← The evidence ledger
Evidence row 300058
Observed , by probe.mcp/1.
- Kind
- mcp.tools
- About
- endpoint d3a36417-5101-49ed-a783-0f6f42181608
- Recorded
- Previous row
- None: the first of its kind about this subject
- Body SHA-256
- d42ff0b189314182c4a584aaa1651709edb147b5e0cf7692150684aee55cbbaa
- Leaf
- 0x5a10c3a0a0f7209b802be0799006b984b138966fdd600bcdfd9f4c4e84b20ab5
What was observed
{
"count": 20,
"tools": [
{
"description": "Resolves a public IP address, or a domain, to the autonomous system that announces it: AS number and name, announced prefix, country code, registry and allocation date. Distinguishes hosting providers, CDNs and corporate networks; it does not identify the site owner. Private and reserved addresses have no announcing AS. ip_geolocation returns the same AS data plus country and PTR. Anonymous, rate-limited per IP.",
"inputSchema": {
"$schema": "http://json-schema.org/draft-07/schema#",
"properties": {
"query": {
"description": "Public IP address or domain name",
"minLength": 1,
"type": "string"
}
},
"required": [
"query"
],
"type": "object"
},
"name": "asn_lookup"
},
{
"description": "Resolves a domain's DNS records in one call (A, AAAA, CNAME, MX, TXT, NS, SOA and more) and returns each record type with its values, or a per-type error where a lookup failed. Answers come from a single resolver; dns_propagation compares several. Reads records only and never connects to the host. Anonymous, rate-limited per IP.",
"inputSchema": {
"$schema": "http://json-schema.org/draft-07/schema#",
"properties": {
"domain": {
"description": "Domain name, e.g. deinkunde.com",
"minLength": 1,
"type": "string"
}
},
"required": [
"domain"
],
"type": "object"
},
"name": "check_dns"
},
{
"description": "Fetches and evaluates a host's TLS certificate over a live handshake: subject, issuer, validity window, days until expiry, hostname match, chain trust, self-signed and expired flags, SANs, serial and SHA-256 fingerprint. Takes a hostname (not an IP address) and an optional port (default 443). A single sample taken now; HTTP behaviour is covered by website_status and the HSTS policy by hsts_check. Anonymous, rate-limited per IP; private and reserved addresses are refused.",
"inputSchema": {
"$schema": "http://json-schema.org/draft-07/schema#",
"properties": {
"host": {
"description": "Domain name (not an IP), e.g. deinkunde.com",
"minLength": 1,
"type": "string"
},
"port": {
"description": "TLS port, default 443",
"maximum": 65535,
"minimum": 1,
"type": "integer"
}
},
"required": [
"host"
],
"type": "object"
},
"name": "check_ssl"
},
{
"description": "Fetches and validates the DKIM public key at <selector>._domainkey.<domain>: parsed tags, key type, key size and warnings such as a revoked or malformed key. The selector is required and cannot be derived from the domain; it appears in a message's DKIM-Signature header (common provider values: google, selector1, default, k1). An unused selector returns found=false. Anonymous, rate-limited per IP.",
"inputSchema": {
"$schema": "http://json-schema.org/draft-07/schema#",
"properties": {
"domain": {
"description": "Domain name, e.g. deinkunde.com",
"minLength": 1,
"type": "string"
},
"selector": {
"description": "DKIM selector, e.g. google or default",
"minLength": 1,
"type": "string"
}
},
"required": [
"domain",
"selector"
],
"type": "object"
},
"name": "dkim_check"
},
{
"description": "Fetches a domain's DMARC record from _dmarc.<domain> and evaluates it: raw record, parsed tags, policy and subdomain policy, percentage, and warnings for records that parse but offer no protection (p=none, missing rua). Reports the published policy, not whether real mail passes it; spf_check and dkim_check cover the mechanisms it aligns against. Anonymous, rate-limited per IP.",
"inputSchema": {
"$schema": "http://json-schema.org/draft-07/schema#",
"properties": {
"domain": {
"description": "Domain name, e.g. deinkunde.com",
"minLength": 1,
"type": "string"
}
},
"required": [
"domain"
],
"type": "object"
},
"name": "dmarc_check"
},
{
