Evidence row 573195

What was observed

{
  "count": 9,
  "tools": [
    {
      "description": "Use before depending on an unfamiliar A2A agent. Reads only the public Agent Card and optional public registry metadata, checks declared bindings/protocol versions, skill descriptions, security declarations and registry task-verification evidence, then returns a trust/readiness score plus shareable badge metadata. It does not send a task to or execute any skill on the target agent.",
      "inputSchema": {
        "additionalProperties": false,
        "properties": {
          "card_url": {
            "description": "Public HTTPS A2A Agent Card URL, normally /.well-known/agent-card.json.",
            "format": "uri",
            "type": "string"
          }
        },
        "required": [
          "card_url"
        ],
        "type": "object"
      },
      "name": "audit_a2a_agent_card"
    },
    {
      "description": "Use for a public remote MCP server that an autonomous agent depends on. Remembers the tools/list baseline, returns only added/removed/modified tools, screens new or changed tool definitions, and produces one aggregate ALLOW/REVIEW/BLOCK decision. It does not inspect server source code or authenticated/private MCP endpoints.",
      "inputSchema": {
        "additionalProperties": false,
        "properties": {
          "endpoint_url": {
            "description": "Public HTTPS MCP endpoint.",
            "format": "uri",
            "type": "string"
          }
        },
        "required": [
          "endpoint_url"
        ],
        "type": "object"
      },
      "name": "audit_mcp_dependency"
    },
    {
      "description": "Use to inspect a public Shopify store's AI-shopping surface before an autonomous agent trusts it. Reads only public /.well-known/ucp, /agents.md and /api/ucp/mcp metadata, runs initialize/tools/list, screens exposed tool definitions, and returns a readiness/risk packet. It never creates or mutates carts, checkouts, orders, payments, credentials, or store data.",
      "inputSchema": {
        "additionalProperties": false,
        "properties": {
          "store": {
            "description": "Public Shopify store domain or HTTPS URL, for example store.myshopify.com.",
            "type": "string"
          }
        },
        "required": [
          "store"
        ],
        "type": "object"
      },
      "name": "audit_shopify_agentic_storefront"
    },
    {
      "description": "Use only when free usage is exhausted or production volume is needed. Returns Stripe checkout for 10,000 prepaid GHOSBC Safety Gate checks for $19; it does not charge or receive payment credentials.",
      "inputSchema": {
        "additionalProperties": false,
        "properties": {},
        "type": "object"
      },
      "name": "buy_policy_checks"
    },
    {
      "description": "Use before sending context to an external model, tool or agent when the payload may contain credentials or private material. Redacts common secret patterns and flags policy-extraction language. Not a complete DLP/compliance system.",
      "inputSchema": {
        "additionalProperties": false,
        "properties": {
          "payload": {}
        },
        "required": [
          "payload"
        ],
        "type": "object"
      },
      "name": "sanitize_agent_payload"
    },
    {
      "description": "Use before an agent follows untrusted instructions or requests capabilities. Returns ALLOW, REVIEW, or BLOCK plus an audit digest. Best for prompt/policy routing; use screen_consequential_action for a concrete purchase, write, deployment, deletion or other bounded action.",
      "inputSchema": {
        "additionalProperties": false,
        "properties": {
          "capabilities": {
            "items": {
              "type": "string"
            },
            "type": "array"
          },
          "mode": {
            "enum": [
              "OPEN",
              "GUARDED",
              "SEALED"
            ],
            "type": "string"
          },
          "text": {
            "type": "string"
          }
        },
        "required": [
          "text"
        ],
        "type": "object"
      },
      "name": "screen_agent_request"
    },
    {
      "description": "Use immediately before a consequential agent action such as purchase, payment, transfer, send, deploy, publish, execute, cart mutation, checkout mutation, or delete. Compares the proposed action with caller-declared allowed actions/targets, amount ceiling, currency and expiry. ALLOW only when explicit bounds fit; REVIEW when bounds are missing; BLOCK when limits are violated. Does not execute the action.",
      "inputSchema": {
        "additionalProperties": false,
        "properties": {
          "action": {
            "type": "string"
          },
          "amount": {
            "type": "number"
          },
          "constraints": {
            "additionalProperties": false,
            "properties": {
              "allowed_actions": {
                "items": {
                  "type": "string"
                },
                "type": "array"
              },
              "allowed_targets": {
                "items": {
                  "type": "string"
                },
                "type": "array"
              },
              "currency": {
                "type": "string"
              },
              "expires_at": {
                "format": "date-time",
                "type": "string"
              },
              "max_amount": {
                "type": "number"
              }
            },
            "type": "object"
          },
          "currency": {
            "type": "string"
          },
          "target": {
            "type": "string"
          }
        },
        "required": [
          "action"
        ],
        "type": "object"
      },
      "name": "screen_consequential_action"
    },
    {
      "description": "Use before exposing a third-party MCP tool to an autonomous agent, or after a tool definition changed. Screens name, description, schema and annotations for injection-like language, credential/private-context surfaces, side-effect risk and weak contracts. Advisory metadata gate, not source-code verification.",
      "inputSchema": {
        "additionalProperties": false,
        "properties": {
          "annotations": {
            "type": [
              "object",
              "null"
            ]
          },
          "description": {
            "type": "string"
          },
          "inputSchema": {
            "type": [
              "object",
              "null"
            ]
          },
          "name": {
            "type": "string"
          }
        },
        "required": [
          "name"
        ],
        "type": "object"
      },
      "name": "screen_mcp_tool_definition"
    },
    {
      "description": "Use immediately before an agent delivers a response outside its trust boundary. Flags likely credential leakage or policy-extraction content and returns a sanitized response when review is needed. Not factuality verification.",
      "inputSchema": {
        "additionalProperties": false,
        "properties": {
          "response": {}
        },
        "required": [
          "response"
        ],
        "type": "object"
      },
      "name": "validate_agent_response"
    }
  ]
}

