Evidence row 542669

What was observed

{
  "count": 13,
  "tools": [
    {
      "description": "Check up to 100 domains or IPv4 addresses at once against ThreatCluster's high-confidence 30-day IOC feed; each domain is resolved and its IPv4 matched too. IOC only (no ransomware-claim lookups; use threat_check for one domain). Stale feed returns an error and is not charged. Costs $0.50 USDC per call via x402 (payment goes in _meta[\"x402/payment\"]); invalid input or an upstream failure returns an error and is not charged.",
      "inputSchema": {
        "$schema": "https://json-schema.org/draft/2020-12/schema",
        "properties": {
          "items": {
            "description": "Up to 100 domains/IPv4, comma or newline separated",
            "maxLength": 20000,
            "minLength": 1,
            "type": "string"
          }
        },
        "required": [
          "items"
        ],
        "type": "object"
      },
      "name": "bulk_threat_check"
    },
    {
      "description": "Check the TLS certificate of one hostname: issuer, validity dates, days left, % of lifetime used, renewal cadence and a renewal-stall flag, plus a live HTTPS pass/fail probe. Use it when you only need certificate health; use site_health for cert + DNS + expiry together, or domain_grade for a scored A-F result. Certificate details come from public Certificate Transparency logs (Cert Spotter, crt.sh fallback), not from the live connection, so a brand-new cert may not show yet. Read-only; makes one HTTPS request to the host and one CT-log query, usually 1-5 s. Costs $0.01 USDC per call via x402 (payment goes in _meta[\"x402/payment\"]); invalid input or an upstream failure returns an error and is not charged.",
      "inputSchema": {
        "$schema": "https://json-schema.org/draft/2020-12/schema",
        "properties": {
          "domain": {
            "description": "Hostname or URL, e.g. example.com or https://www.example.com/path",
            "maxLength": 300,
            "minLength": 1,
            "type": "string"
          }
        },
        "required": [
          "domain"
        ],
        "type": "object"
      },
      "name": "check_cert"
    },
    {
      "description": "Look up the live DNS of a domain: NS, A/AAAA/CNAME, MX, SPF, DMARC, CAA (climbing to the parent zone) and DNSSEC status, with plain-English findings. Use it for a DNS inventory or to debug resolution; use check_email_auth for a deeper SPF/DMARC/DKIM/MTA-STS review. Queries Cloudflare DNS-over-HTTPS (1.1.1.1) at call time; read-only, nothing is stored. Costs $0.01 USDC per call via x402 (payment goes in _meta[\"x402/payment\"]); invalid input or an upstream failure returns an error and is not charged.",
      "inputSchema": {
        "$schema": "https://json-schema.org/draft/2020-12/schema",
        "properties": {
          "domain": {
            "description": "Hostname or URL, e.g. example.com or https://www.example.com/path",
            "maxLength": 300,
            "minLength": 1,
            "type": "string"
          }
        },
        "required": [
          "domain"
        ],
        "type": "object"
      },
      "name": "check_dns"
    },
    {
      "description": "Check when a domain registration expires: registrar, registered and expiry dates, days left, EPP status codes and nameservers, from the registry's RDAP server. Use it for renewal risk on the registered domain (not the certificate; use check_cert for that). Some TLDs publish no RDAP service, in which case found=false explains why. Read-only. Costs $0.01 USDC per call via x402 (payment goes in _meta[\"x402/payment\"]); invalid input or an upstream failure returns an error and is not charged.",
      "inputSchema": {
        "$schema": "https://json-schema.org/draft/2020-12/schema",
        "properties": {
          "domain": {
            "description": "Hostname or URL, e.g. example.com or https://www.example.com/path",
            "maxLength": 300,
            "minLength": 1,
            "type": "string"
          }
        },
        "required": [
          "domain"
        ],
        "type": "object"
      },
      "name": "check_domain_expiry"
    },
    {
      "description": "Review the email authentication setup of a domain: SPF validity and DNS-lookup count (limit 10), DMARC policy, pct and reporting, DKIM on common selector names, MTA-STS mode, TLS-RPT and BIMI, with a rough 0-100 score and plain-English fixes. Use it before sending mail from a domain or when mail lands in spam. DKIM is only checked on common selectors, so \"not found\" is not proof DKIM is missing. Live DNS via Cloudflare DoH; read-only, no email is sent. Costs $0.01 USDC per call via x402 (payment goes in _meta[\"x402/payment\"]); invalid input or an upstream failure returns an error and is not charged.",
      "inputSchema": {
        "$schema": "https://json-schema.org/draft/2020-12/schema",
        "properties": {
          "domain": {
            "description": "Hostname or URL, e.g. example.com or https://www.example.com/path",
            "maxLength": 300,
            "minLength": 1,
            "type": "string"
          }
        },
        "required": [
          "domain"
        ],
        "type": "object"
      },
      "name": "check_email_auth"
    },
    {
      "description": "Check the HTTP security headers of a website with one live HTTPS GET: redirect chain (up to 5 hops), final status, HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy and COOP, with a simple A-F header grade and findings. Use it for web-hardening checks; it is not a vulnerability scan. The page body is not read or stored. Costs $0.01 USDC per call via x402 (payment goes in _meta[\"x402/payment\"]); invalid input or an upstream failure returns an error and is not charged.",
      "inputSchema": {
        "$schema": "https://json-schema.org/draft/2020-12/schema",
        "properties": {
          "domain": {
            "description": "Hostname or URL, e.g. example.com or https://www.example.com/path",
            "maxLength": 300,
            "minLength": 1,
            "type": "string"
          }
        },
        "required": [
          "domain"
        ],
        "type": "object"
      },
      "name": "check_security_headers"
    },
    {
