← The evidence ledger
Evidence row 300162
Observed , by probe.mcp/1.
- Kind
- mcp.tools
- About
- endpoint b9c42303-b597-4113-a60a-b4ca25cd2dce
- Recorded
- Previous row
- None: the first of its kind about this subject
- Body SHA-256
- fb106ba9e91df0c91ad802abba1dd0d1770b180ebc4780963c722087460d4fd7
- Leaf
- 0xbf8ddaa607eec9f8026319de4097b7f9ec7b23b63ad97ee3e8b914f66b316d11
What was observed
{
"count": 14,
"tools": [
{
"description": "Archive a list entry so it stops matching. Reversible with castle_unarchive_list_item. Castle: DELETE /v1/lists/{list_id}/items/{id}/archive.",
"inputSchema": {
"$schema": "https://json-schema.org/draft/2020-12/schema",
"properties": {
"item_id": {
"description": "The item to archive.",
"type": "string"
},
"list_id": {
"description": "The list holding the item.",
"type": "string"
}
},
"required": [
"list_id",
"item_id"
],
"type": "object"
},
"name": "castle_archive_list_item"
},
{
"description": "Count the entries in one list, with the same optional filters as the search. Read-only despite being a POST. Castle: POST /v1/lists/{list_id}/items/count.",
"inputSchema": {
"$schema": "https://json-schema.org/draft/2020-12/schema",
"properties": {
"filters": {
"description": "Optional {field, op, value} filters over the items.",
"items": {
"additionalProperties": {},
"propertyNames": {
"type": "string"
},
"type": "object"
},
"type": "array"
},
"list_id": {
"description": "The list to count.",
"type": "string"
}
},
"required": [
"list_id"
],
"type": "object"
},
"name": "castle_count_list_items"
},
{
"description": "Create a new allow or deny list. primary_field is the event field its entries match on, e.g. ip or user.email. Castle: POST /v1/lists.",
"inputSchema": {
"$schema": "https://json-schema.org/draft/2020-12/schema",
"properties": {
"color": {
"description": "Dashboard colour label, e.g. $red, $green, $blue — Castle requires one.",
"type": "string"
},
"description": {
"description": "What this list is for.",
"type": "string"
},
"name": {
"description": "The list name.",
"type": "string"
},
"primary_field": {
"description": "The event field entries match on, e.g. ip or user.email.",
"type": "string"
},
"secondary_field": {
"description": "An optional second field entries also carry.",
"type": "string"
}
},
"required": [
"name",
"color",
"primary_field"
],
"type": "object"
},
"name": "castle_create_list"
},
{
"description": "Add an entry to a list — for example block an IP or an email. This changes live policy behaviour. Castle: POST /v1/lists/{list_id}/items.",
"inputSchema": {
"$schema": "https://json-schema.org/draft/2020-12/schema",
"properties": {
"author_identifier": {
"description": "Who is adding it, e.g. the analyst's email address.",
"type": "string"
},
"author_type": {
"description": "What kind of actor is adding this entry.",
"enum": [
"$analyst_email",
"$castle_dashboard_user",
"$castle_policy",
"$user",
"$user_email",
"$other"
],
"type": "string"
},
"auto_archives_at": {
"description": "ISO-8601 time to archive the entry automatically.",
"type": "string"
},
"comment": {
"description": "Why this entry was added.",
"type": "string"
},
"list_id": {
"description": "The list to add to.",
"type": "string"
},
"primary_value": {
"description": "The value to add, matching the list's primary_field.",
"type": "string"
},
"secondary_value": {
"description": "Value for the list's secondary_field.",
"type": "string"
}
},
"required": [
"list_id",
"primary_value",
"author_type",
"author_identifier"
],
"type": "object"
},
"name": "castle_create_list_item"
},
{
"description": "List the event fields you can filter and group on, with their types. Read this first — the other query tools need real field names. Castle: GET /v1/events/schema.",
"inputSchema": {
"$schema": "https://json-schema.org/draft/2020-12/schema",
"properties": {},
"type": "object"
},
"name": "castle_get_events_schema"
},
{
"description": "Fetch a single list with its primary and secondary field definitions. Castle: GET /v1/lists/{id}.",
"inputSchema": {
"$schema": "https://json-schema.org/draft/2020-12/schema",
"properties": {
"list_id": {
"description": "The list's id.",
"type": "string"
}
},
"required": [
"list_id"
],
"type": "object"
},
"name": "castle_get_list"
},
