Evidence row 265091

What was observed

{
  "count": 4,
  "tools": [
    {
      "description": "Use this when the user wants their Supabase migrations checked for RLS gaps before launch, asks whether the Supabase October 30, 2026 Data API grants change will break their tables, or asks whether a security definer function is callable by anon or by signed-in users. Pass the SQL text: sql for one migration, or files with path and content for several, in the repo's file names. It runs the SQL rules of the VibeRaven 1.6.12 CLI and returns each finding with id, severity, file and line in the text passed, a one-line fix and a guide link. Finding ids: rls_disabled (table without RLS), rls_no_policies (RLS on, no policies), rls_policy_allows_all_read and rls_policy_allows_all_write (using (true) or with check (true) for anon, authenticated or public), security_definer_function_executable (EXECUTE not revoked from anon or authenticated), data_api_grant_without_rls (table granted to anon or authenticated with RLS off), data_api_grant_missing (the browser queries a table that has no grant once default grants are off). data_api_grant_missing needs the migration that revokes default privileges or supabase/config.toml, plus the browser files that call supabase.from(...) (a \"use client\" file, or src files with package.json for a Vite app). It is a static read of the text passed: it does not connect to the database, does not run the SQL and does not see the rest of the repository. Up to 200 KB in 50 files. The text is processed in memory, not stored and not logged.",
      "inputSchema": {
        "additionalProperties": false,
        "properties": {
          "files": {
            "description": "Several files: .sql migrations, and optionally supabase/config.toml, package.json and browser code files.",
            "items": {
              "additionalProperties": false,
              "properties": {
                "content": {
                  "description": "The full text of the file.",
                  "type": "string"
                },
                "path": {
                  "description": "The file path in the repo, for example supabase/migrations/20260101000000_init.sql. Migrations run in file name order.",
                  "maxLength": 300,
                  "minLength": 1,
                  "type": "string"
                }
              },
              "required": [
                "path",
                "content"
              ],
              "type": "object"
            },
            "maxItems": 50,
            "minItems": 1,
            "type": "array"
          },
          "sql": {
            "description": "The SQL text of one migration file.",
            "minLength": 1,
            "type": "string"
          }
        },
        "type": "object"
      },
      "name": "check_supabase_migrations"
    },
    {
      "description": "Use this when the user asks what a VibeRaven finding id means, for example rls_disabled or env_var_drift, or pastes a finding from a VibeRaven 1.6.12 report. Returns what the rule detects in repository files, why it matters, how to fix it and what it does not check, quoted from viberaven.dev with a source link for each part. It does not read the user's repository, database or Vercel project. Known ids: rls_disabled, rls_no_policies, rls_policy_allows_all_read, rls_policy_allows_all_write, security_definer_function_executable, pooler_port_mismatch, service_role_key_in_client_code, env_var_drift. An unknown id returns found: false and the list of known ids.",
      "inputSchema": {
        "additionalProperties": false,
        "properties": {
          "gap_id": {
            "description": "The finding id as printed by VibeRaven, for example rls_disabled.",
            "maxLength": 100,
            "minLength": 1,
            "type": "string"
          }
        },
        "required": [
          "gap_id"
        ],
        "type": "object"
      },
      "name": "explain_finding"
    },
    {
      "description": "Use this when the user wants a manual pre-launch checklist for a Lovable + Supabase app or a Next.js + Supabase app on Vercel. Returns the checklist published on viberaven.dev for that stack with its sources, and the one optional local VibeRaven step (`npx -y viberaven@1.6.12 check`), which is advice, not a gate. The items are manual checks the user does in their dashboards and code; this tool does not run any of them.",
      "inputSchema": {
        "additionalProperties": false,
        "properties": {
          "stack": {
            "description": "lovable-supabase for a Lovable app with Supabase, nextjs-supabase-vercel for a Next.js app with Supabase deployed on Vercel.",
            "enum": [
              "lovable-supabase",
              "nextjs-supabase-vercel"
            ],
            "type": "string"
          }
        },
        "required": [
          "stack"
        ],
        "type": "object"
      },
      "name": "launch_checklist"
    },
    {
      "description": "Use this when the user has a launch question about an AI-built app on Vercel + Supabase, such as Supabase RLS, env vars on Vercel, a Stripe webhook after deploy or a client handoff. Searches the launch guides published on viberaven.dev by keyword and returns up to 5 matches, each with its title, URL and the short answer from the page. It only searches those published pages: it does not browse the web or read the user's project. No match returns an empty list.",
      "inputSchema": {
        "additionalProperties": false,
        "properties": {
          "query": {
            "description": "A few keywords from the question, for example \"supabase tables missing rls\".",
            "maxLength": 200,
            "minLength": 1,
            "type": "string"
          }
        },
        "required": [
          "query"
        ],
        "type": "object"
      },
      "name": "search_guides"
    }
  ]
}

