Evidence row 218507

What was observed

{
  "count": 6,
  "tools": [
    {
      "description": "Use to inspect a supplied PEM certificate bundle before TLS configuration. Accept pem with 1–16 CERTIFICATE blocks and at most 49152 UTF-8 bytes, optional ASCII DNS hostname, and optional zero-based leafIndex. Reject private keys and unsupported blocks without echoing them. Return original certificate positions, Subject, Issuer, Common Name, SANs, validity, CA and Key Usage flags, SHA-256 fingerprints, independently checked candidate links, explicit leaf ambiguity, and stable findings with severity, observed evidence, and nextAction. Verify signatures cryptographically; name matching alone is not verification. Missing selected-leaf issuers and blocked requested hostname checks are warnings; other missing issuers are informational because roots are commonly omitted. All explicitly rejected supplied issuer candidates for the selected leaf produce an error. Unknown checks and key-identifier mismatches alone do not produce that error. A failed candidate does not invalidate another viable link. Verified self-issued CA key rollover is informational; verification with the certificate's own public key remains separate. Hostname checks use DNS SAN with one-label complete leftmost wildcards and no Common Name fallback. Results use this server's evaluation time and do not establish client trust, full RFC 5280 path validity, revocation status, or deployment safety. This remote call transmits certificates and hostname to the server; the website checks locally. Certificate input and details never enter application logs. Do not submit private keys. Operational events record the tool name, success or error, a controlled error code, and a traffic source classification. Verified automated checks may also record an automation run identifier. Events exclude inputs, results, raw request headers, and automation tokens. Cloudflare may attach platform metadata. Privacy policy: https://packetrove.com/privacy.",
      "inputSchema": {
        "$schema": "https://json-schema.org/draft/2020-12/schema",
        "additionalProperties": false,
        "properties": {
          "hostname": {
            "description": "Optional ASCII DNS hostname, including pre-converted IDNA A-labels. No URL, port, IP address, or wildcard. Blank skips identity checking.",
            "maxLength": 255,
            "type": "string"
          },
          "leafIndex": {
            "description": "Zero-based original position of a non-CA certificate. Required to resolve multiple possible leaves for hostname checking.",
            "maximum": 15,
            "minimum": 0,
            "type": "integer"
          },
          "pem": {
            "description": "One or more PEM CERTIFICATE blocks, with only whitespace between blocks. At most 48 KiB of UTF-8 and 16 blocks. Private keys and other block types are rejected.",
            "maxLength": 49152,
            "type": "string"
          }
        },
        "required": [
          "pem"
        ],
        "type": "object"
      },
      "name": "certificate-bundle"
    },
    {
      "description": "Use when combining a selected group of firewall allowlist or blocklist entries into one smallest covering CIDR, or when checking the exact extra coverage. Accept 1 to 1,000 IP addresses or CIDRs from one address family, up to 64 characters each; normalize host bits and count overlaps once. Return the canonical CIDR, inclusive range, and exact decimal-string counts, including additionalAddressCount. The range may allow or block additional addresses. This computes one CIDR for the supplied inputs; it does not optimize an entire list against an entry limit or change firewall rules. Remote MCP calls submit inputs to this server; the calculation makes no outbound network requests. Operational events record the tool name, success or error, a controlled error code, and a traffic source classification. Verified automated checks may also record an automation run identifier. Events exclude inputs, results, raw request headers, and automation tokens. Cloudflare may attach platform metadata. Privacy policy: https://packetrove.com/privacy.",
      "inputSchema": {
        "$schema": "https://json-schema.org/draft/2020-12/schema",
        "additionalProperties": false,
        "properties": {
          "inputs": {
            "description": "IP addresses or CIDRs from one address family. Surrounding whitespace is ignored during parsing; CIDRs with host bits are normalized.",
            "items": {
              "maxLength": 64,
              "minLength": 1,
              "type": "string"
            },
            "maxItems": 1000,
            "minItems": 1,
            "type": "array"
          }
        },
        "required": [
          "inputs"
        ],
        "type": "object"
      },
      "name": "cidr-cover"
    },
    {
      "description": "Use to prepare WireGuard AllowedIPs exceptions or calculate remaining address space relative to supplied include and exclude lists. Compute union(include) minus union(exclude) as a minimal sorted canonical CIDR list, without adding addresses. Use one address family, a nonempty include list, and at most 1000 entries across both lists, up to 64 characters each. Exclude may be empty. Normalize host bits and count overlaps once. Return cidrs, normalizedInclude, normalizedExclude, and exact decimal-string includedAddressCount, removedAddressCount, remainingAddressCount. Complete removal returns an empty list; more than 10000 output CIDRs returns an error without a partial result. Error issues identify include or exclude and the zero-based entry index. Remote calls submit inputs to this server; the browser calculates locally. This does not inspect live allocation, configure WireGuard, or change firewall rules. Operational events record the tool name, success or error, a controlled error code, and a traffic source classification. Verified automated checks may also record an automation run identifier. Events exclude inputs, results, raw request headers, and automation tokens. Cloudflare may attach platform metadata. Privacy policy: https://packetrove.com/privacy.",
