Evidence row 524577

What was observed

{
  "endpoints": [
    [
      "web",
      "https://github.com/mguttmann/the-real-bitwarden-mcp"
    ]
  ],
  "name": "Bitwarden Public API and Secrets Manager (unofficial)",
  "owner_address": null,
  "raw": {
    "_meta": {
      "io.modelcontextprotocol.registry/official": {
        "isLatest": true,
        "publishedAt": "2026-10-27T17:36:33.400219Z",
        "status": "active",
        "statusChangedAt": "2026-10-27T17:36:33.400219Z",
        "updatedAt": "2026-10-27T17:36:33.400219Z"
      }
    },
    "server": {
      "$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json",
      "description": "Unofficial MCP server for the Bitwarden Public API and Secrets Manager, self-hosted or cloud.",
      "name": "io.github.mguttmann/the-real-bitwarden-mcp",
      "packages": [
        {
          "environmentVariables": [
            {
              "description": "Self-hosted instance: API base URL, e.g. https://vault.example.com/api. Configure all four BITWARDEN_SELFHOST_* or all four BITWARDEN_CLOUD_* variables (or both); a partial set is fatal.",
              "format": "string",
              "name": "BITWARDEN_SELFHOST_API_BASE"
            },
            {
              "description": "Self-hosted instance: identity URL, e.g. https://vault.example.com/identity.",
              "format": "string",
              "name": "BITWARDEN_SELFHOST_IDENTITY_URL"
            },
            {
              "description": "Self-hosted instance: organization Public API client id (organization.<uuid>).",
              "format": "string",
              "name": "BITWARDEN_SELFHOST_CLIENT_ID"
            },
            {
              "description": "Self-hosted instance: organization Public API client secret. It can manage members, groups, collections and policies, including creating Owners.",
              "format": "string",
              "isSecret": true,
              "name": "BITWARDEN_SELFHOST_CLIENT_SECRET"
            },
            {
              "description": "Bitwarden Cloud: API base URL, e.g. https://api.bitwarden.com. Used for license and subscription tools.",
              "format": "string",
              "name": "BITWARDEN_CLOUD_API_BASE"
            },
            {
              "description": "Bitwarden Cloud: identity URL, e.g. https://identity.bitwarden.com.",
              "format": "string",
              "name": "BITWARDEN_CLOUD_IDENTITY_URL"
            },
            {
              "description": "Bitwarden Cloud: organization Public API client id (organization.<uuid>).",
              "format": "string",
              "name": "BITWARDEN_CLOUD_CLIENT_ID"
            },
            {
              "description": "Bitwarden Cloud: organization Public API client secret.",
              "format": "string",
              "isSecret": true,
              "name": "BITWARDEN_CLOUD_CLIENT_SECRET"
            },
            {
              "description": "Optional: Secrets Manager machine account access token; enables the bws_* tools. A malformed token is fatal at startup.",
              "format": "string",
              "isSecret": true,
              "name": "BWS_ACCESS_TOKEN"
            },
            {
              "description": "Optional: organization UUID for the Secrets Manager tools, used when a call passes no organizationId.",
              "format": "string",
              "name": "BWS_ORG_ID"
            },
            {
              "description": "Optional: Secrets Manager API base URL; defaults to BITWARDEN_SELFHOST_API_BASE.",
              "format": "string",
              "name": "BWS_API_BASE"
            },
            {
              "description": "Optional: Secrets Manager identity URL; defaults to BITWARDEN_SELFHOST_IDENTITY_URL.",
              "format": "string",
              "name": "BWS_IDENTITY_URL"
            },
            {
              "default": "true",
              "description": "true: write tools return a preview unless the call carries confirm \"YES\". The model sets confirm itself, so this is friction, not a security boundary.",
              "format": "boolean",
              "name": "BITWARDEN_CONFIRM_WRITES"
            },
            {
              "default": "false",
              "description": "true: write tools stay listed but refuse to run, and bw_raw_request allows GET only.",
              "format": "boolean",
              "name": "BITWARDEN_READ_ONLY"
            },
            {
              "choices": [
                "debug",
                "info",
                "warn",
                "error"
              ],
              "default": "warn",
              "description": "Log level of the JSON log lines on stderr.",
              "format": "string",
              "name": "LOG_LEVEL"
            },
            {
              "default": "1048576",
              "description": "Successful tool output above this many bytes is cut to valid JSON with a responseTruncated marker that says how to narrow or page the query.",
              "format": "number",
              "name": "BW_MCP_MAX_RESPONSE_BYTES"
            }
          ],
          "identifier": "the-real-bitwarden-mcp",
          "registryType": "npm",
          "runtimeHint": "npx",
          "transport": {
            "type": "stdio"
          },
          "version": "0.3.0"
        }
      ],
      "repository": {
        "source": "github",
        "url": "https://github.com/mguttmann/the-real-bitwarden-mcp"
      },
      "title": "Bitwarden Public API and Secrets Manager (unofficial)",
      "version": "0.3.0",
      "websiteUrl": "https://github.com/mguttmann/the-real-bitwarden-mcp#readme"
    }
  },
  "source": "mcp_registry",
  "summary": "Unofficial MCP server for the Bitwarden Public API and Secrets Manager, self-hosted or cloud."
}