"description": "Queries one domain against several public resolvers and compares the answers, which tells a recent record change apart from a stale cache. Returns each resolver with its values and a `consistent` flag that stays false while the answers differ. check_dns is the cheaper call for a single reading of all record types. Anonymous, rate-limited per IP.",
"inputSchema": {
"$schema": "http://json-schema.org/draft-07/schema#",
"properties": {
"domain": {
"description": "Domain name, e.g. deinkunde.com",
"minLength": 1,
"type": "string"
}
},
"required": [
"domain"
],
"type": "object"
},
"name": "dns_propagation"
},
{
"description": "Checks a public IP address against common DNS blocklists and returns, per list, whether it is listed, the list's reason code and delisting URL, plus totals and a `clean` flag. Takes an IP address, not a domain (mx_lookup or check_dns resolve one). Slow lists are skipped rather than awaited, so partial=true marks a provisional verdict. One call reflects only the current moment. Anonymous, with the strictest per-IP rate limit of the anonymous tools.",
"inputSchema": {
"$schema": "http://json-schema.org/draft-07/schema#",
"properties": {
"ip": {
"description": "Public IPv4 or IPv6 address",
"minLength": 1,
"type": "string"
}
},
"required": [
"ip"
],
"type": "object"
},
"name": "dnsbl_check"
},
{
"description": "Reports a domain's registration expiry from WHOIS with the remaining days, plus registrar, creation and update dates and the EPP status codes that reveal redemption or pending delete. Covers the registration, not the TLS certificate (check_ssl). tldSupported=false means the TLD has no queryable WHOIS server, not that the domain is unregistered. Anonymous, rate-limited per IP.",
"inputSchema": {
"$schema": "http://json-schema.org/draft-07/schema#",
"properties": {
"domain": {
"description": "Domain name, e.g. deinkunde.com",
"minLength": 1,
"type": "string"
}
},
"required": [
"domain"
],
"type": "object"
},
"name": "domain_expiry"
},
{
"description": "Checks a domain's HTTP Strict Transport Security setup: header presence and raw value, max-age, includeSubDomains and preload flags, whether plain HTTP redirects to HTTPS, preload-list eligibility, and warnings for ineffective values. Reports the advertised policy only; the certificate is check_ssl and the redirect chain redirect_check. Anonymous, rate-limited per IP; private and reserved addresses are refused.",
"inputSchema": {
"$schema": "http://json-schema.org/draft-07/schema#",
"properties": {
"domain": {
"description": "Domain name, e.g. deinkunde.com",
"minLength": 1,
"type": "string"
}
},
"required": [
"domain"
],
"type": "object"
},
"name": "hsts_check"
},
{
"description": "Fetches a URL and returns its HTTP response headers verbatim as a name/value map, with the status line and every redirect hop. The response body is never returned. website_status gives a plain up/down verdict and redirect_check the redirect chain alone. Anonymous, rate-limited per IP; private and reserved addresses are refused.",
"inputSchema": {
"$schema": "http://json-schema.org/draft-07/schema#",
"properties": {
"url": {
"description": "Full URL, e.g. https://deinkunde.com",
"minLength": 1,
"type": "string"
}
},
"required": [
"url"
],
"type": "object"
},
"name": "http_headers"
},
{
"description": "Locates a public IP address, or a domain resolved to one, at network level: country code, registry, announced prefix, PTR hostname and autonomous systems. Registry-based, so it names the network operator's country, which for hosted or CDN addresses differs from where a visitor or business is located; it is not a street address. Private and reserved addresses have no answer. Anonymous, rate-limited per IP.",
"inputSchema": {
"$schema": "http://json-schema.org/draft-07/schema#",
"properties": {
"query": {
"description": "Public IP address or domain name",
"minLength": 1,
"type": "string"
}
},
"required": [
"query"
],
"type": "object"
},
"name": "ip_geolocation"
},
{