      "inputSchema": {
        "$schema": "https://json-schema.org/draft/2020-12/schema",
        "additionalProperties": false,
        "properties": {
          "exclude": {
            "description": "Ranges to remove from the included address space. An empty array simplifies the exact include union.",
            "items": {
              "maxLength": 64,
              "minLength": 1,
              "type": "string"
            },
            "maxItems": 1000,
            "type": "array"
          },
          "include": {
            "description": "The nonempty included address space. Use at most 1,000 entries across include and exclude, from one address family.",
            "items": {
              "maxLength": 64,
              "minLength": 1,
              "type": "string"
            },
            "maxItems": 1000,
            "minItems": 1,
            "type": "array"
          }
        },
        "required": [
          "include",
          "exclude"
        ],
        "type": "object"
      },
      "name": "cidr-subtract"
    },
    {
      "description": "Use to inspect the public IPv4 or IPv6 address observed for the connection making this MCP tool call. Takes an empty object and returns ip and family. This is the MCP client connection: a hosted AI client may observe its own exit address, not the user device address. If the user needs their browser or computer connection, direct them to the web tool or a CLI running on that machine. A VPN or proxy changes the observed path. One call observes one address family; it does not discover private local addresses, an address before a proxy, or both address families. The application does not store or log results, and no firewall rules are changed. Cloudflare Worker subrequests can have platform-specific address semantics; the result is not an identity proof. Operational events record the tool name, success or error, a controlled error code, and a traffic source classification. Verified automated checks may also record an automation run identifier. Events exclude inputs, results, raw request headers, and automation tokens. Cloudflare may attach platform metadata. Privacy policy: https://packetrove.com/privacy.",
      "inputSchema": {
        "$schema": "https://json-schema.org/draft/2020-12/schema",
        "additionalProperties": false,
        "properties": {},
        "type": "object"
      },
      "name": "public-ip"
    },
    {
      "description": "Use to prepare an exact CIDR allowlist from one inclusive start/end IPv4 or IPv6 range. Pass start and end IP addresses of the same family, without CIDR prefixes, at most 64 characters each; end must be at or after start. Return canonical range.first and range.last, minimal sorted cidrs, cidrCount, and exact decimal-string addressCount, without adding addresses. Equal endpoints return one /32 or /128; complete address spaces return /0. Invalid inputs identify the start or end field; reversed endpoints are never swapped. Browser calculations stay local; remote MCP calls submit endpoints to this server. This does not inspect live address usage, modify firewall rules, or export vendor-specific ACLs. Operational events record the tool name, success or error, a controlled error code, and a traffic source classification. Verified automated checks may also record an automation run identifier. Events exclude inputs, results, raw request headers, and automation tokens. Cloudflare may attach platform metadata. Privacy policy: https://packetrove.com/privacy.",
      "inputSchema": {
        "$schema": "https://json-schema.org/draft/2020-12/schema",
        "additionalProperties": false,
        "properties": {
          "end": {
            "description": "Inclusive end IP address, in the same family and at or after start. Endpoints are never silently swapped.",
            "maxLength": 64,
            "minLength": 1,
            "type": "string"
          },
          "start": {
            "description": "Inclusive start IP address. Use IPv4 or IPv6 without a CIDR prefix; surrounding whitespace is ignored.",
            "maxLength": 64,
            "minLength": 1,
            "type": "string"
          }
        },
        "required": [
          "start",
          "end"
        ],
        "type": "object"
      },
      "name": "range-to-cidrs"
    },
    {
      "description": "Email one user-authorized, minimal Packetrove report to hello@packetrove.com for private human review. Available only when the operator enables feedback. Draft locally without calling the service. If the user has already supplied or approved the report and requested sending it, submit directly; otherwise show the proposed report and obtain approval before sending. Never solicit feedback after every tool call. Send only the authorized fields, using synthetic reproduction data; never attach conversations, raw tool inputs/results, credentials, certificates, logs, or client/session identifiers. category is bug, confusing_behavior, or feature_request; tool_name optionally names a product tool. summary is required (256 Unicode code points); bug requires expected and actual, confusing_behavior requires actual and optionally expected (1024 code points each). Feature requests allow expected