← The evidence ledger
Evidence row 2200121
Observed , by sync.x402_bazaar/1.
- Kind
- listing
- About
- source_record x402_bazaar:https://nohands-coinbase-bazaar.bytoken2023.workers.dev/x402/v1/mcp/trust-preflight
- Recorded
- Previous row
- None: the first of its kind about this subject
- Body SHA-256
- f73f910e4eee5a2dbe29f473080179e1ef03038b62281ebaa43b15963c625400
- Leaf
- 0x0833149f0950b8ea7f4b15a84df7c189adc380e25dfeee3118eaac2cc190c249
What was observed
{
"endpoints": [
[
"x402",
"https://nohands-coinbase-bazaar.bytoken2023.workers.dev/x402/v1/mcp/trust-preflight"
]
],
"name": "NO HANDS AI",
"owner_address": "0x94f751f04b98507d31b500b7ed50be68a1514873",
"raw": {
"accepts": [
{
"amount": "1500001",
"asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
"extra": {
"assetTransferMethod": "eip3009",
"name": "USD Coin",
"version": "2"
},
"maxTimeoutSeconds": 300,
"network": "eip155:8453",
"payTo": "0x94F751f04b98507D31b500b7Ed50bE68A1514873",
"scheme": "exact"
}
],
"description": "Assess caller-declared MCP server, publisher, repository and tool metadata for trust and permission risk. No package is installed, no MCP server or tool is contacted and no credential is accessed.",
"extensions": {
"bazaar": {
"info": {
"input": {
"body": {
"commit_sha": "0123456789abcdef0123456789abcdef01234567",
"credential_requirements": [],
"declared_permissions": [
"read"
],
"execution_environment": {
"sandbox_profile": "L2_GVISOR"
},
"filesystem_requirements": [
"workspace/tmp"
],
"lifecycle_install_scripts": [],
"maintenance": {
"active": true,
"last_release_at": "2026-07-20T00:00:00.000Z"
},
"network_destinations": [
"https://api.example.com"
],
"publisher": {
"name": "NoHands AI",
"verified": true
},
"repository": {
"url": "https://github.com/nomoslabs2026-bit/nomos-x402-services",
"verified": true
},
"requested_tool": "read_risk_report",
"server_name": "nomos-local-tools",
"server_url": "https://mcp.example.com",
"tools": [
{
"declared": true,
"name": "read_risk_report",
"permissions": [
"read"
]
}
],
"version": "1.0.0"
},
"bodyType": "json",
"method": "POST",
"type": "http"
},
"output": {
"example": {
"assessment": {
"credential_status": "NOT_REQUESTED",
"filesystem_status": "BOUNDED",
"lifecycle_status": "NONE_DECLARED",
"network_status": "BOUNDED",
"permission_status": "BOUNDED",
"prompt_injection_status": "LOW_DECLARED_SURFACE",
"publisher_status": "UNVERIFIED",
"repository_status": "UNVERIFIED",
"version_status": "PINNED"
},
"credential_access": false,
"decision": "INSUFFICIENT_EVIDENCE",
"deterministic": true,
"evaluated_at": "2026-11-01T00:00:00.000Z",
"expires_at": "2026-11-01T00:05:00.000Z",
"external_mcp_called": false,
"llm_used": false,
"packages_installed": false,
"policy_version": "nomos-mcp-trust-preflight-v1-20260726",
"product": "nomos-mcp-trust-preflight",
"reason_codes": [
"MCP_PUBLISHER_UNVERIFIED",
"MCP_REPOSITORY_UNVERIFIED",
"MCP_SERVER_NAME_MISMATCH"
],
"required_controls": [
"PIN_VERSION",
"VERIFY_PUBLISHER",
"LIMIT_PERMISSIONS",
"GATE_SIDE_EFFECT_TOOLS",
"LOG_TOOL_CALLS"
],
"result_id": "mcp_20261101000000_6z1",
"schema_version": "1.0",
"server": {
"commit_sha": "0123456789abcdef0123456789abcdef01234567",
"name": "nomos-local-tools",
"publisher": "NoHands AI",
"repository": "https://github.com/nomoslabs2026-bit/nomos-x402-services",
"requested_tool": "read_risk_report",
"tool_count": 1,
"url": "https://mcp.example.com",
"version": "1.0.0"
},
"supported_reason_codes": [
"MCP_PUBLISHER_UNVERIFIED",
"MCP_REPOSITORY_UNVERIFIED",
"MCP_VERSION_UNPINNED",
"MCP_SERVER_NAME_MISMATCH",
"MCP_TOOL_UNDECLARED",
"MCP_PERMISSION_TOO_BROAD",
"MCP_CREDENTIAL_ACCESS_REQUESTED",
"MCP_NETWORK_SCOPE_TOO_BROAD",
"MCP_FILESYSTEM_SCOPE_TOO_BROAD",
"MCP_LIFECYCLE_SCRIPT_PRESENT",
"MCP_EXTERNAL_BINARY_DOWNLOAD",
"MCP_CAPABILITY_MISMATCH",
"MCP_MAINTENANCE_INACTIVE",
"MCP_PROMPT_INJECTION_SURFACE",
"INSUFFICIENT_MCP_EVIDENCE"
],
"unknown_mcp_executed": false
},
"type": "json"
}
},
