← The evidence ledger
Evidence row 293515
Observed , by probe.mcp/1.
- Kind
- mcp.tools
- About
- endpoint 43c7e111-9e13-42f8-b5e7-aaa723088a9a
- Recorded
- Previous row
- None: the first of its kind about this subject
- Body SHA-256
- 88c30987253ca213d85781357e9ca5a3eb2825097694b31cd7375c600810fdd9
- Leaf
- 0x53f5c0f5da4346f3ec9a17ea853cb7e88dd3ff958fbdab67ddb3fc879e8090f0
What was observed
{
"count": 17,
"tools": [
{
"description": "Generate the TXT record value required to verify domain control via DNS, creating or reusing the private HIBP domain-verification records needed for the request. Requires an authenticated subscription with domain-verification access.",
"inputSchema": {
"$schema": "https://json-schema.org/draft/2020-12/schema",
"properties": {
"domain": {
"description": "The domain to generate a verification token for.",
"type": "string"
},
"response_format": {
"default": "markdown",
"description": "Format only the text content as markdown (default) or a JSON string. The same machine-readable data is always returned in structuredContent.",
"enum": [
"markdown",
"json"
],
"type": "string"
}
},
"required": [
"domain"
],
"type": "object"
},
"name": "hibp_generate_domain_verification_dns_token"
},
{
"description": "Look up a single public HIBP breach by its canonical breach name, such as Adobe.",
"inputSchema": {
"$schema": "https://json-schema.org/draft/2020-12/schema",
"properties": {
"name": {
"description": "The breach name to retrieve, for example Adobe.",
"type": "string"
},
"response_format": {
"default": "markdown",
"description": "Format only the text content as markdown (default) or a JSON string. The same machine-readable data is always returned in structuredContent.",
"enum": [
"markdown",
"json"
],
"type": "string"
}
},
"required": [
"name"
],
"type": "object"
},
"name": "hibp_get_breach"
},
{
"description": "Search HIBP for breaches affecting a single email address. Requires an OAuth bearer token linked to an active HIBP API subscription; use domain and verification filters to refine the result.",
"inputSchema": {
"$schema": "https://json-schema.org/draft/2020-12/schema",
"properties": {
"account": {
"description": "The email address to search for.",
"type": "string"
},
"domain": {
"description": "Filter results to a specific breach domain.",
"type": "string"
},
"includeUnverified": {
"default": true,
"description": "Include unverified breaches. Defaults to true.",
"type": "boolean"
},
"limit": {
"default": 25,
"description": "Maximum number of items to include in the response. Defaults to 25.",
"maximum": 100,
"minimum": 1,
"type": "integer"
},
"offset": {
"default": 0,
"description": "Number of items to skip before returning results. Defaults to 0.",
"maximum": 9007199254740991,
"minimum": 0,
"type": "integer"
},
"responseMode": {
"default": "full",
"description": "Choose full breach objects, truncated objects, or breach names.",
"enum": [
"full",
"truncated",
"names"
],
"type": "string"
},
"response_format": {
"default": "markdown",
"description": "Format only the text content as markdown (default) or a JSON string. The same machine-readable data is always returned in structuredContent.",
"enum": [
"markdown",
"json"
],
"type": "string"
}
},
"required": [
"account"
],
"type": "object"
},
"name": "hibp_get_breached_account"
},
{
"description": "Query the authenticated HIBP k-anonymity breached-account range endpoint with the first 6 characters of a SHA-1 email hash. Requires a subscription with k-anonymity access; compare each returned suffix with the remaining hash characters locally because a prefix alone cannot identify an account.",
"inputSchema": {
"$schema": "https://json-schema.org/draft/2020-12/schema",
"properties": {
"limit": {
