Evidence row 574517

What was observed

{
  "count": 10,
  "tools": [
    {
      "description": "Create a public HTTPS URL that captures every request sent to it (any method, any sub-path). Use it when you need an endpoint to receive a webhook from a third-party service while building or debugging an integration. Returns the URL to configure in the service and a live inspector link for the human.",
      "inputSchema": {
        "$schema": "http://json-schema.org/draft-07/schema#",
        "properties": {
          "name": {
            "description": "Label, e.g. 'stripe-test'",
            "maxLength": 60,
            "type": "string"
          }
        },
        "type": "object"
      },
      "name": "create_webhook_url"
    },
    {
      "description": "AI analysis of a captured request. mode=explain: who sent it, which event, key fields, how to verify the signature, pitfalls. mode=handler: complete receiving code that verifies the signature and handles this event. Included in paid plans; anonymous and free users get 3 trials.",
      "inputSchema": {
        "$schema": "http://json-schema.org/draft-07/schema#",
        "properties": {
          "language": {
            "description": "Handler language (mode=handler). Default node.",
            "enum": [
              "node",
              "nextjs",
              "python",
              "php",
              "go",
              "ruby"
            ],
            "type": "string"
          },
          "mode": {
            "enum": [
              "explain",
              "handler"
            ],
            "type": "string"
          },
          "request_id": {
            "type": "string"
          },
          "token": {
            "type": "string"
          }
        },
        "required": [
          "token",
          "request_id"
        ],
        "type": "object"
      },
      "name": "explain_webhook_request"
    },
    {
      "description": "Return one captured request in full (headers, raw body, detected provider/event).",
      "inputSchema": {
        "$schema": "http://json-schema.org/draft-07/schema#",
        "properties": {
          "request_id": {
            "type": "string"
          },
          "token": {
            "type": "string"
          }
        },
        "required": [
          "token",
          "request_id"
        ],
        "type": "object"
      },
      "name": "get_webhook_request"
    },
    {
      "description": "List the most recent requests captured by a webhook URL, newest first (summaries; use get_webhook_request for one full request).",
      "inputSchema": {
        "$schema": "http://json-schema.org/draft-07/schema#",
        "properties": {
          "limit": {
            "description": "Default 10",
            "maximum": 50,
            "minimum": 1,
            "type": "integer"
          },
          "token": {
            "type": "string"
          }
        },
        "required": [
          "token"
        ],
        "type": "object"
      },
      "name": "list_webhook_requests"
    },
    {
      "description": "List the webhook URLs of the account behind the API key (requires an API key).",
      "inputSchema": {
        "$schema": "http://json-schema.org/draft-07/schema#",
        "properties": {},
        "type": "object"
      },
      "name": "list_webhook_urls"
    },
    {
      "description": "Re-send a captured request (same method, headers and raw body) to a PUBLIC URL and return the target's response. Localhost and private IPs are refused here: for localhost use the CLI (`npx webhook-toolkit replay`) or the local MCP server (`npx webhook-toolkit mcp`).",
      "inputSchema": {
        "$schema": "http://json-schema.org/draft-07/schema#",
        "properties": {
          "request_id": {
            "type": "string"
          },
          "target_url": {
            "format": "uri",
            "type": "string"
          },
          "token": {
            "type": "string"
          }
        },
        "required": [
          "token",
          "request_id",
          "target_url"
        ],
        "type": "object"
      },
      "name": "replay_webhook_request"
    },
    {
      "description": "Choose what the webhook URL answers to callers (status code, body, content type) — e.g. return 500 to test the sender's retries, or a specific JSON/XML body the service expects.",
      "inputSchema": {
        "$schema": "http://json-schema.org/draft-07/schema#",
        "properties": {
          "body": {
            "maxLength": 10000,
            "type": "string"
          },
          "content_type": {
            "maxLength": 120,
            "type": "string"
          },
          "status": {
            "maximum": 599,
            "minimum": 100,
            "type": "integer"
          },
          "token": {
            "type": "string"
          }
        },
        "required": [
          "token"
        ],
        "type": "object"
      },
      "name": "set_webhook_response"
    },
    {
      "description": "Build a webhook body with a VALID signature header for a provider, to test a handler's signature verification without triggering a real event. Providers: stripe, github, shopify, slack, twilio, mailgun. Returns the headers, the exact body to send and a ready-to-run curl command.",
      "inputSchema": {
        "$schema": "http://json-schema.org/draft-07/schema#",
        "properties": {
          "event_type": {
            "description": "Sample event to use when no payload is given, e.g. checkout.session.completed",
            "type": "string"
          },
          "payload": {
            "description": "JSON payload (or form fields as JSON for Twilio). Default: a realistic sample event.",
            "type": "string"
          },
          "provider": {
            "enum": [
              "stripe",
              "github",
              "shopify",
              "slack",
              "twilio",
              "mailgun"
            ],
            "type": "string"
          },
          "secret": {
            "description": "The webhook signing secret configured in your handler (whsec_… for Stripe)",
            "type": "string"
          },
          "target_url": {
            "description": "Handler URL (required for Twilio, whose signature covers the URL)",
            "type": "string"
          }
        },
        "required": [
          "provider",
          "secret"
        ],
        "type": "object"
      },
      "name": "sign_webhook_payload"
    },
    {
      "description": "Check whether a webhook signature is valid for a raw body and a secret, and diagnose why it fails (wrong secret, whitespace, re-serialized JSON body, expired timestamp, wrong URL for Twilio). Providers: stripe, github, shopify, slack, twilio.",
      "inputSchema": {
        "$schema": "http://json-schema.org/draft-07/schema#",
        "properties": {
          "provider": {
            "enum": [
              "stripe",
              "github",
              "shopify",
              "slack",
              "twilio"
            ],
            "type": "string"
          },
          "raw_body": {
            "description": "The raw request body exactly as received",
            "type": "string"
          },
          "secret": {
            "type": "string"
          },
          "signature": {
            "description": "The signature header value (Stripe-Signature, X-Hub-Signature-256, X-Shopify-Hmac-Sha256, X-Slack-Signature, X-Twilio-Signature)",
            "type": "string"
          },
          "timestamp": {
            "description": "Slack only: X-Slack-Request-Timestamp",
            "type": "string"
          },
          "url": {
            "description": "Twilio only: the full URL Twilio called",
            "type": "string"
          }
        },
        "required": [
          "provider",
          "secret",
          "raw_body",
          "signature"
        ],
        "type": "object"
      },
      "name": "verify_webhook_signature"
    },
    {
      "description": "Block until the next request reaches a webhook URL (or the timeout elapses), then return it in full: method, path, headers, body, detected provider and event. Use right after triggering an action that should send a webhook. Call again with `after` set to the last request's createdAt to wait for the following one.",
      "inputSchema": {
        "$schema": "http://json-schema.org/draft-07/schema#",
        "properties": {
          "after": {
            "description": "ISO timestamp: only requests strictly newer than this. Default: now.",
            "type": "string"
          },
          "timeout_seconds": {
            "description": "Default 30, max 50",
            "maximum": 50,
            "minimum": 1,
            "type": "integer"
          },
          "token": {
            "description": "Token of the webhook URL (the part after /r/)",
            "type": "string"
          }
        },
        "required": [
          "token"
        ],
        "type": "object"
      },
      "name": "wait_for_webhook"
    }
  ]
}