What the leaf hashes

{"body":"7cbeb7220f1ec8b1b93aba25aa0ae049f0d2ced502d37a2325449b51db7b46c7","id":524577,"kind":"listing","method":"sync.mcp_registry/1","observed_us":1793124738867018,"prev":519452,"subject":"mcp_registry:io.github.mguttmann/the-real-bitwarden-mcp","subject_kind":"source_record"}

Proof

Fold these into the leaf in order, hashing each sorted pair with keccak256, to reach the root of 2026-10-27 (273461 rows).

1. 0x14b8cc8e517db484d5e85abb8ed5286e893d22d6a79ed59eaf8059d88f57b73d
2. 0x75af525e929be4e97441bd1d3e506f7c1beb13d5c8b8e639a6a5851b21984d09
3. 0x2c05ccc2c7275ee3382b4f6884a03fa75476f9287a5a0420724362c219134935
4. 0x2e0ff2e7c7ef9665f0df9374267afbc71390bef50e2a5dc08d3b7f6e19dc7639
5. 0x5f4df24e830cf08d22875199840a5df1d4363dcfbb288b4d585edc654dda6c19
6. 0x1fb77f1058f36df54f83e283d33d00c29ccaa22dc8daab51c3c470d369881b10
7. 0x6a7ca9184cb054b5cee350b5d2e9dff206bfcc6ca96abcef71ada538ce8520a8
8. 0xa2d90976acd68d3bfb3c417794b983ede4f1ae4e6de75d0df620be663583b1b2
9. 0x6022b001c78a1c9aced010a6942deac8c671a4f1e13ab1e77777b25f6b05d3c4
10. 0x964aab94b95758e275e8cb8d8cbaa9631adcef1ffde837b108b6ed76473e0eec
11. 0x9e947eb3c86df14ac44eada3cf18f3014afb9e8b087fe1322e63ef26dea3d049
12. 0x7cac66284a22c84861ef245248a5242a95b1ad6d2755b690ffdf86f14742a9be
13. 0xfae7ed2d06f4d6ced86c104b6381c26d795f82be10e6314b53b0524bd75a292f
14. 0x52c5141da0cbee106a30396ee7d1360fd22f55084aca2ca436c8007892775670
15. 0x6913cb48392acb8dc5c940dcdb6e6fc889d544f85dff11da249551a5f027e688
16. 0x518b93854db03dc9fc938883abf30da6eaae5ae0d4336903968fd32a7df8c71b
17. 0x22c1fb9487ee0b9732fa017a0cc321eb27a60c08450d112f755089796e12cb1c
18. 0xa20d48798a34aba12eb9c7297722982d910f06c148f5e27ac59307422964a585
19. 0x9fc354c0ea3efc3f1b6548bb77ea902a50f2c9647647ea61592efce2bd795699

Day root

0xdd77e5e99da32c3f154180d63e3c3e6fe11e896a2c6896412ef6b5c4bcf7e795

Chained

0x23bb4dfd09f55c15ac3962f53578e02c6114d5bfd9bb451cf8794fb6e2817ef4

Published

On Arc Testnet, block 69414147: 0xb2ebd83aafeb765a0ce66e76aefb133ed06606c98038fd56191e2bcd1dcb77b4