"default": 25,
"description": "Maximum number of items to include in the response. Defaults to 25.",
"maximum": 100,
"minimum": 1,
"type": "integer"
},
"offset": {
"default": 0,
"description": "Number of items to skip before returning results. Defaults to 0.",
"maximum": 9007199254740991,
"minimum": 0,
"type": "integer"
},
"prefix": {
"description": "The first 6 hexadecimal characters of the SHA-1 hash of an email address. Compare each returned suffix with the remaining 34 characters locally; a prefix alone does not identify an account.",
"pattern": "^[0-9A-Fa-f]{6}$",
"type": "string"
},
"response_format": {
"default": "markdown",
"description": "Format only the text content as markdown (default) or a JSON string. The same machine-readable data is always returned in structuredContent.",
"enum": [
"markdown",
"json"
],
"type": "string"
}
},
"required": [
"prefix"
],
"type": "object"
},
"name": "hibp_get_breached_account_range"
},
{
"description": "Return breached aliases for a verified domain. This tool requires an authorized subscription via OAuth bearer token.",
"inputSchema": {
"$schema": "https://json-schema.org/draft/2020-12/schema",
"properties": {
"domain": {
"description": "The verified domain to search.",
"type": "string"
},
"limit": {
"default": 25,
"description": "Maximum number of items to include in the response. Defaults to 25.",
"maximum": 100,
"minimum": 1,
"type": "integer"
},
"offset": {
"default": 0,
"description": "Number of items to skip before returning results. Defaults to 0.",
"maximum": 9007199254740991,
"minimum": 0,
"type": "integer"
},
"response_format": {
"default": "markdown",
"description": "Format only the text content as markdown (default) or a JSON string. The same machine-readable data is always returned in structuredContent.",
"enum": [
"markdown",
"json"
],
"type": "string"
}
},
"required": [
"domain"
],
"type": "object"
},
"name": "hibp_get_breached_domain"
},
{
"description": "Return the most recently added public breach currently loaded into HIBP.",
"inputSchema": {
"$schema": "https://json-schema.org/draft/2020-12/schema",
"properties": {
"response_format": {
"default": "markdown",
"description": "Format only the text content as markdown (default) or a JSON string. The same machine-readable data is always returned in structuredContent.",
"enum": [
"markdown",
"json"
],
"type": "string"
}
},
"type": "object"
},
"name": "hibp_get_latest_breach"
},
{
"description": "Search for public pastes containing a single email address. Requires an OAuth bearer token linked to an active HIBP API subscription; run this separately from breached-account lookup.",
"inputSchema": {
"$schema": "https://json-schema.org/draft/2020-12/schema",
"properties": {
"account": {
"description": "The email address to search for pastes.",
"type": "string"
},
"limit": {
"default": 25,
"description": "Maximum number of items to include in the response. Defaults to 25.",
"maximum": 100,
"minimum": 1,
"type": "integer"
},
"offset": {
"default": 0,
"description": "Number of items to skip before returning results. Defaults to 0.",
"maximum": 9007199254740991,
"minimum": 0,
"type": "integer"
},
"response_format": {
"default": "markdown",
"description": "Format only the text content as markdown (default) or a JSON string. The same machine-readable data is always returned in structuredContent.",
"enum": [
"markdown",
"json"
],
"type": "string"
}
},
"required": [
"account"
],
"type": "object"
},
"name": "hibp_get_paste_account"
},
{
"description": "Query the public Pwned Passwords k-anonymity API with a 5-character SHA-1 or NTLM prefix and return matching suffixes with prevalence counts.",
"inputSchema": {
"$schema": "https://json-schema.org/draft/2020-12/schema",