What the leaf hashes

{"body":"b83c0b58f980691ee7d303a7d95ee5fbce6ff3fb3bdf287f3b5b26741f92ac66","id":574517,"kind":"mcp.tools","method":"probe.mcp/1","observed_us":1793141551301209,"prev":null,"subject":"f24edd3b-ddef-4f7f-a663-bcf081c7fdcb","subject_kind":"endpoint"}

Proof

Fold these into the leaf in order, hashing each sorted pair with keccak256, to reach the root of 2026-10-27 (273461 rows).

1. 0x8ba1c17ee9cbfc7aa0ac7b5c97e153214535d03a7c3ea25aa1749ef22b6d2e15
2. 0x600f817d0d66fe5ecbccc4385f45334ffe9901f21514727515ca1e01c80bc0cf
3. 0x598857092c1b9048710a244f9f3f53de7f6bedbb738fd7969cac2cd37db191c0
4. 0xb82769187532559a1e9e57db7e03d2c8e7e625883781cf2cd666bf6a08d71392
5. 0xdae20cc6e4edcd4ab72e7c1f997089e6cff248c1c1860c3e6669ce8a7af9781b
6. 0xc9ba86ee8e9cf5d63c9a35f2973817bcce1bd8f292cfb26b57ba91dafd692428
7. 0xbc7426bef36be491784f9812740af70aa00b599825d450d7bcf528f1329b621d
8. 0xf640fa04aeacab25ba1f4f0b80b913a260aa7031aa8701abe402b59ae1df7420
9. 0x2d7d45ff680434190b8afaeac0e174794ab02d968b20c730968db76f8020c8e1
10. 0x0ca30ec94337e2e0b4a0b00e9e5686108240f05cc6751241e417346db4380f8d
11. 0xcdbeb854b5cb2391772ef949ab5c1e3c24cc8221d97cd112ccb987b02e3d89da
12. 0xe9b891332733aa3fa69ace7f82b036df13816078968e2c10034f79c2255498d0
13. 0xea3d566bf95ca7a3a7f6de9c4f77180bd8c5ffd160486a27d870e8a2fb6d0b9e
14. 0x06e3b43165f5b3c31d850bc32f20b2e25b844564c4e042c141b9748c26a5a600
15. 0xb4f7223140c8a36cb87a63d77cf617086d9968dc4658f03e102571ebe06e9ed6
16. 0xfecf3d4646dd4984a13dd715499e842c3fde63692336d97394c2bfd8e877ca5d
17. 0xf30fddbf4811226c58e8f0daf36fddd79fc5f1356b592bb1d99a8061ddbabe66
18. 0x2bf8151e5f157dd183b9de6fa00469551932a7a6e3f33a694895000ac9061197
19. 0x9fc354c0ea3efc3f1b6548bb77ea902a50f2c9647647ea61592efce2bd795699

Day root

0xdd77e5e99da32c3f154180d63e3c3e6fe11e896a2c6896412ef6b5c4bcf7e795

Chained

0x23bb4dfd09f55c15ac3962f53578e02c6114d5bfd9bb451cf8794fb6e2817ef4

Published

On Arc Testnet, block 69414147: 0xb2ebd83aafeb765a0ce66e76aefb133ed06606c98038fd56191e2bcd1dcb77b4