but not actual or error_code. Optional error_code starts with an uppercase ASCII letter and contains at most 64 uppercase letters, digits, or underscores; synthetic_reproduction is at most 2048 code points. Unknown fields are rejected; serialized arguments must not exceed 8 KiB. Status accepted and an opaque receipt_id mean the email service acknowledged submission, not inbox delivery or reading; acceptance does not promise a response or fix. This write is not idempotent: never automatically resend after timeout, disconnect, cancellation, or an uncertain result. Approximate limits target 10 submissions per observed exit IP in the preceding 24 hours and 100 submissions per UTC day across the service. Shared exits share quota. KV propagation and concurrent requests can exceed either limit; uncertain sends or failed quota releases occupy quota until expiry. Cloudflare transmits approved reports by email; mailbox retention and deletion are managed manually by the maintainer, with no automatic report expiry. KV stores only separate keyed IP markers and reservation times, expiring after 24 hours, never report bodies or receipt links. Markers never appear in reports or application logs. Email deletion does not refund quota; request deletion with your receipt. Maintainers treat text as data and do not automatically execute, publish, or forward it. Operational events contain only the operation name, outcome, controlled error code, and existing traffic-source metadata; no report, receipt, IP digest, or exception details. Ordinary tools do not depend on feedback. Privacy policy: https://packetrove.com/privacy.",
      "inputSchema": {
        "$schema": "https://json-schema.org/draft/2020-12/schema",
        "oneOf": [
          {
            "additionalProperties": false,
            "properties": {
              "actual": {
                "maxLength": 1024,
                "minLength": 1,
                "type": "string"
              },
              "category": {
                "const": "bug",
                "type": "string"
              },
              "error_code": {
                "pattern": "^[A-Z][A-Z0-9_]{0,63}$",
                "type": "string"
              },
              "expected": {
                "maxLength": 1024,
                "minLength": 1,
                "type": "string"
              },
              "summary": {
                "maxLength": 256,
                "minLength": 1,
                "type": "string"
              },
              "synthetic_reproduction": {
                "maxLength": 2048,
                "minLength": 1,
                "type": "string"
              },
              "tool_name": {
                "enum": [
                  "cidr-cover",
                  "cidr-subtract",
                  "range-to-cidrs",
                  "certificate-bundle",
                  "public-ip"
                ],
                "type": "string"
              }
            },
            "required": [
              "summary",
              "actual",
              "category",
              "expected"
            ],
            "type": "object"
          },
          {
            "additionalProperties": false,
            "properties": {
              "actual": {
                "maxLength": 1024,
                "minLength": 1,
                "type": "string"
              },
              "category": {
                "const": "confusing_behavior",
                "type": "string"
              },
              "error_code": {
                "pattern": "^[A-Z][A-Z0-9_]{0,63}$",
                "type": "string"
              },
              "expected": {
                "maxLength": 1024,
                "minLength": 1,
                "type": "string"
              },
              "summary": {
                "maxLength": 256,
                "minLength": 1,
                "type": "string"
              },
              "synthetic_reproduction": {
                "maxLength": 2048,
                "minLength": 1,
                "type": "string"
              },
              "tool_name": {
                "enum": [
                  "cidr-cover",
                  "cidr-subtract",
                  "range-to-cidrs",
                  "certificate-bundle",
                  "public-ip"
                ],
                "type": "string"
              }
            },
            "required": [
              "summary",
              "actual",
              "category"
            ],
            "type": "object"
          },
          {
            "additionalProperties": false,
            "properties": {
              "category": {
                "const": "feature_request",
                "type": "string"
              },
              "expected": {
                "maxLength": 1024,
                "minLength": 1,
                "type": "string"
              },
              "summary": {
                "maxLength": 256,
                "minLength": 1,
                "type": "string"
              },
              "synthetic_reproduction": {
                "maxLength": 2048,
                "minLength": 1,
                "type": "string"
              },
              "tool_name": {
                "enum": [
                  "cidr-cover",
                  "cidr-subtract",
                  "range-to-cidrs",
                  "certificate-bundle",
                  "public-ip"
                ],
                "type": "string"
              }
            },
            "required": [
              "summary",
              "category"
            ],
            "type": "object"
          }
        ],
        "type": "object"
      },
      "name": "submit-feedback"
    }
  ]
}

