Evidence row 577765

What was observed

{
  "count": 7,
  "tools": [
    {
      "description": "Create a hosted okgate proxy in front of an MCP server. Returns the proxy id, the per-customer MCP URL and the proxy key (shown once). Point your agent's MCP client at the URL with `Authorization: Bearer <key>`. Requires an account key.",
      "inputSchema": {
        "$schema": "https://json-schema.org/draft/2020-12/schema",
        "additionalProperties": false,
        "properties": {
          "mode": {
            "default": "dry-run",
            "description": "dry-run records what the policy would have blocked and lets every call through; enforce actually blocks. Start in dry-run.",
            "enum": [
              "dry-run",
              "enforce"
            ],
            "type": "string"
          },
          "slug": {
            "description": "short name, a-z 0-9 -",
            "maxLength": 40,
            "minLength": 2,
            "type": "string"
          },
          "upstreamName": {
            "description": "name used to namespace tools when you add more upstreams later",
            "maxLength": 32,
            "minLength": 1,
            "type": "string"
          },
          "upstreamUrl": {
            "description": "Streamable HTTP URL of the MCP server to protect",
            "format": "uri",
            "type": "string"
          }
        },
        "required": [
          "slug",
          "upstreamUrl"
        ],
        "type": "object"
      },
      "name": "okgate_create_proxy"
    },
    {
      "description": "Export a run's hash-chained audit entries (prev_hash, hash, redacted args) with the Merkle root, for disputes and questionnaires. Verify offline with sha256(prev_hash + canonical(entry)). Requires an account key.",
      "inputSchema": {
        "$schema": "https://json-schema.org/draft/2020-12/schema",
        "additionalProperties": false,
        "properties": {
          "proxyId": {
            "description": "the proxy id returned by okgate_create_proxy",
            "minLength": 6,
            "type": "string"
          },
          "runId": {
            "description": "the X-Run-Id your agent sent with the calls; one run is one agent session",
            "minLength": 1,
            "type": "string"
          }
        },
        "required": [
          "proxyId",
          "runId"
        ],
        "type": "object"
      },
      "name": "okgate_export_audit"
    },
    {
      "description": "Machine-readable pricing for okgate hosted: bands (Starter/Pro/Team) with included tool calls per month, the 80% soft alert and 150% hard stop, features, the free trial allowance, `per_call` — buying tool calls outright at POST /api/v1/calls from a prepaid balance, which is the one purchase here an unattended agent can complete — and `one_time`: reports a person pays for once on Stripe Checkout, such as the $49 EU AI Act Article 50 readiness report. Same data as /pricing.json.",
      "inputSchema": {
        "$schema": "https://json-schema.org/draft/2020-12/schema",
        "additionalProperties": false,
        "properties": {},
        "type": "object"
      },
      "name": "okgate_get_pricing"
    },
    {
      "description": "The incident-shaped report for one run: counts (calls, reads, writes, faked, blocked, spend), the call timeline with decisions, dry-run mutations (what would have changed), ledger entries and the audit-chain verification. Requires an account key.",
      "inputSchema": {
        "$schema": "https://json-schema.org/draft/2020-12/schema",
        "additionalProperties": false,
        "properties": {
          "proxyId": {
            "description": "the proxy id returned by okgate_create_proxy",
            "minLength": 6,
            "type": "string"
          },
          "runId": {
            "description": "the X-Run-Id your agent sent with the calls; one run is one agent session",
            "minLength": 1,
            "type": "string"
          }
        },
        "required": [
          "proxyId",
          "runId"
        ],
        "type": "object"
      },
      "name": "okgate_get_run"
    },
    {
      "description": "Least-privilege recommendation from the proxy's recorded calls: the minimal tool allowlist, argument keys used per tool, and the upstream tools never used (remove them first). No LLM call here; apply it in the dashboard. Requires an account key.",
      "inputSchema": {
        "$schema": "https://json-schema.org/draft/2020-12/schema",
        "additionalProperties": false,
        "properties": {
          "proxyId": {
            "description": "the proxy id returned by okgate_create_proxy",
            "minLength": 6,
            "type": "string"
          }
        },
        "required": [
          "proxyId"
        ],
        "type": "object"
      },
      "name": "okgate_recommend_allowlist"
    },
    {
      "description": "Replace a proxy's policy (YAML: mode, upstreams, classify, caps, loop, dry_run, approvals, alerts, chaos, drift). Validated before saving; takes effect within 30 seconds. Requires an account key.",
      "inputSchema": {
        "$schema": "https://json-schema.org/draft/2020-12/schema",
        "additionalProperties": false,
        "properties": {
          "policyYaml": {
            "description": "the complete policy document; it replaces the current one rather than merging",
            "maxLength": 64000,
            "minLength": 1,
            "type": "string"
          },
          "proxyId": {
            "description": "the proxy id returned by okgate_create_proxy",
            "minLength": 6,
            "type": "string"
          }
        },
        "required": [
          "proxyId",
          "policyYaml"
        ],
        "type": "object"
      },
      "name": "okgate_set_policy"
    },
    {
      "description": "Read an agent log and report what it spent: totals, calls by tool and by class, estimated\ndollars by rail, loops, the largest single run, and — for every overspend — the okgate\nband whose cap would have stopped it, the exact cap, and the call that would have tripped\nit.\n\nNeeds no account and no key. The log is read in the request and discarded; nothing is\nstored. Accepts an agentwares audit export (`agentwares.audit/v1`), a Claude Code session\n`.jsonl`, or a CSV/JSONL of tool calls with any of `tool`, `ts`, `class`, `amount_usd`,\n`rail`, `run_id`, `model`, `input_tokens`, `output_tokens`.\n\nCaps come from the proxy's own default policy, so a band named here refuses exactly what\nit says it refuses. Buying that band is a checkout a person completes; the calls-only\npurchase an unattended agent can complete is in `okgate_get_pricing` instead.",
      "inputSchema": {
        "$schema": "https://json-schema.org/draft/2020-12/schema",
        "additionalProperties": false,
        "properties": {
          "detail": {
            "description": "`concise` (default) returns the totals, the top ten tools, the rails, the loops and every overspend. `full` adds the complete per-tool breakdown and the window. Ask for `full` only when you are going to read it.",
            "enum": [
              "concise",
              "full"
            ],
            "type": "string"
          },
          "log": {
            "description": "The log itself, verbatim — JSON, JSONL or CSV. Not a path and not a URL: this server does not fetch anything.",
            "minLength": 1,
            "type": "string"
          }
        },
        "required": [
          "log"
        ],
        "type": "object"
      },
      "name": "okgate_spend_report"
    }
  ]
}