"routeTemplate": "/x402/v1/mcp/trust-preflight",
"schema": {
"$schema": "https://json-schema.org/draft/2020-12/schema",
"properties": {
"input": {
"additionalProperties": false,
"properties": {
"body": {
"example": {
"commit_sha": "0123456789abcdef0123456789abcdef01234567",
"credential_requirements": [],
"declared_permissions": [
"read"
],
"execution_environment": {
"sandbox_profile": "L2_GVISOR"
},
"filesystem_requirements": [
"workspace/tmp"
],
"lifecycle_install_scripts": [],
"maintenance": {
"active": true,
"last_release_at": "2026-07-20T00:00:00.000Z"
},
"network_destinations": [
"https://api.example.com"
],
"publisher": {
"name": "NoHands AI",
"verified": true
},
"repository": {
"url": "https://github.com/nomoslabs2026-bit/nomos-x402-services",
"verified": true
},
"requested_tool": "read_risk_report",
"server_name": "nomos-local-tools",
"server_url": "https://mcp.example.com",
"tools": [
{
"declared": true,
"name": "read_risk_report",
"permissions": [
"read"
]
}
],
"version": "1.0.0"
},
"properties": {
"commit_sha": {
"maxLength": 80,
"type": "string"
},
"credential_requirements": {
"items": {
"type": "string"
},
"type": "array"
},
"declared_permissions": {
"items": {
"type": "string"
},
"type": "array"
},
"execution_environment": {
"additionalProperties": true,
"properties": {
"sandbox_profile": {
"type": "string"
}
},
"type": "object"
},
"filesystem_requirements": {
"items": {
"type": "string"
},
"type": "array"
},
"idempotency_key": {
"maxLength": 128,
"type": "string"
},
"lifecycle_install_scripts": {
"items": {
"type": "string"
},
"type": "array"
},
"maintenance": {
"additionalProperties": true,
"properties": {
"active": {
"type": "boolean"
},
"last_release_at": {
"type": "string"
}
},
"type": "object"
},
"network_destinations": {
"items": {
"type": "string"
},
"type": "array"
},
"publisher": {
"additionalProperties": true,
"example": {
"name": "NoHands AI",
"verified": true
},
"properties": {
"name": {
"type": "string"
},
"verified": {
"type": "boolean"
}
},
"type": "object"
},
"repository": {
"additionalProperties": true,
"example": {
"url": "https://github.com/nomoslabs2026-bit/nomos-x402-services",
"verified": true
},
"properties": {
"url": {
"type": "string"
},
"verified": {
"type": "boolean"
}
},
"type": "object"
},
"requested_tool": {
"example": "read_risk_report",
"maxLength": 160,
"minLength": 1,
"type": "string"
},
"server_name": {
"example": "nomos-local-tools",
"maxLength": 160,
"minLength": 1,
"type": "string"
},
"server_url": {
"example": "https://mcp.example.com",
"maxLength": 2048,
"pattern": "^https?://",
"type": "string"
},
"tools": {
"example": [
{
"declared": true,
"name": "read_risk_report",
"permissions": [
"read"
]
}
],
"items": {
"additionalProperties": true,
"properties": {
"declared": {
"type": "boolean"
},
"name": {
"type": "string"
},
"permissions": {
"items": {
"type": "string"
},
"type": "array"
}
},
"type": "object"
},
"type": "array"
},
"version": {
"maxLength": 80,
"type": "string"
}
},
"required": [
"server_name",
"server_url",
"publisher",
"repository",
"tools",
"requested_tool"
],
"type": "object"
},
"bodyType": {
"enum": [
"json",
"form-data",
"text"
],
"type": "string"
},
"method": {
"enum": [
"POST"
],
"type": "string"
},
"type": {
"const": "http",
"type": "string"
}
},
"required": [
"type",
"method",
"bodyType",
"body"
],
"type": "object"
},
"output": {
"properties": {
"example": {
"additionalProperties": true,
"properties": {
"assessment": {
"additionalProperties": true,
"properties": {
"credential_status": {
"type": "string"
},
"filesystem_status": {
"type": "string"
},
"lifecycle_status": {
"type": "string"
},
"network_status": {
"type": "string"
},
"permission_status": {
"type": "string"
},
"prompt_injection_status": {
"type": "string"
},
"publisher_status": {
"type": "string"
},
"repository_status": {
"type": "string"
},
"version_status": {
"type": "string"
}
},
"type": "object"
},
"credential_access": {
"type": "boolean"
},