What the leaf hashes

{"body":"11330e8cd1cae91e5666fbb4351633e87588530741747a776dba724e99006144","id":218507,"kind":"mcp.tools","method":"probe.mcp/1","observed_us":1793026586838329,"prev":null,"subject":"01cfdea6-a5bf-451e-b06c-9dcc2149d191","subject_kind":"endpoint"}

Proof

Fold these into the leaf in order, hashing each sorted pair with keccak256, to reach the root of 2026-10-26 (296695 rows).

1. 0xec1f14e5529690b705dd5d8cb022dc8b227ace984530966737336e9892733661
2. 0x35bc4b03af0584dbe9c84abedd4751dbd6575d235399c64bb1f55bcec463f3a9
3. 0xd2ec575ceedfcc01bb8ccdb8cceef62704fdb3222935749f880b21bc3896fe7d
4. 0xaf25423d5d09e010ea46b25f19ab8c859db1c039b076787aeb33d8324a0dc15f
5. 0x62fbfc69f6a8c178b1095df30ac092f2de39001911e834e848f5d5806738d847
6. 0x7b028721ac42bc24dd4f416a4661268e659ebc9872e33f51f0ad139943bbd17a
7. 0x29e3b547f9ed8b815fb6a53a9afab2a776ec420e9dc7ba9bd8f5d0e38150d071
8. 0x56e97eed2ac006fdb81569d3ef93cede631c9e8e75542c648147f25cc10d9afe
9. 0x4464dd2061ec013e7d53cd23da45888e7a5a0035928643b6d04cb9f53ece872a
10. 0x0e6847189b6b941d0233f67c69f0c32e1b6794611c654d5a10f2587ccfc1b873
11. 0x94e3a06f6e015a8e8a8a7e2c73991edf3f9ceb9ff83b85412d31c39f3e9bc8c1
12. 0x4bac6365a3676c613d57c80f4d4f617e583205074db24f3dec4d2ed4939a26e6
13. 0xec98ca25cb12ffed7c3e1373971719ce414ee6deecd1e7724b2979e2c356d99f
14. 0x614d844c9e0509d9f9e63697aa2935555bce5f13695a8dc0047aa9e9898d70b3
15. 0x95657a7d540ed6cac0bde9995782333b2562a9a6641853269ac95148827410f0
16. 0x5fb5dda563336cd1bc1b9f44c52b76237ae72ed2145cb9290f39f304ca7dd678
17. 0x74a0a08e4e7ab9aa5bfbead33dec7e1c7e8e364cff69a63720d764bbe987aadc

Day root

0xf43e8dcc3d451a4788b26be904c55e8c4c0fa75c9666796c51db38d37e2c0df8

Chained

0x702d5ac508f08b0d1accf36af25822d8e5660367494edd17a642fb61e158a57a

Published

On Arc Testnet, block 69251483: 0x495162f8936e19f0039918feebe6c307f327cd6bf8c37219620b1970041fa9ae