What the leaf hashes

{"body":"919372c404024924be98070e5e57d098dfb2073d6e1318748948e1d514d629b1","id":577765,"kind":"mcp.tools","method":"probe.mcp/1","observed_us":1793142749136853,"prev":null,"subject":"07e5176a-bb16-4a0a-a591-26fad8388bb3","subject_kind":"endpoint"}

Proof

Fold these into the leaf in order, hashing each sorted pair with keccak256, to reach the root of 2026-10-27 (273461 rows).

1. 0x605588167bdd45527b4905c2d02588ced0d6b3d83d539de6a1322ac696325f89
2. 0xce7408a786dde8c29c074483218835733872d5969e91ed0d6498aec15db94dbc
3. 0x6aafbde9141c6e6b957e3e5d3fde9f0f3cee0b39d0f0f1000c0e246ea2b9c742
4. 0x286fd23162acd09f5a767bc7c37faf75eec02996425275bf8c26422d4aa0ea78
5. 0xf062cddbaa1fe21f3395f32009f9a138ff173f79a877663e6ffd4dff37780cc0
6. 0x18bac4e9e36015082f382dea6423ff8bd85f882bae7b09787688d54d5dfd16fb
7. 0xb53d8b992ba0e76e0065a37a6feafe37a9c5accf84fd6821ffb21c2b73eb2fcf
8. 0xb5f74d82cad313459593d39c38ab01dc16f60fe8cefc516b91c289d95deb7bfd
9. 0x9a7ecbac7e25cf5c4881219576298a27c3ed9bc9bb44ae81d0c5528f1b6467e6
10. 0xde1d4091b964030686aabb2c829b674b046cbd75d244ba2b915500dd8d284a67
11. 0x042ed023614c046dfcee504f2fb14ba7df71bf698e682b1391b1905d7f519255
12. 0x4fbbcb97bbe92a4202db4cfe9ed5ce98ec76cb76473d9a37a3775c708528409e
13. 0x38f17e73d675dd35d0dd4a9f0ebd22a3333bcd28f96e42d5dd126e08211ffc4a
14. 0x4277e02be0b5d91d78bc2247e37d402572474ba896c2e8f45765c8dc4e244d36
15. 0x6f00f0da417f4126951ba8ba9b7962c847e91f5c61364ad9ad47e5f979698a60
16. 0x23cf9bb4337ee8be7fcae368fd69d24c62c11fb45882127b4cd919bb96a19996
17. 0x0e01aa9525097570a6edaf32bfc959de57bf5c24317cf10c0716affea85ca60d
18. 0xa20d48798a34aba12eb9c7297722982d910f06c148f5e27ac59307422964a585
19. 0x9fc354c0ea3efc3f1b6548bb77ea902a50f2c9647647ea61592efce2bd795699

Day root

0xdd77e5e99da32c3f154180d63e3c3e6fe11e896a2c6896412ef6b5c4bcf7e795

Chained

0x23bb4dfd09f55c15ac3962f53578e02c6114d5bfd9bb451cf8794fb6e2817ef4

Published

On Arc Testnet, block 69414147: 0xb2ebd83aafeb765a0ce66e76aefb133ed06606c98038fd56191e2bcd1dcb77b4