{
"description": "Fetch a single list entry — its value, who added it, the comment and its archive time. Castle: GET /v1/lists/{list_id}/items/{id}.",
"inputSchema": {
"$schema": "https://json-schema.org/draft/2020-12/schema",
"properties": {
"item_id": {
"description": "The item's id.",
"type": "string"
},
"list_id": {
"description": "The list holding the item.",
"type": "string"
}
},
"required": [
"list_id",
"item_id"
],
"type": "object"
},
"name": "castle_get_list_item"
},
{
"description": "Aggregate matching events by one or more fields — the fast way to see which IPs, devices or countries dominate a spike. Read-only despite being a POST. Castle: POST /v1/events/group.",
"inputSchema": {
"$schema": "https://json-schema.org/draft/2020-12/schema",
"properties": {
"filters": {
"description": "Castle query filters, ANDed together. Each is {field, op, value} — e.g. {\"field\":\"user.email\",\"op\":\"$eq\",\"value\":\"a@example.com\"}. Operators: $eq, $neq, $in, $nin, $like, $nlike, $contains, $ncontains, $starts_with, $nstarts_with, $ends_with, $nends_with, $matches, $nmatches, $ip_range, $nip_range, $relative_range (value {gt,gteq,lt,lteq} in seconds ago), $range, $exists. Call castle_get_events_schema first to see the available field names.",
"items": {
"additionalProperties": {},
"propertyNames": {
"type": "string"
},
"type": "object"
},
"type": "array"
},
"group_by_fields": {
"description": "Fields to group by, e.g. [\"ip\", \"user.email\"]. Names come from the event schema.",
"items": {
"type": "string"
},
"type": "array"
},
"page": {
"description": "1-based page number.",
"maximum": 9007199254740991,
"minimum": 1,
"type": "integer"
},
"results_size": {
"description": "Results per page, 1-100.",
"maximum": 100,
"minimum": 1,
"type": "integer"
}
},
"required": [
"filters",
"group_by_fields"
],
"type": "object"
},
"name": "castle_group_events"
},
{
"description": "Query the security event stream — logins, registrations, transactions and their risk verdicts. Read-only despite being a POST: Castle takes the query in the body. Castle: POST /v1/events/query.",
"inputSchema": {
"$schema": "https://json-schema.org/draft/2020-12/schema",
"properties": {
"columns": {
"description": "Only return these event fields.",
"items": {
"type": "string"
},
"type": "array"
},
"filters": {
"description": "Castle query filters, ANDed together. Each is {field, op, value} — e.g. {\"field\":\"user.email\",\"op\":\"$eq\",\"value\":\"a@example.com\"}. Operators: $eq, $neq, $in, $nin, $like, $nlike, $contains, $ncontains, $starts_with, $nstarts_with, $ends_with, $nends_with, $matches, $nmatches, $ip_range, $nip_range, $relative_range (value {gt,gteq,lt,lteq} in seconds ago), $range, $exists. Call castle_get_events_schema first to see the available field names.",
"items": {
"additionalProperties": {},
"propertyNames": {
"type": "string"
},
"type": "object"
},
"type": "array"
},
"page": {
"description": "1-based page number.",
"maximum": 9007199254740991,
"minimum": 1,
"type": "integer"
},
"query_type": {
"description": "Return matching records, just a count, or both. Defaults to records.",
"enum": [
"$records",
"$count",
"$records_with_count"
],
"type": "string"
},
"results_size": {
"description": "Results per page, 1-100.",
"maximum": 100,
"minimum": 1,
"type": "integer"
}
},
"required": [
"filters"
],
"type": "object"
},
"name": "castle_search_events"
},
{
"description": "Search the entries of one list — the blocked IPs, emails or device ids it holds. Read-only despite being a POST. Castle: POST /v1/lists/{list_id}/items/query.",
"inputSchema": {
"$schema": "https://json-schema.org/draft/2020-12/schema",
"properties": {
"filters": {
"description": "Optional {field, op, value} filters over the items.",
"items": {
"additionalProperties": {},
"propertyNames": {
"type": "string"
},
"type": "object"
},
"type": "array"
},
"list_id": {
"description": "The list to search.",
"type": "string"
},
"page": {
"description": "1-based page number.",
"maximum": 9007199254740991,
"minimum": 1,
"type": "integer"
},
"results_size": {
"description": "Results per page, 1-100.",
"maximum": 100,
"minimum": 1,
"type": "integer"
}
},
"required": [
"list_id"
],
"type": "object"
},
"name": "castle_search_list_items"