"properties": {
"addPadding": {
"default": false,
"description": "Send the Add-Padding header and discard padded zero-count entries.",
"type": "boolean"
},
"limit": {
"default": 25,
"description": "Maximum number of items to include in the response. Defaults to 25.",
"maximum": 100,
"minimum": 1,
"type": "integer"
},
"mode": {
"default": "sha1",
"description": "Use SHA-1 by default or NTLM when mode is set to ntlm.",
"enum": [
"sha1",
"ntlm"
],
"type": "string"
},
"offset": {
"default": 0,
"description": "Number of items to skip before returning results. Defaults to 0.",
"maximum": 9007199254740991,
"minimum": 0,
"type": "integer"
},
"prefix": {
"description": "The first 5 hexadecimal characters of a SHA-1 or NTLM hash.",
"pattern": "^[0-9A-Fa-f]{5}$",
"type": "string"
},
"response_format": {
"default": "markdown",
"description": "Format only the text content as markdown (default) or a JSON string. The same machine-readable data is always returned in structuredContent.",
"enum": [
"markdown",
"json"
],
"type": "string"
}
},
"required": [
"prefix"
],
"type": "object"
},
"name": "hibp_get_pwned_passwords_range"
},
{
"description": "Return website domains historically observed in stealer logs for an email address. Requires an OAuth-linked active subscription with the stealer-log feature; results do not establish current account access.",
"inputSchema": {
"$schema": "https://json-schema.org/draft/2020-12/schema",
"properties": {
"email": {
"description": "The email address to search for in stealer logs.",
"type": "string"
},
"limit": {
"default": 25,
"description": "Maximum number of items to include in the response. Defaults to 25.",
"maximum": 100,
"minimum": 1,
"type": "integer"
},
"offset": {
"default": 0,
"description": "Number of items to skip before returning results. Defaults to 0.",
"maximum": 9007199254740991,
"minimum": 0,
"type": "integer"
},
"response_format": {
"default": "markdown",
"description": "Format only the text content as markdown (default) or a JSON string. The same machine-readable data is always returned in structuredContent.",
"enum": [
"markdown",
"json"
],
"type": "string"
}
},
"required": [
"email"
],
"type": "object"
},
"name": "hibp_get_stealer_logs_by_email"
},
{
"description": "Return email aliases and associated website domains historically observed in stealer logs for an email domain. Requires an OAuth-linked active subscription with the stealer-log feature; results do not establish current account access.",
"inputSchema": {
"$schema": "https://json-schema.org/draft/2020-12/schema",
"properties": {
"domain": {
"description": "The email domain to search for in stealer logs.",
"type": "string"
},
"limit": {
"default": 25,
"description": "Maximum number of items to include in the response. Defaults to 25.",
"maximum": 100,
"minimum": 1,
"type": "integer"
},
"offset": {
"default": 0,
"description": "Number of items to skip before returning results. Defaults to 0.",
"maximum": 9007199254740991,
"minimum": 0,
"type": "integer"
},
"response_format": {
"default": "markdown",
"description": "Format only the text content as markdown (default) or a JSON string. The same machine-readable data is always returned in structuredContent.",
"enum": [
"markdown",
"json"
],
"type": "string"
}
},
"required": [
"domain"
],
"type": "object"
},
"name": "hibp_get_stealer_logs_by_email_domain"
},
{
"description": "Return email addresses historically observed in stealer logs for a website domain. Requires an OAuth-linked active subscription with the stealer-log feature; results do not establish current account access.",
"inputSchema": {
"$schema": "https://json-schema.org/draft/2020-12/schema",
"properties": {
"domain": {
"description": "The website domain to search for in stealer logs.",
