Evidence row 535633

What was observed

{
  "endpoints": [
    [
      "web",
      "https://github.com/mguttmann/the-real-bitwarden-mcp"
    ]
  ],
  "name": "Bitwarden Public API and Secrets Manager (unofficial)",
  "owner_address": null,
  "raw": {
    "_meta": {
      "io.modelcontextprotocol.registry/official": {
        "isLatest": true,
        "publishedAt": "2026-10-27T18:54:50.022712Z",
        "status": "active",
        "statusChangedAt": "2026-10-27T18:54:50.022712Z",
        "updatedAt": "2026-10-27T18:54:50.022712Z"
      }
    },
    "server": {
      "$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json",
      "description": "Unofficial MCP server for the Bitwarden Public API and Secrets Manager, self-hosted or cloud.",
      "name": "io.github.mguttmann/the-real-bitwarden-mcp",
      "packages": [
        {
          "environmentVariables": [
            {
              "description": "Self-hosted instance: API base URL, e.g. https://vault.example.com/api. Configure all four BITWARDEN_SELFHOST_* or all four BITWARDEN_CLOUD_* variables (or both); a partial set is fatal.",
              "format": "string",
              "name": "BITWARDEN_SELFHOST_API_BASE"
            },
            {
              "description": "Self-hosted instance: identity URL, e.g. https://vault.example.com/identity.",
              "format": "string",
              "name": "BITWARDEN_SELFHOST_IDENTITY_URL"
            },
            {
              "description": "Self-hosted instance: organization Public API client id (organization.<uuid>).",
              "format": "string",
              "name": "BITWARDEN_SELFHOST_CLIENT_ID"
            },
            {
              "description": "Self-hosted instance: organization Public API client secret. It can manage members, groups, collections and policies, including creating Owners.",
              "format": "string",
              "isSecret": true,
              "name": "BITWARDEN_SELFHOST_CLIENT_SECRET"
            },
            {
              "description": "Bitwarden Cloud: API base URL, e.g. https://api.bitwarden.com. Used for license and subscription tools.",
              "format": "string",
              "name": "BITWARDEN_CLOUD_API_BASE"
            },
            {
              "description": "Bitwarden Cloud: identity URL, e.g. https://identity.bitwarden.com.",
              "format": "string",
              "name": "BITWARDEN_CLOUD_IDENTITY_URL"
            },
            {
              "description": "Bitwarden Cloud: organization Public API client id (organization.<uuid>).",
              "format": "string",
              "name": "BITWARDEN_CLOUD_CLIENT_ID"
            },
            {
              "description": "Bitwarden Cloud: organization Public API client secret.",
              "format": "string",
              "isSecret": true,
              "name": "BITWARDEN_CLOUD_CLIENT_SECRET"
            },
            {
              "description": "Optional: Secrets Manager machine account access token; enables the bws_* tools. A malformed token is fatal at startup.",
              "format": "string",
              "isSecret": true,
              "name": "BWS_ACCESS_TOKEN"
            },
            {
              "description": "Optional: organization UUID for the Secrets Manager tools, used when a call passes no organizationId.",
              "format": "string",
              "name": "BWS_ORG_ID"
            },
            {
              "description": "Optional: Secrets Manager API base URL; defaults to BITWARDEN_SELFHOST_API_BASE.",
              "format": "string",
              "name": "BWS_API_BASE"
            },
            {
              "description": "Optional: Secrets Manager identity URL; defaults to BITWARDEN_SELFHOST_IDENTITY_URL.",
              "format": "string",
              "name": "BWS_IDENTITY_URL"
            },
            {
              "default": "true",
              "description": "true: write tools return a preview unless the call carries confirm \"YES\". The model sets confirm itself, so this is friction, not a security boundary.",
              "format": "boolean",
              "name": "BITWARDEN_CONFIRM_WRITES"
            },
            {
              "default": "false",
              "description": "true: write tools stay listed but refuse to run, and bw_raw_request allows GET only.",
              "format": "boolean",
              "name": "BITWARDEN_READ_ONLY"
            },
            {
              "choices": [
                "debug",
                "info",
                "warn",
                "error"
              ],
              "default": "warn",
              "description": "Log level of the JSON log lines on stderr.",
              "format": "string",
              "name": "LOG_LEVEL"
            },
            {
              "default": "1048576",
              "description": "Successful tool output above this many bytes is cut to valid JSON with a responseTruncated marker that says how to narrow or page the query.",
              "format": "number",
              "name": "BW_MCP_MAX_RESPONSE_BYTES"
            }
          ],
          "identifier": "the-real-bitwarden-mcp",
          "registryType": "npm",
          "runtimeHint": "npx",
          "transport": {
            "type": "stdio"
          },
          "version": "0.3.1"
        }
      ],
      "repository": {
        "source": "github",
        "url": "https://github.com/mguttmann/the-real-bitwarden-mcp"
      },
      "title": "Bitwarden Public API and Secrets Manager (unofficial)",
      "version": "0.3.1",
      "websiteUrl": "https://github.com/mguttmann/the-real-bitwarden-mcp#readme"
    }
  },
  "source": "mcp_registry",
  "summary": "Unofficial MCP server for the Bitwarden Public API and Secrets Manager, self-hosted or cloud."
}

