← The evidence ledger
Evidence row 275758
Observed , by probe.mcp/1.
- Kind
- mcp.tools
- About
- endpoint df496e41-4151-4a62-af1b-dbe203fe6d7a
- Recorded
- Previous row
- None: the first of its kind about this subject
- Body SHA-256
- 1cc5979b59b9e5393f137a5de3b9a1e88942b84f9fb9215c722752af586b5075
- Leaf
- 0x9810185ab43334df66f37183f9d56b5fd46235de17af94f619750f9bb8063e17
What was observed
{
"count": 11,
"tools": [
{
"description": "Deterministically attach your triage verdicts to their findings and re-sort by exposure (highest first). Never suppresses. Pass the same 'findings' array you triaged plus a 'verdicts' array of { fingerprint, exposureScore, priority, rationale }.",
"inputSchema": {
"additionalProperties": false,
"properties": {
"findings": {
"description": "The findings that were triaged.",
"items": {
"description": "A single finding from `scan_path --format json`.",
"properties": {
"algorithm": {
"description": "Classical algorithm family, when applicable.",
"type": "string"
},
"category": {
"type": "string"
},
"confidence": {
"type": "string"
},
"cwe": {
"description": "e.g. \"CWE-327\".",
"type": "string"
},
"hndl": {
"description": "Exposed to harvest-now-decrypt-later.",
"type": "boolean"
},
"location": {
"description": "Where the finding is.",
"properties": {
"file": {
"type": "string"
},
"line": {
"type": "number"
}
},
"required": [
"file"
],
"type": "object"
},
"message": {
"type": "string"
},
"remediation": {
"type": "string"
},
"ruleId": {
"description": "Stable rule id, e.g. \"rsa-keygen\".",
"type": "string"
},
"severity": {
"description": "critical | high | medium | low | info.",
"type": "string"
},
"title": {
"type": "string"
}
},
"required": [
"ruleId",
"location"
],
"type": "object"
},
"type": "array"
},
"verdicts": {
"description": "One verdict per finding, keyed by fingerprint.",
"items": {
"description": "A triage verdict for one finding.",
"properties": {
"exposureScore": {
"description": "Real-world exposure (higher = more exposed).",
"type": "number"
},
"fingerprint": {
"description": "Fingerprint of the finding this verdict applies to.",
"type": "string"
},
"priority": {
"enum": [
"now",
"soon",
"later"
],
"type": "string"
},
"rationale": {
"description": "Why this exposure score / priority.",
"type": "string"
}
},
"required": [
"fingerprint",
"exposureScore",
"priority",
"rationale"
],
"type": "object"
},
"type": "array"
}
},
"required": [
"findings",
"verdicts"
],
"type": "object"
},
"name": "apply_triage"
},
{
"description": "Deterministically VERIFY a proposed fix before writing it — runs the same patch-policy + verify_fix + blast-radius gates as `qremediate` (offline, no key, no network). Give the finding, the file's current content, and your proposed FULL corrected content; returns approved:true only if the patch is in-policy, clears the finding, adds no new finding, introduces no network/exec sink, and is bounded in size. This does NOT write the file — you write it, only when approved, and never auto-merge.",
"inputSchema": {
"additionalProperties": false,
"properties": {
"finding": {
"description": "The scan finding being fixed (needs a string ruleId and location.file).",
"type": "object"
},
"newContent": {
"description": "Your proposed full corrected file content.",
"type": "string"
},
"originalContent": {
"description": "The file's current full content.",
"type": "string"
}
},
"required": [
"finding",
"originalContent",
"newContent"
],
"type": "object"
},
"name": "apply_verified_patch"
},
{
"description": "Check whether a package is in quantakrypto's known quantum-vulnerable dependency database (the classical crypto it exposes). Provide 'name' and optional 'ecosystem' (default npm).",
