Evidence row 263593

What was observed

{
  "count": 14,
  "tools": [
    {
      "description": "Check a single package@version for known vulnerabilities via OSV.dev (npm, PyPI, Go, Maven, NuGet, RubyGems, Packagist, crates.io, etc.). Returns advisories with CVE IDs, severity, fixed versions, and references. Free tier eligible.",
      "inputSchema": {
        "properties": {
          "ecosystem": {
            "description": "Package ecosystem: npm, PyPI, Go, Maven, NuGet, RubyGems, Packagist, crates.io",
            "maxLength": 20,
            "type": "string"
          },
          "name": {
            "description": "Package name (e.g., \"lodash\", \"django\", \"github.com/gorilla/mux\")",
            "maxLength": 200,
            "type": "string"
          },
          "version": {
            "description": "Exact version (e.g., \"4.17.20\")",
            "maxLength": 50,
            "type": "string"
          }
        },
        "required": [
          "name",
          "version",
          "ecosystem"
        ],
        "type": "object"
      },
      "name": "assess_dependency"
    },
    {
      "description": "Assess security risk for a list of technologies. Returns known CVEs affecting each technology with severity breakdown. Input: comma-separated technology names only.",
      "inputSchema": {
        "properties": {
          "technologies": {
            "description": "Comma-separated list of technology names (e.g., \"Apache HTTP Server, OpenSSL, nginx\"). Max 50 technologies.",
            "maxLength": 2000,
            "pattern": "^[a-zA-Z0-9.,\\s\\-/()@]+$",
            "type": "string"
          }
        },
        "required": [
          "technologies"
        ],
        "type": "object"
      },
      "name": "assess_tech_risk"
    },
    {
      "description": "Get recently added entries to the CISA Known Exploited Vulnerabilities (KEV) catalog.",
      "inputSchema": {
        "properties": {
          "days": {
            "description": "Number of days to look back (1-365, default: 30)",
            "maxLength": 3,
            "pattern": "^\\d{1,3}$",
            "type": "string"
          }
        },
        "type": "object"
      },
      "name": "get_kev_recent"
    },
    {
      "description": "Get Shield WAF posture score and breakdown for a domain registered under this account. Returns 0-100 score, letter grade, per-component breakdown (origin lock, virtual patching, TLS, etc.), and edge_health (whether Shield is actually intercepting traffic). Requires API key.",
      "inputSchema": {
        "properties": {
          "domain": {
            "description": "Domain registered under your Sectora account",
            "maxLength": 253,
            "pattern": "^[a-z0-9.-]+$",
            "type": "string"
          }
        },
        "required": [
          "domain"
        ],
        "type": "object"
      },
      "name": "get_my_posture"
    },
    {
      "description": "Get a scan with all its findings (full detail: title, description, evidence, remediation, CVSS). Requires API key.",
      "inputSchema": {
        "properties": {
          "scan_id": {
            "description": "Scan UUID",
            "maxLength": 36,
            "pattern": "^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$",
            "type": "string"
          }
        },
        "required": [
          "scan_id"
        ],
        "type": "object"
      },
      "name": "get_scan"
    },
    {
      "description": "Get statistics about the Sectora threat intelligence database including counts of EPSS scores, KEV entries, Nuclei templates, and exploits. No input required.",
      "inputSchema": {
        "properties": {},
        "type": "object"
      },
      "name": "get_threat_stats"
    },
    {
      "description": "Get currently trending CVEs based on recent KEV additions, high EPSS scores, and exploit availability.",
      "inputSchema": {
        "properties": {
          "limit": {
            "description": "Maximum results to return (1-100, default: 20)",
            "maxLength": 3,
            "pattern": "^\\d{1,3}$",
            "type": "string"
          }
        },
        "type": "object"
      },
      "name": "get_trending_cves"
    },
    {
      "description": "Get the weaponization score (0-100) for a CVE. Factors in EPSS, KEV status, exploit availability, Nuclei templates, and CVSS. Input must be a valid CVE ID.",
      "inputSchema": {
        "properties": {
          "cve_id": {
            "description": "CVE identifier in format CVE-YYYY-NNNNN (e.g., CVE-2024-3400)",
            "maxLength": 20,
            "pattern": "^CVE-\\d{4}-\\d{4,}$",
            "type": "string"
          }
        },
        "required": [
          "cve_id"
        ],
        "type": "object"
      },
      "name": "get_weaponization_score"
    },
    {
      "description": "List the API key owner's open security findings across all scans. Use this to answer \"what's my current exposure?\" Filter by severity, status, or domain. Returns finding summaries; call get_scan for full detail. Requires API key.",
      "inputSchema": {
        "properties": {
          "domain": {