"type": "string"
},
"limit": {
"default": 25,
"description": "Maximum number of items to include in the response. Defaults to 25.",
"maximum": 100,
"minimum": 1,
"type": "integer"
},
"offset": {
"default": 0,
"description": "Number of items to skip before returning results. Defaults to 0.",
"maximum": 9007199254740991,
"minimum": 0,
"type": "integer"
},
"response_format": {
"default": "markdown",
"description": "Format only the text content as markdown (default) or a JSON string. The same machine-readable data is always returned in structuredContent.",
"enum": [
"markdown",
"json"
],
"type": "string"
}
},
"required": [
"domain"
],
"type": "object"
},
"name": "hibp_get_stealer_logs_by_website_domain"
},
{
"description": "Return the current plan, quotas, rate limits, expiry, and feature flags for the active HIBP API subscription linked to the authenticated OAuth connection. Use it to confirm access before feature-dependent lookups.",
"inputSchema": {
"$schema": "https://json-schema.org/draft/2020-12/schema",
"properties": {
"response_format": {
"default": "markdown",
"description": "Format only the text content as markdown (default) or a JSON string. The same machine-readable data is always returned in structuredContent.",
"enum": [
"markdown",
"json"
],
"type": "string"
}
},
"type": "object"
},
"name": "hibp_get_subscription_status"
},
{
"description": "List public HIBP breaches, optionally filtered by domain, spam-list flag, and verification status.",
"inputSchema": {
"$schema": "https://json-schema.org/draft/2020-12/schema",
"properties": {
"domain": {
"description": "Filter to breaches for a specific domain.",
"type": "string"
},
"includeUnverified": {
"default": true,
"description": "Include unverified breaches. Defaults to true.",
"type": "boolean"
},
"isSpamList": {
"description": "Filter to breaches that are or are not flagged as spam lists.",
"type": "boolean"
},
"limit": {
"default": 25,
"description": "Maximum number of items to include in the response. Defaults to 25.",
"maximum": 100,
"minimum": 1,
"type": "integer"
},
"offset": {
"default": 0,
"description": "Number of items to skip before returning results. Defaults to 0.",
"maximum": 9007199254740991,
"minimum": 0,
"type": "integer"
},
"response_format": {
"default": "markdown",
"description": "Format only the text content as markdown (default) or a JSON string. The same machine-readable data is always returned in structuredContent.",
"enum": [
"markdown",
"json"
],
"type": "string"
}
},
"type": "object"
},
"name": "hibp_list_breaches"
},
{
"description": "List the data classes used across public HIBP breach models, such as email addresses or passwords.",
"inputSchema": {
"$schema": "https://json-schema.org/draft/2020-12/schema",
"properties": {
"response_format": {
"default": "markdown",
"description": "Format only the text content as markdown (default) or a JSON string. The same machine-readable data is always returned in structuredContent.",
"enum": [
"markdown",
"json"
],
"type": "string"
}
},
"type": "object"
},
"name": "hibp_list_data_classes"
},
{
"description": "List the domains associated with the authenticated HIBP subscription.",
"inputSchema": {
"$schema": "https://json-schema.org/draft/2020-12/schema",
"properties": {
"limit": {
"default": 25,
"description": "Maximum number of items to include in the response. Defaults to 25.",
"maximum": 100,
"minimum": 1,
"type": "integer"
},
"offset": {
"default": 0,
"description": "Number of items to skip before returning results. Defaults to 0.",
"maximum": 9007199254740991,
"minimum": 0,
"type": "integer"
},
"response_format": {
"default": "markdown",