"inputSchema": {
"additionalProperties": false,
"properties": {
"ecosystem": {
"description": "Package ecosystem. Default: npm.",
"type": "string"
},
"name": {
"description": "Package name to look up (e.g. 'node-forge', 'jsonwebtoken').",
"type": "string"
}
},
"required": [
"name"
],
"type": "object"
},
"name": "check_dependency"
},
{
"description": "Explain a quantakrypto finding and its post-quantum remediation. Provide a ruleId (e.g. 'forge-rsa-keygen', 'elliptic-ec', 'node-rsa', 'pem-ec-private-key') and/or an algorithm (e.g. 'RSA', 'ECDSA'). The ruleId is resolved against the core detector set, so library and config rules explain correctly.",
"inputSchema": {
"additionalProperties": false,
"properties": {
"algorithm": {
"description": "The classical algorithm family involved (e.g. RSA, ECDH, ECDSA).",
"type": "string"
},
"ruleId": {
"description": "The finding's rule id, matching a detector id prefix.",
"type": "string"
}
},
"type": "object"
},
"name": "explain_finding"
},
{
"description": "Return before/after code examples for migrating a classical algorithm to a post-quantum / hybrid replacement. Provide an 'algorithm' (RSA, ECDH, ECDSA, …) or a 'ruleId' from a finding.",
"inputSchema": {
"additionalProperties": false,
"properties": {
"algorithm": {
"description": "Classical algorithm family to migrate away from.",
"type": "string"
},
"ruleId": {
"description": "A finding's ruleId (resolved to its algorithm).",
"type": "string"
}
},
"type": "object"
},
"name": "get_fix_examples"
},
{
"description": "List the quantakrypto detector catalog: every detector id and what it looks for.",
"inputSchema": {
"additionalProperties": false,
"properties": {},
"type": "object"
},
"name": "list_rules"
},
{
"description": "Produce a deterministic remediation REQUEST bundle (rubric + fix schema + per-finding metadata + fingerprints) for YOU (the host agent) to fix. This tool calls no model and needs no key. For each finding, propose the corrected FULL file content, then VERIFY with verify_fix and keep only fixes that clear the finding. Never touch files with secrets; never auto-merge. Pass 'findings' from scan_path --format json.",
"inputSchema": {
"additionalProperties": false,
"properties": {
"findings": {
"description": "Findings from a scan's JSON output.",
"items": {
"description": "A single finding from `scan_path --format json`.",
"properties": {
"algorithm": {
"description": "Classical algorithm family, when applicable.",
"type": "string"
},
"category": {
"type": "string"
},
"confidence": {
"type": "string"
},
"cwe": {
"description": "e.g. \"CWE-327\".",
"type": "string"
},
"hndl": {
"description": "Exposed to harvest-now-decrypt-later.",
"type": "boolean"
},
"location": {
"description": "Where the finding is.",
"properties": {
"file": {
"type": "string"
},
"line": {
"type": "number"
}
},
"required": [
"file"
],
"type": "object"
},
"message": {
"type": "string"
},
"remediation": {
"type": "string"
},
"ruleId": {
"description": "Stable rule id, e.g. \"rsa-keygen\".",
"type": "string"
},
"severity": {
"description": "critical | high | medium | low | info.",
"type": "string"
},
"title": {
"type": "string"
}
},
"required": [
"ruleId",
"location"
],
"type": "object"
},
"type": "array"
}
},
"required": [
"findings"
],
"type": "object"
},
"name": "remediate_findings"
},
{
"description": "Compute the readiness-score and HNDL change between two finding sets (e.g. before and after a migration). Pass 'before' and 'after' as arrays of findings from scan_path --format json.",