What the leaf hashes

{"body":"1f936183b23a6151e87a2b66a6249d6f03c725f96f99a2ff3047c86f18a81a2f","id":265091,"kind":"mcp.tools","method":"probe.mcp/1","observed_us":1793034613087080,"prev":null,"subject":"21966bf7-635e-427a-9bc0-af25858c8736","subject_kind":"endpoint"}

Proof

Fold these into the leaf in order, hashing each sorted pair with keccak256, to reach the root of 2026-10-26 (296695 rows).

1. 0x532c5ec973a204366d77fb57d2514e810e1a113cb73177ce8aba4625742cbf02
2. 0x8dcc5e0db9999b8f70d5f152c39d4b8d5dc8692639ef2d5b6e8256a10e2ad6c3
3. 0xe4fa0fa125eeae0899f5e55f704c12a6942e7f4a9c63b89e88e71eab916c22ce
4. 0x07fc4fa4529059facc09189c25cd1619202712639b0a36e48726a2f5f58dfaf6
5. 0xa75b1a003149745114e82faa394c99d8e43ecefff2447550d3106078372d3dc6
6. 0xf303d76a7532063c396795aa9247bf1227b832a2279877f047c332ca3519fdcc
7. 0xad52d2a7c19d01f87b0bffc787ddf5a285c1bacc21cfb9f9bda2bc703743aea3
8. 0x8833831b6f9ca176d83016c6e063f42128258b707d64f9f1e126d8380d2e0efd
9. 0x707cd63ec08491d361ce9df43c10a73cfe23cf386ca2533a2d986ce81e0b98af
10. 0x72bd13c090ca80e7870affede013ba3445a9ce90177c8d0abe389b26f526682c
11. 0x11ae5fc5d08fb7b25beace35e67656980e21edfc94e809110b5b9ecae306b6c8
12. 0x94dd4ed7cf198df741ccda83eacc422aadb31119fc6e84c4a6d2f023453b7960
13. 0xd830c52e1e8095e014510110592485afcb02b9c9a36f85653e4891a8de941246
14. 0x0733993143f0230e79482cef2c38e95d98f9eafbe64a43cdc74a4545938a4167
15. 0x2be1e80e065dd6b2cc75a7142be22225acd144ac975d70bf24b4f01fd76dc497
16. 0x2e6a32eb32761c210560e852405e2f865f958ddbe01027894f8b9c1b3433b9f0
17. 0x9a83be955a206deb65b995adfd92c58fa31c95fbbf926bd199d300e70b08b26d
18. 0x20704208aa6923d6b2450ef74ede87a6e0265d46447926038fe9506e9e154b2d
19. 0x9b9ce5b74b9bab5121612ef6b64920a8d453cbf311096a423eef9702747e868a

Day root

0xf43e8dcc3d451a4788b26be904c55e8c4c0fa75c9666796c51db38d37e2c0df8

Chained

0x702d5ac508f08b0d1accf36af25822d8e5660367494edd17a642fb61e158a57a

Published

On Arc Testnet, block 69251483: 0x495162f8936e19f0039918feebe6c307f327cd6bf8c37219620b1970041fa9ae