Evidence row 299744

What was observed

{
  "count": 15,
  "tools": [
    {
      "description": "HaveIBeenPwned breach database — check domain/company breach exposure. DORA Art. 18 incident assessment.",
      "inputSchema": {
        "additionalProperties": false,
        "properties": {
          "domain": {
            "description": "Company domain e.g. 'meinbank.de' (optional — omit for latest breaches)",
            "type": "string"
          },
          "limit": {
            "default": 20,
            "description": "Max results 1-50 (default: 20)",
            "maximum": 50,
            "minimum": 1,
            "type": "integer"
          }
        },
        "type": "object"
      },
      "name": "breach_check"
    },
    {
      "description": "CERT-Bund security advisories — authoritative DE source for ICT threats. DORA Art. 17 threat monitoring.",
      "inputSchema": {
        "additionalProperties": false,
        "properties": {
          "keyword": {
            "description": "Filter by keyword e.g. 'Windows', 'Apache', 'Cisco'",
            "type": "string"
          },
          "limit": {
            "default": 15,
            "description": "Max results 1-30 (default: 15)",
            "maximum": 30,
            "minimum": 1,
            "type": "integer"
          }
        },
        "type": "object"
      },
      "name": "cert_advisories"
    },
    {
      "description": "Live status of AWS, GCP, Azure cloud providers. DORA Art. 28 third-party ICT risk monitoring.",
      "inputSchema": {
        "additionalProperties": false,
        "properties": {
          "limit": {
            "default": 10,
            "description": "Max incidents per provider (default: 10)",
            "type": "integer"
          },
          "provider": {
            "description": "Provider: aws, gcp, azure, all (default: all)",
            "type": "string"
          }
        },
        "type": "object"
      },
      "name": "cloud_status"
    },
    {
      "description": "Latest critical CVEs — daily DORA ICT risk briefing. Filter by severity and banking relevance.",
      "inputSchema": {
        "additionalProperties": false,
        "properties": {
          "banking_only": {
            "description": "Filter to banking-relevant vendors only (default: false)",
            "type": "boolean"
          },
          "days": {
            "default": 7,
            "description": "Last N days (default: 7)",
            "type": "integer"
          },
          "limit": {
            "default": 10,
            "description": "Max results 1-20 (default: 10)",
            "maximum": 20,
            "minimum": 1,
            "type": "integer"
          },
          "severity": {
            "description": "CRITICAL, HIGH, MEDIUM (default: CRITICAL)",
            "type": "string"
          }
        },
        "type": "object"
      },
      "name": "cve_latest"
    },
    {
      "description": "Search CVEs by keyword, vendor or product. Returns CVSS scores, attack vectors, DORA pillar mapping.",
      "inputSchema": {
        "additionalProperties": false,
        "properties": {
          "days": {
            "default": 30,
            "description": "Published within last N days (default: 30)",
            "type": "integer"
          },
          "keyword": {
            "description": "Search keyword e.g. 'authentication bypass', 'remote code execution'",
            "type": "string"
          },
          "limit": {
            "default": 10,
            "description": "Max results 1-20 (default: 10)",
            "maximum": 20,
            "minimum": 1,
            "type": "integer"
          },
          "severity": {
            "description": "CVSS severity: CRITICAL, HIGH, MEDIUM, LOW",
            "enum": [
              "CRITICAL",
              "HIGH",
              "MEDIUM",
              "LOW"
            ],
            "type": "string"
          },
          "vendor": {
            "description": "Vendor/product e.g. 'SAP', 'Cisco', 'Microsoft Exchange'",
            "type": "string"
          }
        },
        "type": "object"
      },
      "name": "cve_search"
    },
    {
      "description": "DORA compliance milestones and upcoming deadlines for financial institutions. All Art. references included.",
      "inputSchema": {
        "additionalProperties": false,
        "properties": {},
        "type": "object"
      },
      "name": "dora_calendar"
    },
    {
      "description": "EBA/DORA regulatory news for banks. Topics: general, eba, incident, third_party, testing, guidelines, bafin, swift.",
      "inputSchema": {
        "additionalProperties": false,
        "properties": {
          "lang": {
            "description": "Language: en or de (default: en)",
            "type": "string"
          },
          "limit": {
            "default": 10,
            "description": "Max articles 1-20 (default: 10)",
            "maximum": 20,
            "minimum": 1,
            "type": "integer"
          },
          "topic": {
            "description": "Topic: general, eba, incident, third_party, testing, guidelines, bafin, swift, fintech",
            "type": "string"
          }
        },