"inputSchema": {
"additionalProperties": false,
"properties": {
"after": {
"description": "Findings after the change.",
"items": {
"description": "A single finding from `scan_path --format json`.",
"properties": {
"algorithm": {
"description": "Classical algorithm family, when applicable.",
"type": "string"
},
"category": {
"type": "string"
},
"confidence": {
"type": "string"
},
"cwe": {
"description": "e.g. \"CWE-327\".",
"type": "string"
},
"hndl": {
"description": "Exposed to harvest-now-decrypt-later.",
"type": "boolean"
},
"location": {
"description": "Where the finding is.",
"properties": {
"file": {
"type": "string"
},
"line": {
"type": "number"
}
},
"required": [
"file"
],
"type": "object"
},
"message": {
"type": "string"
},
"remediation": {
"type": "string"
},
"ruleId": {
"description": "Stable rule id, e.g. \"rsa-keygen\".",
"type": "string"
},
"severity": {
"description": "critical | high | medium | low | info.",
"type": "string"
},
"title": {
"type": "string"
}
},
"required": [
"ruleId",
"location"
],
"type": "object"
},
"type": "array"
},
"before": {
"description": "Findings before the change (from a scan's JSON findings).",
"items": {
"description": "A single finding from `scan_path --format json`.",
"properties": {
"algorithm": {
"description": "Classical algorithm family, when applicable.",
"type": "string"
},
"category": {
"type": "string"
},
"confidence": {
"type": "string"
},
"cwe": {
"description": "e.g. \"CWE-327\".",
"type": "string"
},
"hndl": {
"description": "Exposed to harvest-now-decrypt-later.",
"type": "boolean"
},
"location": {
"description": "Where the finding is.",
"properties": {
"file": {
"type": "string"
},
"line": {
"type": "number"
}
},
"required": [
"file"
],
"type": "object"
},
"message": {
"type": "string"
},
"remediation": {
"type": "string"
},
"ruleId": {
"description": "Stable rule id, e.g. \"rsa-keygen\".",
"type": "string"
},
"severity": {
"description": "critical | high | medium | low | info.",
"type": "string"
},
"title": {
"type": "string"
}
},
"required": [
"ruleId",
"location"
],
"type": "object"
},
"type": "array"
}
},
"required": [
"before",
"after"
],
"type": "object"
},
"name": "score_delta"
},
{
"description": "Recommend a post-quantum / hybrid migration. Provide an 'algorithm' (e.g. RSA, ECDH, ECDSA) or free-text 'context' describing the usage. Set 'tier' to 'category-5' for CNSA 2.0 / national-security systems.",
"inputSchema": {
"additionalProperties": false,
"properties": {
"algorithm": {
"description": "Classical algorithm family to migrate away from.",
"type": "string"
},
"context": {
"description": "Free-text description of the cryptographic usage (used when no algorithm is given).",
"type": "string"
},
"tier": {
"description": "Security tier: 'category-3' (default, commercial — ML-KEM-768 / ML-DSA-65) or 'category-5' (CNSA 2.0 / NSS, long-lived secrets — ML-KEM-1024 / ML-DSA-87).",
"enum": [
"category-3",
"category-5"
],
"type": "string"
}
},
"type": "object"
},
"name": "suggest_hybrid"
},
{
"description": "Produce a deterministic triage REQUEST bundle (rubric + verdict schema + per-finding metadata) for YOU (the host agent) to reason over. This tool does NOT call any model and needs no API key. Assess each finding's real-world exposure, then call apply_triage with your verdicts. Pass 'findings' as an array from scan_path --format json.",
"inputSchema": {
"additionalProperties": false,
"properties": {
"findings": {
"description": "Findings from a scan's JSON output.",
"items": {
"description": "A single finding from `scan_path --format json`.",
"properties": {
"algorithm": {