"description": "Format only the text content as markdown (default) or a JSON string. The same machine-readable data is always returned in structuredContent.",
"enum": [
"markdown",
"json"
],
"type": "string"
}
},
"type": "object"
},
"name": "hibp_list_subscribed_domains"
},
{
"description": "Send a domain verification email to an approved alias such as admin or security. Requires an authenticated subscription with domain-verification access.",
"inputSchema": {
"$schema": "https://json-schema.org/draft/2020-12/schema",
"properties": {
"domain": {
"description": "The domain to verify by email.",
"type": "string"
},
"emailAlias": {
"description": "The approval alias to send the verification email to, for example admin.",
"type": "string"
},
"response_format": {
"default": "markdown",
"description": "Format only the text content as markdown (default) or a JSON string. The same machine-readable data is always returned in structuredContent.",
"enum": [
"markdown",
"json"
],
"type": "string"
}
},
"required": [
"domain",
"emailAlias"
],
"type": "object"
},
"name": "hibp_send_domain_verification_email"
},
{
"description": "Complete domain verification by checking the expected HIBP TXT record on the target domain. Requires an authenticated subscription with domain-verification access.",
"inputSchema": {
"$schema": "https://json-schema.org/draft/2020-12/schema",
"properties": {
"domain": {
"description": "The domain to verify by DNS.",
"type": "string"
},
"response_format": {
"default": "markdown",
"description": "Format only the text content as markdown (default) or a JSON string. The same machine-readable data is always returned in structuredContent.",
"enum": [
"markdown",
"json"
],
"type": "string"
}
},
"required": [
"domain"
],
"type": "object"
},
"name": "hibp_verify_domain_verification_dns_token"
}
]
}What the leaf hashes
{"body":"88c30987253ca213d85781357e9ca5a3eb2825097694b31cd7375c600810fdd9","id":293515,"kind":"mcp.tools","method":"probe.mcp/1","observed_us":1793049445869978,"prev":null,"subject":"43c7e111-9e13-42f8-b5e7-aaa723088a9a","subject_kind":"endpoint"}Proof
Fold these into the leaf in order, hashing each sorted pair with keccak256, to reach the root of (296695 rows).
- 0x53f5a335b273d9e80a63bebabcf03af32aa6156e70a5eae9f69ee853fe330ccf
- 0x9514e12deccd9548a010fcfc87a63f9f8ffb4c82c6759a21bb2d6c234b9cbe2c
- 0x8f12be520ab760d44e545c58095933a64ec1834c0c523eb9ca3380b684d52d8b
- 0x0207e9796cbcab4adaf93fab966b810b7db3fce6c1e6ff00dbf3e3bf7b4733c5
- 0x67cca1628cf93f091b0aeaa3ec7137188939ddee038c8c3d622a265a115c1ae7
- 0x524c1eee0f8bd01fe5f8e7b049091c221f26480b2a72e33858b58b948477d3c6
- 0x8ca30eda164fd7343b6d685e53fdc5a92fbe7f92c4295918db7084385bc0caa4
- 0x00c67fc48f63c2582153c3a8e345581d1a3aa836a49cf141ed671fe23a238465
- 0x6de35252275872c66261656ad91778274bf661defd7004071c1996b7c44932fc
- 0x51f5ff307937bdcac2eeb604499c77e1e67ec126246e5fead94e1044a2a751f5
- 0xa1d1c99aa28ad1dadb7dae5386ee0342e06cf642d29909897d3feca675a6d839
- 0x774d66905c34a786c6d34bf1c4491dbdb08f534c9eb5f76cf3de03385d28f388
- 0xd830c52e1e8095e014510110592485afcb02b9c9a36f85653e4891a8de941246
- 0x0733993143f0230e79482cef2c38e95d98f9eafbe64a43cdc74a4545938a4167
- 0x2be1e80e065dd6b2cc75a7142be22225acd144ac975d70bf24b4f01fd76dc497
- 0x2e6a32eb32761c210560e852405e2f865f958ddbe01027894f8b9c1b3433b9f0
- 0x9a83be955a206deb65b995adfd92c58fa31c95fbbf926bd199d300e70b08b26d
- 0x20704208aa6923d6b2450ef74ede87a6e0265d46447926038fe9506e9e154b2d
- 0x9b9ce5b74b9bab5121612ef6b64920a8d453cbf311096a423eef9702747e868a
- Day root
- 0xf43e8dcc3d451a4788b26be904c55e8c4c0fa75c9666796c51db38d37e2c0df8
- Chained
- 0x702d5ac508f08b0d1accf36af25822d8e5660367494edd17a642fb61e158a57a
- Published
- On Arc Testnet, block 69251483: 0x495162f8936e19f0039918feebe6c307f327cd6bf8c37219620b1970041fa9ae