What the leaf hashes

{"body":"d7eebcc913f99f7e78af6241f18d9d33cf1bfe94a8655ba613b6c4e6f99805ea","id":573195,"kind":"mcp.tools","method":"probe.mcp/1","observed_us":1793140971142666,"prev":null,"subject":"696fb4e1-c5ee-4dea-b860-edc494b32ab3","subject_kind":"endpoint"}

Proof

Fold these into the leaf in order, hashing each sorted pair with keccak256, to reach the root of 2026-10-27 (273461 rows).

1. 0xf5c37fe7898ec0ee894cf03721a0051e90e6c963d37f79f2320962cafc220c03
2. 0xc184093c816a83ffbb95db3f684b984bd31c7f3e822b457932e6dd5419fadab6
3. 0x0f6347c003300bbf91953466753618f8acb33aadb053700ee12082652519e17b
4. 0x8423402f855a5119337bb0c973505cc14874be2d8309b37c1aa46b71d71fae1d
5. 0xa45638237b8c743b721e8dbaab022bdcdacb4fd96c6bd3a1bc6178c92d5e5ebe
6. 0x1e8e78683ee88c23b5b16731cdcbcb9337b61bb14916e402f8e5fbda74f46d3d
7. 0x7cab439ca6474ca6917e67bd022fa2b77ef167bfcf032647f3f6e50a2f89e4a2
8. 0x45ef5f56991056a945f46443226aa626127d6b1c663a1d7b94da7b777077326e
9. 0xed0e2eff6268d181a48b24f99cd337f62f0ed8cf2563246977856ac53764fe8b
10. 0x2f63abd8161e1650deec05401c58aef6c022c70f7608fa2721658cdc4c8319e1
11. 0xb3ff7369d12615d3036b48b1396a793b1d0d84a56c22090d510b0219bcb8a827
12. 0xb841380b5d51818d39ebd0d89624396bb243f73c55b9f61e4f4bcddf15ebdec2
13. 0x2cba9be288dab78cb9c5f54fa13242712b2493da9f833a7c3cdd92cde60662b0
14. 0x94d3785ce9330e4580bccada5459380aa2aac76a0bf11354d1353b375afc17d2
15. 0xb5b652bba4a5afca56c21031d89b1c06361563aaf54ccc8541c296ceeb2b66fa

Day root

0xdd77e5e99da32c3f154180d63e3c3e6fe11e896a2c6896412ef6b5c4bcf7e795

Chained

0x23bb4dfd09f55c15ac3962f53578e02c6114d5bfd9bb451cf8794fb6e2817ef4

Published

On Arc Testnet, block 69414147: 0xb2ebd83aafeb765a0ce66e76aefb133ed06606c98038fd56191e2bcd1dcb77b4