What the leaf hashes

{"body":"facee09dee229e59632596f7ba6297fd285284effadb375801ce45a928dafbc2","id":535633,"kind":"listing","method":"sync.mcp_registry/1","observed_us":1793128343415347,"prev":524577,"subject":"mcp_registry:io.github.mguttmann/the-real-bitwarden-mcp","subject_kind":"source_record"}

Proof

Fold these into the leaf in order, hashing each sorted pair with keccak256, to reach the root of 2026-10-27 (273461 rows).

1. 0xd50db1cb3f003ae8ba4eb52ca4a3188fc2886c20b43c453ac65420e7f785f283
2. 0x6cd584536e9bd5903045eac7cbe4ded7712735a448e545e518046f6eb9e6cf01
3. 0x92a80f84a97b363c198c45756613f21cc77aa0ebb0042ef59b6ee6f91371e67e
4. 0xdcea73f91ab4633d11128cc9408960d6f8b630d01af9bab809c8a281bbdab70f
5. 0x1244f42b675efaa98da64adb0c9e7176b0482d4b32f5ae8b2d8d8cd1956ea8f4
6. 0x377776415b6f5e736837e785007fea3550c867ca9e1178555b578a0771c14b14
7. 0xd98eb8f729d1acdee4613a026f1e761b0d107cc34ec734451811e5ce02acfc5d
8. 0x052910899ad28b9ebc922f01a3dd3716a8a57af58b4cdbd6965ca23667fcabbe
9. 0xacf732d84afb73571cba88fc662f50c3cfca0cbeb1756f13c4a5639a3ddfe1a0
10. 0x91caaff748d69a163fc7f2f65c6956cecc662c244f2d6a7c7af980f8188cfacf
11. 0x74b55c296ed1e29baefa7f1b742395fc4d032c5815abd196435abb5c0045e88a
12. 0xde4e8f5f4fa654e4fdaf9393a62fe8d551a621b11ce6193db126f9c7825b0974
13. 0x3b3e4fecead12aaf883ab4f21b6e21efddd0a8d055ced058cb62bcdca8a6c9d6
14. 0x8f676edfb4faaa290229d8f4f69ab721fc627424463d62f5146b3d1ca7f2f0c6
15. 0x969cd44e5a4e8dc3110540398fbf689659eb51df735c1cda5d8f021ef9ff5683
16. 0xa94627de1af0e823832e05a9069b304ecccb8c0cdb8f9cfc4f2039bfb9799dc5
17. 0xdf1105afdc109de3c09a98fc8a3864159ad964e6f49b635c105a27a1e1f14310
18. 0x2bf8151e5f157dd183b9de6fa00469551932a7a6e3f33a694895000ac9061197
19. 0x9fc354c0ea3efc3f1b6548bb77ea902a50f2c9647647ea61592efce2bd795699

Day root

0xdd77e5e99da32c3f154180d63e3c3e6fe11e896a2c6896412ef6b5c4bcf7e795

Chained

0x23bb4dfd09f55c15ac3962f53578e02c6114d5bfd9bb451cf8794fb6e2817ef4

Published

On Arc Testnet, block 69414147: 0xb2ebd83aafeb765a0ce66e76aefb133ed06606c98038fd56191e2bcd1dcb77b4