Evidence row 222369

What was observed

{
  "count": 8,
  "tools": [
    {
      "description": "Call an API from the apifare catalog by slug (find slugs with search_apis). The cost in prepaid credits is deducted automatically and returned with the result.",
      "inputSchema": {
        "$schema": "http://json-schema.org/draft-07/schema#",
        "additionalProperties": false,
        "properties": {
          "params": {
            "additionalProperties": {},
            "description": "Params object per the API's manifest",
            "type": "object"
          },
          "slug": {
            "description": "API slug from search_apis, e.g. \"web-search\"",
            "type": "string"
          }
        },
        "required": [
          "slug"
        ],
        "type": "object"
      },
      "name": "call_api"
    },
    {
      "description": "Check the remaining apifare prepaid credit balance (1 credit = $0.01) and get the top-up link.",
      "inputSchema": {
        "$schema": "http://json-schema.org/draft-07/schema#",
        "properties": {},
        "type": "object"
      },
      "name": "check_balance"
    },
    {
      "description": "Get a secure one-time link where the user can save their OWN API key for a provider (BYOK). Never ask the user to paste an API key into the chat — always use this link instead. BYOK calls cost a flat 0.1 credits; the user's own provider account pays the provider.",
      "inputSchema": {
        "$schema": "http://json-schema.org/draft-07/schema#",
        "additionalProperties": false,
        "properties": {
          "provider": {
            "description": "API slug from search_apis, e.g. \"fal\"",
            "type": "string"
          }
        },
        "required": [
          "provider"
        ],
        "type": "object"
      },
      "name": "get_vault_link"
    },
    {
      "description": "Search the apifare catalog of ready-to-call APIs (web search, scraping, weather, and more). Returns each API's slug, params, and per-call price in prepaid credits. Every miss is logged so missing APIs get added.",
      "inputSchema": {
        "$schema": "http://json-schema.org/draft-07/schema#",
        "additionalProperties": false,
        "properties": {
          "query": {
            "description": "What kind of API you need, in plain words",
            "type": "string"
          }
        },
        "required": [
          "query"
        ],
        "type": "object"
      },
      "name": "search_apis"
    },
    {
      "description": "Generate a random secret and place it directly at a vendor resource SERVER-SIDE — the value never enters this conversation.",
      "inputSchema": {
        "$schema": "http://json-schema.org/draft-07/schema#",
        "additionalProperties": false,
        "properties": {
          "bytes": {
            "maximum": 64,
            "minimum": 16,
            "type": "integer"
          },
          "to": {
            "additionalProperties": false,
            "properties": {
              "key": {
                "type": "string"
              },
              "resource": {
                "type": "string"
              },
              "vendor": {
                "type": "string"
              }
            },
            "required": [
              "vendor",
              "resource",
              "key"
            ],
            "type": "object"
          }
        },
        "required": [
          "to"
        ],
        "type": "object"
      },
      "name": "secret_generate"
    },
    {
      "description": "Move a secret from one vendor to another SERVER-SIDE — the value never enters this conversation. Example: fetch a Supabase service_role key and place it as a Vercel env var.",
      "inputSchema": {
        "$schema": "http://json-schema.org/draft-07/schema#",
        "additionalProperties": false,
        "properties": {
          "from": {
            "additionalProperties": false,
            "properties": {
              "field": {
                "type": "string"
              },
              "resource": {
                "type": "string"
              },
              "vendor": {
                "type": "string"
              }
            },
            "required": [
              "vendor",
              "resource",
              "field"
            ],
            "type": "object"
          },
          "to": {
            "additionalProperties": false,
            "properties": {
              "key": {
                "type": "string"
              },
              "resource": {
                "type": "string"
              },
              "vendor": {
                "type": "string"
              }
            },
            "required": [
              "vendor",
              "resource",
              "key"
            ],
            "type": "object"
          }
        },
        "required": [
          "from",
          "to"
        ],
        "type": "object"
      },
      "name": "secret_transfer"
    },
    {
      "description": "Top up the apifare balance from the owner's standing auto-refill mandate (if the owner enabled one). Charges within the owner's configured limits and returns the new balance. Without a mandate, returns payment instructions to relay to the user.",
      "inputSchema": {
        "$schema": "http://json-schema.org/draft-07/schema#",
        "additionalProperties": false,
        "properties": {
          "amount_usd": {
            "description": "Optional whole-dollar amount; defaults to the mandate's refill amount and is clamped to it",
            "maximum": 100,
            "minimum": 5,
            "type": "integer"
          }
        },
        "type": "object"
      },
      "name": "topup"
    },
    {
      "description": "Call a vendor MANAGEMENT API (supabase, vercel, fly, resend, github, npm, cloudflare, lemonsqueezy) with the owner's vaulted root credential injected server-side. Native request/response; destructive, billing, and member/admin routes are blocked. The root token is never visible.",
      "inputSchema": {
        "$schema": "http://json-schema.org/draft-07/schema#",
        "additionalProperties": false,
        "properties": {
          "body": {
            "additionalProperties": {},
            "description": "JSON body for write methods",
            "type": "object"
          },
          "method": {
            "description": "HTTP method (default GET)",
            "type": "string"
          },
          "path": {
            "description": "The vendor's own API path, e.g. \"v9/projects\"",
            "type": "string"
          },
          "vendor": {
            "description": "Vendor name, e.g. \"vercel\"",
            "type": "string"
          }
        },
        "required": [
          "vendor",
          "path"
        ],
        "type": "object"
      },
      "name": "vendor_call"
    }
  ]
}

