enforcement against real spend is\nrouting the provider call through the /proxy/{provider} rail, which\nprices from the provider's own usage block. Include tokens_in/tokens_out + model on every LLM call so token\nburn shows up in the /v1/tokens report.",
"inputSchema": {
"additionalProperties": false,
"properties": {
"agent_id": {
"description": "unique agent identifier (e.g. \"research-agent-v2\")",
"type": "string"
},
"agent_secret": {
"default": "",
"description": "required for every call after the first for this agent_id",
"type": "string"
},
"amount_cents": {
"description": "spend amount in cents (100 = $1.00), 0-10000000",
"type": "integer"
},
"model": {
"default": "",
"description": "model name (e.g. \"gpt-4o\") — token burn is reported per model",
"type": "string"
},
"rail": {
"description": "payment rail used — one of \"mpp\", \"x402\", \"api_key\", \"manual\"",
"type": "string"
},
"service": {
"description": "what was purchased (e.g. \"search_query\", \"data_export\")",
"type": "string"
},
"tokens_in": {
"default": 0,
"description": "prompt tokens consumed (0 if unknown)",
"type": "integer"
},
"tokens_out": {
"default": 0,
"description": "completion tokens consumed (0 if unknown)",
"type": "integer"
},
"workspace_key": {
"default": "",
"description": "required when claiming a brand-new agent_id; not\n needed once the agent_id has been claimed",
"type": "string"
}
},
"required": [
"agent_id",
"rail",
"amount_cents",
"service"
],
"type": "object"
},
"name": "ledger_track"
},
{
"description": "Long-poll an agent's event feed — how an agent with no public URL receives alerts.\n\nWebhooks (POST /v1/webhooks) push events to a URL you own; an agent on\nstdio MCP cannot host one, so it waits here instead. Call this in a loop:\nthe call holds open up to `timeout` seconds (max 30) and returns when\nevents arrive or the wait lapses.\n\n`consumer_id` names this consumer durably — pick a stable one\n(e.g. \"claude-code-main\") and reuse it. Each call returns a `cursor`;\npass it back on your next call once you have processed that batch — that\nis the ack. To get restart redelivery, also pass `client_instance` (your\nprocess id or any per-boot token) and `client_started` (when your\nprocess booted): when the pair changes, events that were served but\nnever acked come back with `redelivered: true`, so nothing is lost to a\ncrash between serve and process. (The stdio MCP server supplies its own\npid/started automatically — hosted callers must opt in because the\ngateway cannot see the client's process.)\n\nEach event is an envelope: id (deterministic — dedupe on it), kind\n(alert.raised | budget.warning | budget.exceeded | anomaly.detected),\nsummary, context (agent_id, alert_type, timestamp),\nalerts_since_last_write (how many alerts are stacked up since the\nagent's last spend write — use it to throttle escalation), redelivered.\n\nRequires a credential: either the agent's own agent_secret or its\nworkspace's workspace_key (same rule as GET\n/v1/agents/{agent_id}/events/wait).",
"inputSchema": {
"additionalProperties": false,
"properties": {
"agent_id": {
"description": "unique agent identifier",
"type": "string"
},
"agent_secret": {
"default": "",
"description": "the agent's own secret (either this or workspace_key)",
"type": "string"
},
"client_instance": {
"default": "",
"description": "your process identity (e.g. pid or per-boot token) —\nenables restart redelivery",
"type": "string"
},
"client_started": {
"default": "",