"description": "Classical algorithm family, when applicable.",
"type": "string"
},
"category": {
"type": "string"
},
"confidence": {
"type": "string"
},
"cwe": {
"description": "e.g. \"CWE-327\".",
"type": "string"
},
"hndl": {
"description": "Exposed to harvest-now-decrypt-later.",
"type": "boolean"
},
"location": {
"description": "Where the finding is.",
"properties": {
"file": {
"type": "string"
},
"line": {
"type": "number"
}
},
"required": [
"file"
],
"type": "object"
},
"message": {
"type": "string"
},
"remediation": {
"type": "string"
},
"ruleId": {
"description": "Stable rule id, e.g. \"rsa-keygen\".",
"type": "string"
},
"severity": {
"description": "critical | high | medium | low | info.",
"type": "string"
},
"title": {
"type": "string"
}
},
"required": [
"ruleId",
"location"
],
"type": "object"
},
"type": "array"
}
},
"required": [
"findings"
],
"type": "object"
},
"name": "triage_findings"
},
{
"description": "Run the quantakrypto detectors over a code snippet (NOT the filesystem) and report any classical crypto that remains. Use this to confirm an edit actually removed the quantum-vulnerable usage. Provide 'code' plus a 'language' or 'filename'.",
"inputSchema": {
"additionalProperties": false,
"properties": {
"code": {
"description": "The source code to check.",
"type": "string"
},
"filename": {
"description": "Optional filename; its extension selects the detectors (overrides 'language').",
"type": "string"
},
"language": {
"description": "Language of the code (js, ts, python, go, java, csharp, rust, ruby, c, …).",
"type": "string"
}
},
"required": [
"code"
],
"type": "object"
},
"name": "verify_fix"
}
]
}What the leaf hashes
{"body":"1cc5979b59b9e5393f137a5de3b9a1e88942b84f9fb9215c722752af586b5075","id":275758,"kind":"mcp.tools","method":"probe.mcp/1","observed_us":1793040793673229,"prev":null,"subject":"df496e41-4151-4a62-af1b-dbe203fe6d7a","subject_kind":"endpoint"}Proof
Fold these into the leaf in order, hashing each sorted pair with keccak256, to reach the root of (296695 rows).
- 0x98105558107f4ae921f3b3a93aa8fa856a0c08f72ab790eaa659d3fe8fdf25e4
- 0xdc027154a5da101882319c5d9839ba06ce689260bd561e4065a2daa68f69206e
- 0x3117180f0b29da47c035485cc5f257383f2088ed81fb93c94c528b314d20ec20
- 0xc77aad74c2f1c3a0b71d7f54f66a40d7c4cb242d47c84570827dc66856125d1e
- 0x53d6d68461d59350d38d1facd252f317bc74e9f6e6d02d280fa5b498bce10740
- 0x4da0247ef10c9eb2f21e2a256100d8809f628a82b2f64f9d7a1e7b648d44e822
- 0x3c792b711be9eadbc34af6662cc5dcd7e9878907e6d00d01aa4dbf988bc1abf2
- 0xdd378790e95acae01572ea9433f1aebe5dfe4c6c3c8fc022fb3d30e0d484073d
- 0x25d1ea1d0d5fab7b21924d98cb519f19fa869c9a1fbc859dc895a6877626bb0d
- 0x62dba386f50cb8efacb93dad4cf930ac3e24a2aa9dd76d9a72cb57081301531b
- 0xdc8fbefd31fb9903d70279fafdb3f8c1ade2281bea30bd73cec515e9ff4113ed
- 0x6ae9e6ee1b544d831982666bd3570457659e78fc0064894d7ec23f971a37ff2f
- 0x239fd39716710e7412bd120c373072b4c0d8b11bb9ee431dad62a2ce57b3d6f4
- 0x49062da782c4f73855ddd5fdd51840749f928b5f17d1ce75ac50f2d829104e72
- 0xf0bd63870f0bb378fa300bd33563050dcb7b3e02b44eb3ee550c1c534ec4b246
- 0x1ac20d30773e1f4f2f811540e9a99b5cca9177c9e2e029acc0d80cf3f1d11f0f
- 0xd21942ae3214eff88e08ab04884fd4b11958b51af9a0741b7668e2d07a2c56c9
- 0x9a9024edb5069d88a324facb310a5ce8e495214bbaa968f077bede437390194f
- 0x9b9ce5b74b9bab5121612ef6b64920a8d453cbf311096a423eef9702747e868a
- Day root
- 0xf43e8dcc3d451a4788b26be904c55e8c4c0fa75c9666796c51db38d37e2c0df8
- Chained
- 0x702d5ac508f08b0d1accf36af25822d8e5660367494edd17a642fb61e158a57a
- Published
- On Arc Testnet, block 69251483: 0x495162f8936e19f0039918feebe6c307f327cd6bf8c37219620b1970041fa9ae