What the leaf hashes

{"body":"0e7030a364a6da9227995a1921d12d6020ee5a225ed89d9b2fc325b37ddc6194","id":222369,"kind":"mcp.tools","method":"probe.mcp/1","observed_us":1793027993574049,"prev":null,"subject":"c14464ac-b481-414a-8ba9-4f86c601d9d0","subject_kind":"endpoint"}

Proof

Fold these into the leaf in order, hashing each sorted pair with keccak256, to reach the root of 2026-10-26 (296695 rows).

1. 0x9b88542ad88c011f3acc6df0329ef9d1e59d863d78b8b45a31faa35cf77a0d73
2. 0x586a47580a1d4139b6ed8de6d644904aaf477486c351e2bf6d8cf1c3cfa38143
3. 0x9c0118157c6e1dfe47fe5fd3e844bd95ff10a0fda962991b38adc65f7bdc9199
4. 0x27cec8c8fb8c403e91d0c9d6baa26beabc151241a672d57bc01f3b638714ec52
5. 0xdaa7cedf1af50ca7bbae5023272ed0d422aa06837cf09c347afe96a48b634688
6. 0x5c499c46f32e616aab6ef1276f00ff212704fb1c929801014e4ff1b562ff64b1
7. 0x0b37720e2347a3467e5cd26563a3da1c774e35f848f3ef971712448f59e53dc3
8. 0x3310929ae0e7469d5741fa39da6db0983d0021ebccd0f7303280f77a4173fe9a
9. 0xb03a49015e02ec6c907f2ac497d7fd9d859357c975bc781e04d7c7cdc5cc69bb
10. 0x7fc9c551c0bf3724729ea13bb68249f1874a045c6cfd4d9564abfe126a968bcf
11. 0xb79ffe067e46a7abdcd59167d8556c652ce9f0f297fbf7808095f49485591c09
12. 0xd253212b3d5f7245423cc951067880bc2069b90eeee521363fcee13ebbd606ae
13. 0x99a4e0f8b23989f58b564c1b6e419578b4388f6e0dbf6e50177c1bd476302d0e
14. 0x6713795704ddd9c528d421fadd9cc96b0200a4ddbba84f88e718d4968dde888b
15. 0x62a900133713919f4eed33d8336876b7a6d538233b8a4f3ed03b29aa44f5bad0
16. 0x1ac20d30773e1f4f2f811540e9a99b5cca9177c9e2e029acc0d80cf3f1d11f0f
17. 0xd21942ae3214eff88e08ab04884fd4b11958b51af9a0741b7668e2d07a2c56c9
18. 0x9a9024edb5069d88a324facb310a5ce8e495214bbaa968f077bede437390194f
19. 0x9b9ce5b74b9bab5121612ef6b64920a8d453cbf311096a423eef9702747e868a

Day root

0xf43e8dcc3d451a4788b26be904c55e8c4c0fa75c9666796c51db38d37e2c0df8

Chained

0x702d5ac508f08b0d1accf36af25822d8e5660367494edd17a642fb61e158a57a

Published

On Arc Testnet, block 69251483: 0x495162f8936e19f0039918feebe6c307f327cd6bf8c37219620b1970041fa9ae