      "description": "Grade a domain's security posture A-F in one call, for vendor-risk or due-diligence checks. Runs the TLS, DNS (DNSSEC, CAA), registration-expiry, email-auth and HTTP-header checks and returns one letter, a 0-100 score, points per category (TLS 25, email 25, headers 20, DNS 15, registration 15) and the top fixes. Use it when you want a verdict; use site_health or the single checks when you need raw data. Unavailable categories are left out of the percentage (partial=true). Read-only; takes about 3-10 s. Costs $0.03 USDC per call via x402 (payment goes in _meta[\"x402/payment\"]); invalid input or an upstream failure returns an error and is not charged.",
      "inputSchema": {
        "$schema": "https://json-schema.org/draft/2020-12/schema",
        "properties": {
          "domain": {
            "description": "Hostname or URL, e.g. example.com or https://www.example.com/path",
            "maxLength": 300,
            "minLength": 1,
            "type": "string"
          }
        },
        "required": [
          "domain"
        ],
        "type": "object"
      },
      "name": "domain_grade"
    },
    {
      "description": "Full site audit report for one domain, for client reports, vendor reviews or a pre-launch check. Runs every check (TLS from CT logs + live probe, DNS/DNSSEC/CAA, registration expiry and transfer lock, SPF/DMARC/DKIM/MTA-STS, security headers) plus HTTP->HTTPS redirect, www/apex consistency, RFC 9116 security.txt, robots.txt and sitemap. Returns the A-F grade and score (same weights as domain_grade), an action plan sorted critical > high > medium > low where each item has the exact fix and effort, and every raw section. Use domain_grade for just the letter. Fails (not charged) if 3+ core checks fail. Read-only; about 5-15 s. Costs $2 USDC per call via x402 (payment goes in _meta[\"x402/payment\"]); invalid input or an upstream failure returns an error and is not charged.",
      "inputSchema": {
        "$schema": "https://json-schema.org/draft/2020-12/schema",
        "properties": {
          "domain": {
            "description": "Hostname or URL, e.g. example.com or https://www.example.com/path",
            "maxLength": 300,
            "minLength": 1,
            "type": "string"
          }
        },
        "required": [
          "domain"
        ],
        "type": "object"
      },
      "name": "full_site_audit"
    },
    {
      "description": "Free. Return the price of every paid tool, the payment network (Base) and the receiving address, so you can budget before calling. No input, no network request, no payment.",
      "inputSchema": {
        "$schema": "https://json-schema.org/draft/2020-12/schema",
        "properties": {},
        "type": "object"
      },
      "name": "pricing"
    },
    {
      "description": "Run check_cert, check_dns and check_domain_expiry together and return their raw results plus a short summary, the renewal-stall flag and the Let's Encrypt 64-day certificate note (from 2027-02-10). Use it for a full data dump in one call; use domain_grade if you want a single scored A-F answer that also covers email auth and HTTP headers. If one or two sources fail you get partial=true with the rest. Read-only. Costs $0.03 USDC per call via x402 (payment goes in _meta[\"x402/payment\"]); invalid input or an upstream failure returns an error and is not charged.",
      "inputSchema": {
        "$schema": "https://json-schema.org/draft/2020-12/schema",
        "properties": {
          "domain": {
            "description": "Hostname or URL, e.g. example.com or https://www.example.com/path",
            "maxLength": 300,
            "minLength": 1,
            "type": "string"
          }
        },
        "required": [
          "domain"
        ],
        "type": "object"
      },
      "name": "site_health"
    },
    {
      "description": "Is this domain known-bad? Resolves the hostname (A/AAAA), matches the name, its parent domains and resolved IPv4 against ThreatCluster's high-confidence 30-day IOC feed (cached, refreshed about hourly), and looks up ransomware leak-site claims naming the domain (commercially reusable sources via Dragons Eye). Returns verdict listed, claimed, listed_and_claimed or no_known_threat with the matching reports. No match is not proof of safety; claims are unverified attacker assertions. Stale feed or source failure returns an error and is not charged. Costs $0.02 USDC per call via x402 (payment goes in _meta[\"x402/payment\"]); invalid input or an upstream failure returns an error and is not charged.",
      "inputSchema": {
        "$schema": "https://json-schema.org/draft/2020-12/schema",
        "properties": {
          "domain": {
            "description": "Hostname or URL, e.g. example.com or https://www.example.com/path",
            "maxLength": 300,
            "minLength": 1,
            "type": "string"
          }
        },
        "required": [
          "domain"
        ],
        "type": "object"
      },
      "name": "threat_check"
    },
    {
      "description": "Free. Check that a domain or URL is well-formed and get the normalized hostname, before calling a paid check. Offline: no network request, no payment. Rejects IP addresses, single-label names and URLs with credentials.",
      "inputSchema": {
        "$schema": "https://json-schema.org/draft/2020-12/schema",
        "properties": {
          "domain": {
            "description": "Hostname or URL to normalize, e.g. example.com or https://www.example.com/path",
            "maxLength": 300,
            "type": "string"
          }
        },
        "required": [
          "domain"
        ],
        "type": "object"
      },
      "name": "validate_target"
    },
    {
      "description": "Free. Status of a paid domain watch (created with HTTP POST /v1/watch): items, expiry, last check, current DNS/IOC/claim state, last webhook delivery.",
      "inputSchema": {
        "$schema": "https://json-schema.org/draft/2020-12/schema",
        "properties": {
          "watch_id": {
            "description": "Watch id, e.g. ocw_abcdefghijklmnop",
            "pattern": "^ocw_[a-z2-7]{16}$",
            "type": "string"
          }
        },
        "required": [
          "watch_id"
        ],
        "type": "object"
      },
      "name": "watch_status"
    }
  ]
}