            "description": "Limit to a single domain (e.g., app.example.com)",
            "maxLength": 253,
            "type": "string"
          },
          "limit": {
            "description": "Max findings (1-100, default: 25)",
            "maxLength": 3,
            "pattern": "^\\d{1,3}$",
            "type": "string"
          },
          "severity": {
            "description": "Comma-separated severities to include: critical, high, medium, low, info",
            "maxLength": 50,
            "type": "string"
          },
          "status": {
            "description": "Filter by confirmation status",
            "enum": [
              "open",
              "confirmed"
            ],
            "type": "string"
          }
        },
        "type": "object"
      },
      "name": "list_my_findings"
    },
    {
      "description": "List the API key owner's recent scans with summary counts. Requires API key.",
      "inputSchema": {
        "properties": {
          "limit": {
            "description": "Max scans (1-100, default: 25)",
            "maxLength": 3,
            "pattern": "^\\d{1,3}$",
            "type": "string"
          },
          "status": {
            "description": "Filter by status (queued, running, completed, failed)",
            "maxLength": 20,
            "type": "string"
          }
        },
        "type": "object"
      },
      "name": "list_my_scans"
    },
    {
      "description": "Get full threat intelligence enrichment for a CVE including EPSS score, CISA KEV status, public exploits, Nuclei templates, risk level, and risk factors. Input must be a valid CVE ID.",
      "inputSchema": {
        "properties": {
          "cve_id": {
            "description": "CVE identifier in format CVE-YYYY-NNNNN (e.g., CVE-2024-3400)",
            "maxLength": 20,
            "pattern": "^CVE-\\d{4}-\\d{4,}$",
            "type": "string"
          }
        },
        "required": [
          "cve_id"
        ],
        "type": "object"
      },
      "name": "lookup_cve"
    },
    {
      "description": "Look up community IP reputation from Sectora Shield WAF network. Shows if an IP has been reported for attacks. Accepts IPv4 or IPv6 (the Shield network sees both).",
      "inputSchema": {
        "properties": {
          "ip": {
            "description": "IPv4 (e.g., 1.2.3.4) or IPv6 (e.g., 2606:4700::1) address to look up",
            "maxLength": 45,
            "pattern": "^(\\d{1,3}(\\.\\d{1,3}){3}|[0-9A-Fa-f:]{2,45})$",
            "type": "string"
          }
        },
        "required": [
          "ip"
        ],
        "type": "object"
      },
      "name": "lookup_ip_reputation"
    },
    {
      "description": "Kick off a DAST security scan against a public URL the API key owner controls. Two-step flow: first call returns a preview (target, profile, ETA, quota remaining); confirm by calling again with confirm:true to actually start the scan. Returns scan_id; poll status with get_scan. Domain must be verified in the Sectora account. Daily quota: 25 scans/24h per user, plus the plan's monthly scan limit. Requires an API key with the scans:create scope.",
      "inputSchema": {
        "properties": {
          "confirm": {
            "description": "Set to \"true\" to actually execute the scan. Without this, the call returns a preview only.",
            "enum": [
              "true",
              "false"
            ],
            "type": "string"
          },
          "profile": {
            "description": "Scan profile: quick (~2 min), standard (~10 min), deep (~30 min)",
            "enum": [
              "quick",
              "standard",
              "deep"
            ],
            "type": "string"
          },
          "url": {
            "description": "Full URL to scan (must start with http:// or https://)",
            "maxLength": 2048,
            "type": "string"
          }
        },
        "required": [
          "url"
        ],
        "type": "object"
      },
      "name": "scan_url"
    },
    {
      "description": "Search for CVEs by keyword, severity, or other filters. Query must be alphanumeric text.",
      "inputSchema": {
        "properties": {
          "has_exploit": {
            "description": "Only show CVEs with public exploits",
            "enum": [
              "true",
              "false"
            ],
            "type": "string"
          },
          "is_kev": {
            "description": "Only show CVEs in CISA KEV catalog",
            "enum": [
              "true",
              "false"
            ],
            "type": "string"
          },
          "query": {
            "description": "Search keyword (CVE ID, technology name, or description)",
            "maxLength": 200,
            "type": "string"
          },
          "severity": {
            "description": "Filter by severity",
            "enum": [
              "CRITICAL",
              "HIGH",
              "MEDIUM",
              "LOW"
            ],
            "type": "string"
          }
        },
        "required": [
          "query"
        ],
        "type": "object"
      },
      "name": "search_cves"
    }
  ]
}