},
{
"description": "Find the allow/deny lists defined in the environment. Read-only despite being a POST. Castle: POST /v1/lists/query.",
"inputSchema": {
"$schema": "https://json-schema.org/draft/2020-12/schema",
"properties": {
"filters": {
"description": "Optional {field, op, value} filters over the lists themselves.",
"items": {
"additionalProperties": {},
"propertyNames": {
"type": "string"
},
"type": "object"
},
"type": "array"
},
"page": {
"description": "1-based page number.",
"maximum": 9007199254740991,
"minimum": 1,
"type": "integer"
},
"results_size": {
"description": "Results per page, 1-100.",
"maximum": 100,
"minimum": 1,
"type": "integer"
}
},
"type": "object"
},
"name": "castle_search_lists"
},
{
"description": "Restore a previously archived list entry so it matches again. Castle: PUT /v1/lists/{list_id}/items/{id}/unarchive.",
"inputSchema": {
"$schema": "https://json-schema.org/draft/2020-12/schema",
"properties": {
"item_id": {
"description": "The item to restore.",
"type": "string"
},
"list_id": {
"description": "The list holding the item.",
"type": "string"
}
},
"required": [
"list_id",
"item_id"
],
"type": "object"
},
"name": "castle_unarchive_list_item"
},
{
"description": "Rename a list or change its colour or description. Castle: PUT /v1/lists/{id}.",
"inputSchema": {
"$schema": "https://json-schema.org/draft/2020-12/schema",
"properties": {
"color": {
"description": "New colour label.",
"type": "string"
},
"description": {
"description": "New description.",
"type": "string"
},
"list_id": {
"description": "The list to update.",
"type": "string"
},
"name": {
"description": "New name.",
"type": "string"
}
},
"required": [
"list_id"
],
"type": "object"
},
"name": "castle_update_list"
},
{
"description": "Change the comment on a list entry. Castle: PUT /v1/lists/{list_id}/items/{id}.",
"inputSchema": {
"$schema": "https://json-schema.org/draft/2020-12/schema",
"properties": {
"comment": {
"description": "The new comment.",
"type": "string"
},
"item_id": {
"description": "The item to update.",
"type": "string"
},
"list_id": {
"description": "The list holding the item.",
"type": "string"
}
},
"required": [
"list_id",
"item_id",
"comment"
],
"type": "object"
},
"name": "castle_update_list_item"
}
]
}What the leaf hashes
{"body":"fb106ba9e91df0c91ad802abba1dd0d1770b180ebc4780963c722087460d4fd7","id":300162,"kind":"mcp.tools","method":"probe.mcp/1","observed_us":1793053303082354,"prev":null,"subject":"b9c42303-b597-4113-a60a-b4ca25cd2dce","subject_kind":"endpoint"}Proof
Fold these into the leaf in order, hashing each sorted pair with keccak256, to reach the root of (296695 rows).
- 0xbf8dbf423276b69555322129c1605b33c23c8038eae650d513b980f26924a70a
- 0xe752a7d2a90f11415ac41345403dd35327b0f0486aaae387cad4d132a1cc68ad
- 0x8fa2a4891468fe575b9847787a26118131c63e558a1d8ab8137352155e200673
- 0x2cfbfa1ea6724f8d34df42fd1c004e4ae018726fdc7119dfae7723c286bf13a7
- 0x27622a4af0b0c9b2932931aa8dbc1ddd4201aa76d3d67c92a694ccc0ab0c4a74
- 0xe2d6a886a4daf7f6c099fb4dff465bef9de2267cb3d4b0e0787b57478c73f8e5
- 0x1a3599463985dee4fa517d270fc900e54640f967fe4c8d616b25a85f5a4bd17d
- 0xa40caef605531919fff1a8fccf5f7453ee266234a3842eff0b8342aade4c73f2
- 0x2acb1759545dffd0f9d69f1505ae44a8b895f6571c40306d90c2f277ca0e6173
- 0x756a464688b460d8d275513c88e70a991307cf0931a5c4f982289e598f3c1b81
- 0x0decbdcd600e934c38d679c1b99f27ba6676644e856ed6ba36bca74feb432866
- 0xc520305226daa0caf1c2416854f726ec072c950c1903497b2a1e88b0c6f406da
- 0x96eae331a78c1c9248bc58130ff83d31b884760a51fe7191de2a39105ae7c072
- 0xdbe2e8dd65ea1248b2936612538f18268abd5cf27ebdab3737694571ad496004
- 0x9f68b5e15459cb62b8c0cd4c124fa61c74147b4a5755a200fbecd21a581635d1
- 0x123ec8bee20ddc55223eeef5a4f4d6c4b6416515adbb911c56759f5cde56e452
- 0xd0651cb9bc8155eb52b5247d506e74b8a935057dc190ba52091702ac25ed3a40
- 0x9a9024edb5069d88a324facb310a5ce8e495214bbaa968f077bede437390194f
- 0x9b9ce5b74b9bab5121612ef6b64920a8d453cbf311096a423eef9702747e868a
- Day root
- 0xf43e8dcc3d451a4788b26be904c55e8c4c0fa75c9666796c51db38d37e2c0df8
- Chained
- 0x702d5ac508f08b0d1accf36af25822d8e5660367494edd17a642fb61e158a57a
- Published
- On Arc Testnet, block 69251483: 0x495162f8936e19f0039918feebe6c307f327cd6bf8c37219620b1970041fa9ae