What the leaf hashes

{"body":"ef60639e0881d9ff6e79bbe3569dcb6d5065eec6e8f3fb936e547a0aa476a96c","id":542669,"kind":"mcp.tools","method":"probe.mcp/1","observed_us":1793131023508947,"prev":null,"subject":"b8b6b6bb-3800-48dd-9cbc-052940cd49b3","subject_kind":"endpoint"}

Proof

Fold these into the leaf in order, hashing each sorted pair with keccak256, to reach the root of 2026-10-27 (273461 rows).

1. 0x20bbe2dbdb4c4f672f6fb82c9dbbed7ada0d6f0c7264fd194267f6be9ca940ab
2. 0xfb6941b0126b72cc0d07bc0902ef9f24a5d922470957c45c4384426b0f1d8cf0
3. 0x8cb2f45f4dffe37f37810cf11e55f3fac6a7828886a0d9e03e3aa2f2144a7073
4. 0x51e5c9b5f2a76eaf655456246270bd18ae97e8b7b46bbe2aa9b476f42749f2d0
5. 0x577a9af9bea9b5fd73b49cae31ebab92ba1769059e4350232034c71439e6a488
6. 0xa177328c088f11ff8781be89612766df150aaad2afa3aeb67cc1bc4d7ab6be43
7. 0x68826985269aa4887fc781e1abd98d1c5384eef3ec40fab883f5f223a781478f
8. 0xa3f2150c92b13dca701b2460424613d1db6565fe54042cc7e3499243d4ca5975
9. 0xebd2260d02ea2a82fb7040953a3c54037b1ea798b4c0388374dcd706c997f5ac
10. 0x1b988ecad90134ffab61568269963f788ff682e879f6b40e10a928fd89837e2c
11. 0x5b0b64ab1e36bf2ec3c04be82716d130476b3af9a60be0d19dcbdf8a3b7e3da9
12. 0xd4460ea292e8308ed2accdcd5b386b0914636a5b8cec975011dff814c29ff99a
13. 0x20ca24353b8aca3e061eedf55f49b69ae8369b88135dfdabf30039ed34db329a
14. 0xe8ee6f6ed50253c5ee2d1aa85a4b1a38ce94bca7f3b72fd1850f496152dbe285
15. 0xa383a1cfe9b3f6af67eb4c7642564b9424d46d7fca90e7ba175d549f8b67dd0c
16. 0x52efa60e0c3d8525486d2310eb3b6b566c9677c64fd1f819edb072cf101bcbdb
17. 0x22c1fb9487ee0b9732fa017a0cc321eb27a60c08450d112f755089796e12cb1c
18. 0xa20d48798a34aba12eb9c7297722982d910f06c148f5e27ac59307422964a585
19. 0x9fc354c0ea3efc3f1b6548bb77ea902a50f2c9647647ea61592efce2bd795699

Day root

0xdd77e5e99da32c3f154180d63e3c3e6fe11e896a2c6896412ef6b5c4bcf7e795

Chained

0x23bb4dfd09f55c15ac3962f53578e02c6114d5bfd9bb451cf8794fb6e2817ef4

Published

On Arc Testnet, block 69414147: 0xb2ebd83aafeb765a0ce66e76aefb133ed06606c98038fd56191e2bcd1dcb77b4