"description": "Looks up a domain's MX records and resolves each mail exchanger to its IPv4 and IPv6 addresses, ordered by priority, flagging hosts that resolve into private address space. Shows where mail is delivered; it does not connect to the servers or test SMTP, and sender authorisation is covered by spf_check, dkim_check and dmarc_check. Anonymous, rate-limited per IP.",
"inputSchema": {
"$schema": "http://json-schema.org/draft-07/schema#",
"properties": {
"domain": {
"description": "Domain name, e.g. deinkunde.com",
"minLength": 1,
"type": "string"
}
},
"required": [
"domain"
],
"type": "object"
},
"name": "mx_lookup"
},
{
"description": "Measures reachability and round-trip time with repeated TCP connections to a host port (default 443), returning every attempt, sent and received counts, packet loss and min/avg/max milliseconds. A TCP handshake, not an ICMP echo, so hosts that drop ICMP still answer. website_status gives a one-shot verdict for a website. Anonymous, rate-limited per IP; private and reserved addresses are refused.",
"inputSchema": {
"$schema": "http://json-schema.org/draft-07/schema#",
"properties": {
"host": {
"description": "Domain name or host",
"minLength": 1,
"type": "string"
},
"port": {
"description": "Port, default 443",
"maximum": 65535,
"minimum": 1,
"type": "integer"
}
},
"required": [
"host"
],
"type": "object"
},
"name": "ping_test"
},
{
"description": "Opens TCP connections to one port or a list of up to 10 ports on a host and reports each as open, closed or filtered, with the time taken. partial=true means not every port answered within the time budget; filtered means no answer arrived, not that the port is certainly closed. TCP only, no UDP. Anonymous, rate-limited per IP; hosts resolving to private or reserved addresses are refused.",
"inputSchema": {
"$schema": "http://json-schema.org/draft-07/schema#",
"properties": {
"host": {
"description": "Domain name or host",
"minLength": 1,
"type": "string"
},
"port": {
"anyOf": [
{
"maximum": 65535,
"minimum": 1,
"type": "integer"
},
{
"items": {
"maximum": 65535,
"minimum": 1,
"type": "integer"
},
"maxItems": 10,
"minItems": 1,
"type": "array"
}
],
"description": "TCP port, or a list of up to 10 ports, e.g. 443 or [80, 443, 25]"
}
},
"required": [
"host",
"port"
],
"type": "object"
},
"name": "port_check"
},
{
"description": "Follows a URL's redirect chain hop by hop and returns each step's status, source and target, the final URL and status, the hop count, and warnings for loops, HTTPS-to-HTTP downgrades and overly long chains. Body and headers of the destination are not returned (http_headers covers headers). Anonymous, rate-limited per IP; private and reserved addresses are refused.",
"inputSchema": {
"$schema": "http://json-schema.org/draft-07/schema#",
"properties": {
"url": {
"description": "Full URL, e.g. https://deinkunde.com",
"minLength": 1,
"type": "string"
}
},
"required": [
"url"
],
"type": "object"
},
"name": "redirect_check"
},
{
"description": "Measures how fast a URL answers over several samples, returning each sample plus min, average and max milliseconds, the HTTP status and an `up` flag. partial=true means fewer samples returned than requested. Measures the HTTP response only: no browser runs, so JavaScript, assets and Core Web Vitals are not reflected. A snapshot, not a trend. Anonymous, rate-limited per IP; private and reserved addresses are refused.",
"inputSchema": {
"$schema": "http://json-schema.org/draft-07/schema#",
"properties": {
"url": {
"description": "Full URL, e.g. https://deinkunde.com",
"minLength": 1,
"type": "string"
}
},
"required": [
"url"
],
"type": "object"
},
"name": "response_time"
},
{
"description": "Resolves a public IP address to the PTR hostnames published for it, or returns the resolver's error where there is none. A PTR is set by whoever controls the address block, so it names the host rather than necessarily the site; a missing PTR is common and not a fault. Forward and reverse records need not agree, and this call does not check that they do. Anonymous, rate-limited per IP.",
"inputSchema": {
"$schema": "http://json-schema.org/draft-07/schema#",
"properties": {
"ip": {
"description": "Public IPv4 or IPv6 address",