"description": "when your process booted — paired with client_instance",
"type": "string"
},
"consumer_id": {
"description": "durable name for this consumer (1-64 chars, [A-Za-z0-9._-])",
"type": "string"
},
"cursor": {
"anyOf": [
{
"type": "integer"
},
{
"type": "null"
}
],
"default": null,
"description": "line offset you have processed through (omit to continue)"
},
"name": {
"default": "mcp",
"description": "optional label for this consumer instance",
"type": "string"
},
"timeout": {
"anyOf": [
{
"type": "number"
},
{
"type": "null"
}
],
"default": null,
"description": "seconds to hold the call open (default 5, max 30)"
},
"workspace_key": {
"default": "",
"description": "the owning workspace's key (either this or agent_secret)",
"type": "string"
}
},
"required": [
"agent_id",
"consumer_id"
],
"type": "object"
},
"name": "ledger_wait_events"
},
{
"description": "Read a product skill file by its skill:// URI.",
"inputSchema": {
"additionalProperties": false,
"properties": {
"uri": {
"description": "e.g. skill://<product>/<skill-name>/SKILL.md\n Get valid URIs from `skills_list_tool`.",
"type": "string"
}
},
"required": [
"uri"
],
"type": "object"
},
"name": "read_skill"
},
{
"description": "List this product's skills. Each entry carries the SKILL.md URI,\nits name and description, verbatim frontmatter, and a per-file\nsha256 manifest. Read a body with `read_skill`.",
"inputSchema": {
"additionalProperties": false,
"properties": {},
"type": "object"
},
"name": "skills_list_tool"
}
]
}What the leaf hashes
{"body":"afc9ee8dcdcafaab5eecdb04854bc6a3f17670aa868fdfda4fa82f195b1eaefb","id":209406,"kind":"mcp.tools","method":"probe.mcp/1","observed_us":1793026416449547,"prev":null,"subject":"fd780c34-ee71-48b9-a334-c41ce2655953","subject_kind":"endpoint"}Proof
Fold these into the leaf in order, hashing each sorted pair with keccak256, to reach the root of (296695 rows).
- 0x513e2fd7a5c0464661e1e3dad7a55c679e61afef254b043348b3d04951f05f02
- 0x9d58528364403adbf5f4cbd4c1c671beb59db019872279afe109d08d3bf862b7
- 0x006c0c2c1535e74e80fbe188e3536df82d79977c6fe76e6170ee0f354f811f95
- 0x272bae824da77538e9545f227d071207fbdb941d8927be5ee57b01725e5a6bb4
- 0x7042c8345a48d9305e644bd705b8d05654c9d758c9eb83810a11317737698847
- 0x8fcd6f26dfcaa35ad95f34d5360c54e4b5674d671e66d3313d74b13f31aa0dcf
- 0x6752ad4a090e5fcd1395b4bb99f68c6576eec2edd0461b5ea20a9e1bd937d390
- 0xa633125f2c229e0244fd5725f703550ecec40216f4be7493148cfeaa047cee1c
- 0x1219ece7149e94c27319a4926c9146cd0e1ddc72b40654dfa47e0b42d5fbb1ef
- 0x645ef58b69b469e4c309b22dfe9ca3f972fe60aa617a1dcb95a02418c0d9270c
- 0xfa039eb62e5d0ae9f7aaaafb0fcbceacfa661b07228233046b9a9af94e547a55
- 0xecaf47ba75097c34f2d3c4d62539dace0db8b484bf08941a9259e2d1e8ccea77
- 0xf7d2cf278e5d2768b8bdb70730c378877cf7165d8efcbec8bcd3282fdc50d177
- 0x0733993143f0230e79482cef2c38e95d98f9eafbe64a43cdc74a4545938a4167
- 0x2be1e80e065dd6b2cc75a7142be22225acd144ac975d70bf24b4f01fd76dc497
- 0x2e6a32eb32761c210560e852405e2f865f958ddbe01027894f8b9c1b3433b9f0
- 0x9a83be955a206deb65b995adfd92c58fa31c95fbbf926bd199d300e70b08b26d
- 0x20704208aa6923d6b2450ef74ede87a6e0265d46447926038fe9506e9e154b2d
- 0x9b9ce5b74b9bab5121612ef6b64920a8d453cbf311096a423eef9702747e868a
- Day root
- 0xf43e8dcc3d451a4788b26be904c55e8c4c0fa75c9666796c51db38d37e2c0df8
- Chained
- 0x702d5ac508f08b0d1accf36af25822d8e5660367494edd17a642fb61e158a57a
- Published
- On Arc Testnet, block 69251483: 0x495162f8936e19f0039918feebe6c307f327cd6bf8c37219620b1970041fa9ae