"decision": {
"type": "string"
},
"deterministic": {
"type": "boolean"
},
"evaluated_at": {
"type": "string"
},
"expires_at": {
"type": "string"
},
"external_mcp_called": {
"type": "boolean"
},
"llm_used": {
"type": "boolean"
},
"packages_installed": {
"type": "boolean"
},
"policy_version": {
"type": "string"
},
"product": {
"type": "string"
},
"reason_codes": {
"items": {
"type": "string"
},
"type": "array"
},
"required_controls": {
"items": {
"type": "string"
},
"type": "array"
},
"result_id": {
"type": "string"
},
"schema_version": {
"type": "string"
},
"server": {
"additionalProperties": true,
"properties": {
"commit_sha": {
"type": "string"
},
"name": {
"type": "string"
},
"publisher": {
"type": "string"
},
"repository": {
"type": "string"
},
"requested_tool": {
"type": "string"
},
"tool_count": {
"type": "integer"
},
"url": {
"type": "string"
},
"version": {
"type": "string"
}
},
"type": "object"
},
"supported_reason_codes": {
"items": {
"type": "string"
},
"type": "array"
},
"unknown_mcp_executed": {
"type": "boolean"
}
},
"type": "object",
"x-schema-authority": "REPRESENTATIVE_RUNTIME_FIXTURE",
"x-schema-family": "OPERATION_RUNTIME_RESULT"
},
"type": {
"type": "string"
}
},
"required": [
"type"
],
"type": "object"
}
},
"required": [
"input"
],
"type": "object"
}
}
},
"lastUpdated": "2026-11-02T16:26:11.192Z",
"quality": {
"l30DaysTotalCalls": 1,
"l30DaysUniquePayers": 1,
"lastCalledAt": "2026-11-02T16:26:10.892Z"
},
"resource": "https://nohands-coinbase-bazaar.bytoken2023.workers.dev/x402/v1/mcp/trust-preflight",
"serviceName": "NO HANDS AI",
"tags": [
"agent-tools",
"advisory-report",
"mcp-trust-preflight"
],
"type": "http",
"x402Version": 2
},
"source": "x402_bazaar",
"summary": "Assess caller-declared MCP server, publisher, repository and tool metadata for trust and permission risk. No package is installed, no MCP server or tool is contacted and no credential is accessed."
}What the leaf hashes
{"body":"f73f910e4eee5a2dbe29f473080179e1ef03038b62281ebaa43b15963c625400","id":2200121,"kind":"listing","method":"sync.x402_bazaar/1","observed_us":1793646795985072,"prev":null,"subject":"x402_bazaar:https://nohands-coinbase-bazaar.bytoken2023.workers.dev/x402/v1/mcp/trust-preflight","subject_kind":"source_record"}Proof
Fold these into the leaf in order, hashing each sorted pair with keccak256, to reach the root of (444186 rows).
- 0x083322abf02b4a592fca55a35157cf79b2637b4c7acd6746ab25f6bec6a333bd
- 0xfe4b172356f959e4c7c3e44880015c33f30bdc628c101c98cb1cd8a48d93ecd1
- 0xc05e68513c522488a3faaf31ef64231de6ab5ed8f241412b36bfc73da8cb7169
- 0xd504e8ca1026c0668b49f34d3c96fd13576ac4dea4baaa9adf577b0ff97e267f
- 0x1cec254ffadd284d6ac373d3913c7d959f2347186209a580c64a2b787022a8eb
- 0xcf069659cfea9065a105538a8a167d7d8898a988eda2b6b7da59c4fa1ad306ab
- 0xe630875f87521585fc4e352348be62ea9e5d1f797192b6ec0beecab326fe0a75
- 0x388443bb56c1ae34dc8240100145c80dc346fb4e450fba0f00359dac582708a9
- 0xac426c7c3ed5ae003f5be2cf4a3763c45921fffc1c5d75ec894e391a32f003ad
- 0xc03891f049059f0791224720353b21fd39617a694a916347ca6dd148c49563a7
- 0x11f4683aab02f47861ebcb01366f23394e93b45d46d0898dee8bab7b43196ea6
- 0x1e1061c787eccd66beeee856bdeeb2146c8cf8d66dd9f31b721aeb57caac084c
- 0x0f1192f111e333f4cfe5aed028a160b023e5a552da7a04e97103b4a7b2416a85
- 0x66ec51993542849e8bb0ec95d77eba3d6a82a6a4fd1696c4d0ddbb7a693845aa
- 0x150a4dbcf309a6bb857da0b59f7588bd57a20fca094e579bf41d6cc6df9c7bff
- 0x7cb861d18f06406535ade133f716d897f27d257cf0121f99d94c78c713c4b54d
- 0x53a741b69e9e51c4a288a74712aa6ac3fb28c8923cd3e6461d161c4f2d48b31a
- 0x050f2978b537f7afb21ee1551577cdf146d1c56f4df12d24315ae5e69366b0a4
- 0x365b161a4b68d750dcc4b3ecce1154a2163c87b08762079428e68f0ebb6a754e
- Day root
- 0x78fecaabbe319e56f5c4b80fc02e2052e198ad24781da8832a475ff65f2002d1
- Chained
- 0xdc35957db5d1371ca382b9152878ffece28ec7c5cb4f98fd71ddb367f8b999b2
- Published
- On Arc Testnet, block 70432815: 0x56b814612eb2e3e544153df3e91e1f7199106d1e430c7d8c6b653feeb9ebe9af