        "type": "object"
      },
      "name": "dora_news"
    },
    {
      "description": "DORAOracle server status and all backend connectivity checks.",
      "inputSchema": {
        "additionalProperties": false,
        "properties": {},
        "type": "object"
      },
      "name": "health_check"
    },
    {
      "description": "Generate a DORA Art. 19-aligned ICT incident reporting timeline with the regulatory deadline structure. Supports - does not constitute - compliant reporting.",
      "inputSchema": {
        "additionalProperties": false,
        "properties": {
          "classification": {
            "description": "Incident class: major, significant, minor (default: major)",
            "type": "string"
          },
          "incident_time": {
            "description": "ISO timestamp of incident e.g. '2026-03-19T14:00:00Z' (default: now)",
            "type": "string"
          },
          "sector": {
            "description": "Sector: banking, insurance, payment (default: banking)",
            "type": "string"
          }
        },
        "type": "object"
      },
      "name": "incident_timeline"
    },
    {
      "description": "Check if a specific CVE is in CISA KEV (actively exploited in the wild). Returns DORA incident classification guidance.",
      "inputSchema": {
        "additionalProperties": false,
        "properties": {
          "cve_id": {
            "description": "CVE ID to check e.g. 'CVE-2021-44228' (Log4Shell)",
            "type": "string"
          }
        },
        "type": "object"
      },
      "name": "kev_check"
    },
    {
      "description": "CISA Known Exploited Vulnerabilities — actively exploited CVEs with patch deadlines. DORA Art. 9 patch compliance.",
      "inputSchema": {
        "additionalProperties": false,
        "properties": {
          "days": {
            "default": 30,
            "description": "Added to KEV within last N days (default: 30)",
            "type": "integer"
          },
          "limit": {
            "default": 15,
            "description": "Max results 1-50 (default: 15)",
            "maximum": 50,
            "minimum": 1,
            "type": "integer"
          },
          "overdue": {
            "description": "Show only overdue patches (default: false)",
            "type": "boolean"
          },
          "vendor": {
            "description": "Filter by vendor e.g. 'Cisco', 'Microsoft', 'SAP'",
            "type": "string"
          }
        },
        "type": "object"
      },
      "name": "kev_list"
    },
    {
      "description": "MITRE ATT&CK techniques for DORA TLPT / TIBER-EU penetration testing. Maps to DORA Art. 26.",
      "inputSchema": {
        "additionalProperties": false,
        "properties": {
          "keyword": {
            "description": "Search keyword e.g. 'ransomware', 'phishing', 'credential'",
            "type": "string"
          },
          "limit": {
            "default": 10,
            "description": "Max results 1-20 (default: 10)",
            "maximum": 20,
            "minimum": 1,
            "type": "integer"
          },
          "tactic": {
            "description": "Filter by tactic: Initial Access, Lateral Movement, Impact, Persistence, etc.",
            "type": "string"
          }
        },
        "type": "object"
      },
      "name": "mitre_techniques"
    },
    {
      "description": "DORA Art. 28 ICT third-party risk assessment: CVE history, news, GLEIF registration, contractual checklist.",
      "inputSchema": {
        "additionalProperties": false,
        "properties": {
          "provider": {
            "description": "Provider name e.g. 'SAP', 'Salesforce', 'AWS', 'Temenos'",
            "type": "string"
          }
        },
        "type": "object"
      },
      "name": "provider_risk"
    },
    {
      "description": "Feodo Tracker: live C2 botnet servers (Emotet, QakBot, etc.). Actionable IP blocklist for DORA Art. 9.",
      "inputSchema": {
        "additionalProperties": false,
        "properties": {
          "limit": {
            "default": 20,
            "description": "Max results 1-100 (default: 20)",
            "maximum": 100,
            "minimum": 1,
            "type": "integer"
          },
          "malware": {
            "description": "Filter by malware family: Emotet, QakBot, Dridex, TrickBot",
            "type": "string"
          },
          "status": {
            "description": "Filter by status: online, offline",
            "type": "string"
          }
        },
        "type": "object"
      },
      "name": "threat_actors"
    },
    {
      "description": "TIBER-EU threat scenarios for DORA resilience testing planning. Banking-specific attack simulations.",
      "inputSchema": {
        "additionalProperties": false,
        "properties": {
          "focus": {
            "description": "Focus area: swift, ransomware, insider, ddos, cloud (default: all)",
            "type": "string"
          },
          "sector": {
            "description": "Sector: banking (default: banking)",
            "type": "string"
          }
        },
        "type": "object"
      },
      "name": "tlpt_scenarios"
    }
  ]
}