What the leaf hashes

{"body":"b6f596a92e084fd80c2787cd7ae04965a2b5df8cb31ccd5db663a13c1e9fb9ca","id":263593,"kind":"mcp.tools","method":"probe.mcp/1","observed_us":1793033583238168,"prev":null,"subject":"98fc5d88-a817-4e2d-b115-d8c4aa447606","subject_kind":"endpoint"}

Proof

Fold these into the leaf in order, hashing each sorted pair with keccak256, to reach the root of 2026-10-26 (296695 rows).

1. 0x343fc795d9322126734a6c364f5102641212f8938b90e55bc3c6dfe5b75a932d
2. 0x81829c24258ba7a8e2c38294598f40eb052e84b611c5b19dcb51ff139f9a545d
3. 0x71a71adc9e57161d3de72075ebab30cb300d89501c2a4edc033cbf04c3360977
4. 0x85cc01ff6c05622725e8875d247484aeb8a9b0980370d92303c37046fb38a0db
5. 0x28302bf6313f2ddda7349ee4af4079c225d6d1bd23438e80b3d081d08fe4cb43
6. 0x71df006ba8a7af1f710daaab0fef998b1f67d50782eef21099f386cf01e641eb
7. 0xa8df29747b282bdee958d728f5561011d96a62dde6f1199b0aa67143109b0cf3
8. 0xd3510edcfc6aa71e4cc7b5013730f3a56f5fd3e3b4b1103370412aed51387063
9. 0x82cf6b3d1aae668d4027a29813a07304e6d8998e5336cc71e349905c8a69da93
10. 0x177012e4764007ed1fc9fe062981493cb1e87dce78b4d705154fc6b59f179dc8
11. 0x25f1494b636c5e3c47bd014c16b8f4b5df5a8fb62efdc32979420416a8736679
12. 0xe57be1a98d96d75db9e9d2122794eabebfd735dea66e9d16ca63347243b3d483
13. 0x08de74b7fb265ddb83e4c673da8a94e5f71829b2e6e7464c71c5138e450f2217
14. 0x4338355a835617a26aa0bfcc971e84eb030d84e2aa840e3c8af958921dd080c7
15. 0x610738e0c43687aded83c613c73de8b5226c73c375858a167436461c522ea213
16. 0x06d71bfa7d8b41d62c8836efc2c601e1cc3772d9453596b2ae4950887f3310ca
17. 0x8c756542e482157df0c36464d75c937b845e4423dbbcfad08f0cf8d5a16b9a13
18. 0x20704208aa6923d6b2450ef74ede87a6e0265d46447926038fe9506e9e154b2d
19. 0x9b9ce5b74b9bab5121612ef6b64920a8d453cbf311096a423eef9702747e868a

Day root

0xf43e8dcc3d451a4788b26be904c55e8c4c0fa75c9666796c51db38d37e2c0df8

Chained

0x702d5ac508f08b0d1accf36af25822d8e5660367494edd17a642fb61e158a57a

Published

On Arc Testnet, block 69251483: 0x495162f8936e19f0039918feebe6c307f327cd6bf8c37219620b1970041fa9ae