"minLength": 1,
"type": "string"
}
},
"required": [
"ip"
],
"type": "object"
},
"name": "reverse_dns"
},
{
"description": "Fetches a domain's SPF record and evaluates it: raw record, parsed terms with qualifiers, DNS lookups counted against the RFC 7208 limit of ten, the final `all` qualifier, and warnings for common silent failures. A domain without a record returns found=false. Alignment and reporting belong to dmarc_check, signing keys to dkim_check. Anonymous, rate-limited per IP.",
"inputSchema": {
"$schema": "http://json-schema.org/draft-07/schema#",
"properties": {
"domain": {
"description": "Domain name, e.g. deinkunde.com",
"minLength": 1,
"type": "string"
}
},
"required": [
"domain"
],
"type": "object"
},
"name": "spf_check"
},
{
"description": "Checks whether a website is up right now: up/down verdict, HTTP status and text, response time, server header and number of redirects followed. The usual first call for any is-the-site-down question. A single sample from one location, not uptime; response_time, http_headers and redirect_check go deeper. Anonymous, rate-limited per IP; private and reserved addresses are refused.",
"inputSchema": {
"$schema": "http://json-schema.org/draft-07/schema#",
"properties": {
"url": {
"description": "Full URL, e.g. https://deinkunde.com",
"minLength": 1,
"type": "string"
}
},
"required": [
"url"
],
"type": "object"
},
"name": "website_status"
},
{
"description": "Retrieves WHOIS registration data for a domain: registrar, creation, update and expiry dates, EPP status codes, nameservers and the contact roles the registry still publishes (personal data is usually redacted). tldSupported=false means the TLD has no queryable WHOIS server, which differs from an unregistered domain (found=false). domain_expiry returns the expiry with the remaining days computed. Anonymous, rate-limited per IP.",
"inputSchema": {
"$schema": "http://json-schema.org/draft-07/schema#",
"properties": {
"domain": {
"description": "Domain name, e.g. deinkunde.com",
"minLength": 1,
"type": "string"
}
},
"required": [
"domain"
],
"type": "object"
},
"name": "whois"
}
]
}What the leaf hashes
{"body":"d42ff0b189314182c4a584aaa1651709edb147b5e0cf7692150684aee55cbbaa","id":300058,"kind":"mcp.tools","method":"probe.mcp/1","observed_us":1793053238479834,"prev":null,"subject":"d3a36417-5101-49ed-a783-0f6f42181608","subject_kind":"endpoint"}Proof
Fold these into the leaf in order, hashing each sorted pair with keccak256, to reach the root of (296695 rows).
- 0x5a10f82a9ce411e65162d52c53fdd7f8f1aff4d116770764dfa8c38255642eaf
- 0x88d73dd3b61056518665422283ffd5d032b6208d9718a1b0851f92cc323384dd
- 0x5cca59a848daad9668119f6ea6c6d95f3c0a252eeafec6deb14657f28622c43d
- 0x0fe28adb3ac46f6cb9da32fe0d0627cdfba94571c0d0700f7bb8344e24f1c812
- 0xcaa8aae9c65be9fab154b8e6be9c323809944421ae13795fbb3be1d04e03847f
- 0xcd08d8d450fb1b1392d95a199f7acfe6aaa956ed6b68a72c46fa4be93a350461
- 0xba28bcebb06e699218d533c37bc7b2b61b7d8409854ccaf3b9e911673434ac3e
- 0xcde53b14269f292724b9609d8162a30d1b9bc973f3ec5f2b75ba623018219f9b
- 0xc0c9db97007ad6d8e26affb0420b1d87fee8386d84a59abce718b49eacad9fe6
- 0xf1eeb4a8c5c16de179c12264e7953f094a84068b4ebc7f1cae7834073c43b439
- 0x3ada80dcde3daf850269166ea2ab667084c23fe8ab3b3994664b930470ebdef7
- 0xf522fa92d4115c2b18b96aa43119f8df9b4e96c92f5d6449d0fe96dcd4bf324c
- 0xc8abb13c711b67d9f1ef145286ed450a0f5566f054a4b290ea3d711873bcbe20
- 0x5cdeb4648502e0633d01cc4f3379d48cccb9d4f528565b2868eb93db0df9e829
- 0x7726154b91b2ad65b13849ef6cb6443b1f0ff113a3089c9bd5f2bcfc16be099d
- 0x47b89901b0f07938a6b9a66ddf35683903f79d756a7c7763665fd632758b08d0
- 0x9a83be955a206deb65b995adfd92c58fa31c95fbbf926bd199d300e70b08b26d
- 0x20704208aa6923d6b2450ef74ede87a6e0265d46447926038fe9506e9e154b2d
- 0x9b9ce5b74b9bab5121612ef6b64920a8d453cbf311096a423eef9702747e868a
- Day root
- 0xf43e8dcc3d451a4788b26be904c55e8c4c0fa75c9666796c51db38d37e2c0df8
- Chained
- 0x702d5ac508f08b0d1accf36af25822d8e5660367494edd17a642fb61e158a57a
- Published
- On Arc Testnet, block 69251483: 0x495162f8936e19f0039918feebe6c307f327cd6bf8c37219620b1970041fa9ae