What the leaf hashes

{"body":"b75ffe43610112f1c2ff67b2cce2dfef337e218dc5bd6e681899973d08cd3a22","id":299744,"kind":"mcp.tools","method":"probe.mcp/1","observed_us":1793053071879882,"prev":null,"subject":"0b394709-2101-47f8-8305-edb21b330ae7","subject_kind":"endpoint"}

Proof

Fold these into the leaf in order, hashing each sorted pair with keccak256, to reach the root of 2026-10-26 (296695 rows).

1. 0x8b1f53aff121c2b60f56890962de4cb4dfc9262bc849711dd770003e57a7c915
2. 0xadebf37b523b9e73eeae07a056fa7c05766dd15dfbd024e962cc7d5f6db61f64
3. 0x1f45a892f71cfa19f190311e36662779eb366f58935f4bf0e627549f70e09cf4
4. 0x9b647bc591ef8f3156ad1f2563c39da16b7f204f1a67edc6e7088b913a69f2a4
5. 0x9f52e16dcc6f93943790bdb900750940ba0275abc59f4dd822f9476bd842685b
6. 0xb4d37c809fd704b5dedfa74d84ae289043d3edc0b54aba270a4af12b898ee323
7. 0xb0f5534f081e32471ea221d5d7122461bddc4081420882bb4e0d5694b9458fad
8. 0x29dfc76639bdd608de1da37aa51ef19a82f23e884bfa3bcbc31248d798cddff7
9. 0x0fffe292d9960e31d06d8fce508362f1d4f4450d619eba8241c8efa6d94710d9
10. 0x7d19a8f0d44d0c224dd4e1fd540ac67cd3370e926b73e965b2beb37e5ab9936b
11. 0x7d887da17795602ff54a7a2d145692904e47f8d3ab035b8db85d274d00bc9bfe
12. 0x8cb11bf3bc7d3a6f859c170a167821024ffc4758cdfd2cc96f61a3291aefb637
13. 0xd5ec7ffaecac790d8adfa0620b0a5494758f862e3090b49e556a6ecbad2f0782
14. 0x78ac2b34737774659a6a411f4d10b8ba570d40699d9f277321c3a32ff03d1dc9
15. 0x7eb603d37f0f22dae1ea013e391889906ffc0139ff26e25b044bee38eec8f9b2
16. 0x2b6e23e3624a1b66e1d2298cfbce99a93ce6b13d24a58112a71802d79c5f7a76
17. 0xd21942ae3214eff88e08ab04884fd4b11958b51af9a0741b7668e2d07a2c56c9
18. 0x9a9024edb5069d88a324facb310a5ce8e495214bbaa968f077bede437390194f
19. 0x9b9ce5b74b9bab5121612ef6b64920a8d453cbf311096a423eef9702747e868a

Day root

0xf43e8dcc3d451a4788b26be904c55e8c4c0fa75c9666796c51db38d37e2c0df8

Chained

0x702d5ac508f08b0d1accf36af25822d8e5660367494edd17a642fb61e158a57a

Published

On Arc Testnet, block 69251483: 0x495162f8936e19f0039918feebe6c307f327cd6bf8c37219620b1970041fa9ae