Evidence row 570628

What was observed

{
  "count": 1,
  "tools": [
    {
      "description": "Scan a public GitHub MCP-server repository for security issues.\n\n    Clones the repo (shallow, <60s, <200 MB), runs compuute-scan v0.6.2 in\n    static analysis mode (no code execution from the target), and returns a\n    structured report with severity counts, a 0-100 score, and the 10 most\n    severe findings.\n\n    WHEN TO USE:\n      - Before connecting to an unknown MCP server discovered via Anthropic\n        Registry, Smithery, mcp.so, or a Discord recommendation.\n      - Before installing a third-party MCP-server package into a production\n        pipeline.\n      - As part of an agent's pre-commit / pre-deploy due-diligence step\n        when adding new dependencies.\n      - As one input to a multi-source trust evaluation (combine with\n        publisher reputation, package install count, last-update recency).\n\n    WHEN NOT TO USE:\n      - For private repos. Use the on-prem CLI instead:\n          `npx compuute-scan ./path-to-private-repo`\n      - For deep exploitability assessment of a specific code path. This is\n        pattern matching, not dataflow analysis. Book a manual L2-L4 audit\n        at https://compuute.se/audit for that depth.\n      - For non-GitHub hosts (GitLab, Bitbucket, self-hosted). v1 supports\n        github.com only.\n      - For repos > 200 MB or clone time > 60s. The endpoint returns a 413\n        or 504 in those cases — fall back to local CLI.\n\n    EXPECTED RESPONSE TIME:\n      - Median: ~1-2 seconds for small repos (<100 files).\n      - p99: ~10 seconds for medium repos.\n      - Hard timeout at clone=60s, scan=120s combined.\n\n    EXPECTED COST:\n      - Free tier in MVP. Future Pro tier may charge per-scan or per-month.\n\n    DATA FRESHNESS:\n      - Scanner version is reported in response.scanner.version.\n      - L1 rule set freshness reflects compuute-scan releases — see\n        github.com/Compuute/compuute-scan/CHANGELOG.md for the latest CVE\n        and threat-intel response timeline.\n\n    EXAMPLES:\n\n      Example 1 — scan an MCP server you're evaluating:\n        github_url = \"https://github.com/modelcontextprotocol/servers\"\n        → score: 0, summary: {critical: 1, high: 94, medium: 22}\n        → top_findings include SSRF, eval, etc.\n        → recommendation: \"AVOID — 1 critical and 94 high finding(s)...\"\n\n      Example 2 — scan a clean reference implementation:\n        github_url = \"https://github.com/microsoft/azure-devops-mcp\"\n        → score: 90+, summary: {critical: 0, high: 1}\n        → recommendation: \"REVIEW — 1 high finding(s)...\"\n\n      Example 3 — scan your own dev MCP-server before publishing:\n        github_url = \"https://github.com/yourorg/your-mcp\"\n        → audit your own surface before others install it\n\n    OUTPUT FIELDS (stable schema):\n      - repo_url (str): canonical URL of the scanned repo.\n      - score (int): 0-100, higher safer. Coarse summary, not a precision claim.\n      - summary (object): {critical, high, medium, low, info, files_scanned}.\n      - recommendation (str): action guidance derived from severity counts.\n      - findings_count (int): total raw findings (may include false positives).\n      - top_findings (list): up to 10 most severe, each with {id, title,\n        severity, file, line, owasp, cwe}.\n      - l0_discovery (object): MCP transport, tool count, dependency pinning.\n      - performance (object): clone_seconds, scan_seconds, repo_size_bytes.\n      - scanner (object): {name, version, layers_covered}.\n      - _disclaimer (str): MANDATORY triage disclaimer. Read it.\n\n    Args:\n      github_url: Public GitHub HTTPS URL (e.g. https://github.com/org/repo).\n                  Must be public and < 200 MB. v1 is github.com only.\n\n    Returns:\n      Structured scan result. On error, returns {\"error\": code, \"message\": ...}\n      with HTTP-style code (invalid_url, clone_failed, scan_timeout, etc.).\n    ",
      "inputSchema": {
        "properties": {
          "github_url": {
            "title": "Github Url",
            "type": "string"
          }
        },
        "required": [
          "github_url"
        ],
        "title": "scan_mcp_serverArguments",
        "type": "object"
      },
      "name": "scan_mcp_server"
    }
  ]
}

What the leaf hashes

{"body":"4eb5fc8aa6989b8aa38ca1aba975f4b5b701ace425fb8d5bf75a273456924fdb","id":570628,"kind":"mcp.tools","method":"probe.mcp/1","observed_us":1793139849999759,"prev":null,"subject":"e72c7d0a-5808-4a52-a63f-6c0acfd9f818","subject_kind":"endpoint"}

Proof

Fold these into the leaf in order, hashing each sorted pair with keccak256, to reach the root of 2026-10-27 (273461 rows).

1. 0xa694e58dd30adad21b53f6c15cd616040e735059617d868a1ac2c8085d3c6574
2. 0xcd173097afa68452ef17d77b3f526beea932f915e19bc8ee68c4336c4c7a03c2
3. 0x4899a569a48cdc7691262d14aa723bd577e12cb446f1dd617610029157ae2268
4. 0xd10bf27fff6d8dbfaaf8a70b54d6a794581d5f8b81bc4a6f88b93b7b1ae03cd2
5. 0x391a0ddd257abfe7e6150b3271815ef667a1a251068a26d20d394e1f469c9086
6. 0x48ad30e6bb86c84291df9c35985b239f4671595168413031b7018d2a6252e346
7. 0x759a95e452a113c1d3c3ba572cf1514ab0d1857a7a835ef6f3d2e8aee76f638e
8. 0x337ee481ceb958ef92f02338008f7110c79062e8cb33a3d1942c0861adffeccf
9. 0x25d3dd26600ddd40f9fd4339f485e0abe36a1deab802f4e5f09b51343231088b
10. 0x5ae263265777ee62431de587d377c20bb922d60cc6fb48094a7f3cdb8a3b231e
11. 0x84d44ad9f2c04577b96d73f7fdc6010e8b93e5b318136ae9ea601cf365fad041
12. 0x98f564dcc2f0d0fd67cbc3a17211687e12a4becc9b9c47ef78c02ff7431b734a
13. 0xb37156a04839055daed26674da38864f8dae598cab9742c6fb3e74eb3178f2d4
14. 0x0644f7e2a4b5bf9b66f185cc3fbb766d456ad94490183852f4c6db5855114cc5
15. 0xa3fff4662cd48659f5bafd0612931759a90e53a7b4209ed8f26f6594a07bb547
16. 0x64c405a28e8819716221eb2529fe4ce277ab08025e17e685cbd5ece75ceb75c7
17. 0xf30fddbf4811226c58e8f0daf36fddd79fc5f1356b592bb1d99a8061ddbabe66
18. 0x2bf8151e5f157dd183b9de6fa00469551932a7a6e3f33a694895000ac9061197
19. 0x9fc354c0ea3efc3f1b6548bb77ea902a50f2c9647647ea61592efce2bd795699

Day root

0xdd77e5e99da32c3f154180d63e3c3e6fe11e896a2c6896412ef6b5c4bcf7e795

Chained

0x23bb4dfd09f55c15ac3962f53578e02c6114d5bfd9bb451cf8794fb6e2817ef4

Published

On Arc Testnet, block 69414147: 0xb2ebd83aafeb765a0ce66e76aefb133ed06606c98038fd56191e2bcd1dcb77b4