Evidence row 64685

What was observed

{
  "endpoints": [
    [
      "x402",
      "https://api.agentstools.dev/mcp/scan"
    ]
  ],
  "name": "mcp-scan",
  "owner_address": "0xf22e558a00d91ee12a1f50c52186fecb8ddff493",
  "raw": {
    "accepts": [
      {
        "amount": "10000",
        "asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
        "extra": {
          "name": "USD Coin",
          "version": "2"
        },
        "maxTimeoutSeconds": 300,
        "network": "eip155:8453",
        "payTo": "0xF22e558a00D91Ee12A1F50C52186FecB8dDFf493",
        "scheme": "exact"
      }
    ],
    "description": "Static security scan of an MCP manifest or tool list. Detects tool poisoning, hidden unicode instructions, prompt injection, data-exfiltration directives, dangerous capabilities, tool shadowing and post-approval rug-pull drift. Returns a 0-100 risk score, category, per-tool findings and content hashes. Security indicators, not a guarantee.",
    "extensions": {
      "bazaar": {
        "info": {
          "input": {
            "body": {
              "manifest": {
                "tools": [
                  {
                    "description": "Get the weather for a city.",
                    "inputSchema": {
                      "properties": {
                        "city": {
                          "type": "string"
                        }
                      },
                      "type": "object"
                    },
                    "name": "get_weather"
                  }
                ]
              }
            },
            "bodyType": "json",
            "method": "POST",
            "type": "http"
          },
          "output": {
            "example": {
              "coverage": {
                "dimensions_flagged": [],
                "dimensions_total": 8,
                "tools_scanned": 1
              },
              "disclaimer": "Automated security indicators, not a guarantee.",
              "findings": [],
              "manifest_hash": "sha256:…",
              "object": "manifest",
              "per_tool": {
                "get_weather": {
                  "category": "clean",
                  "findings": [],
                  "score": 0,
                  "tool_hash": "sha256:…"
                }
              },
              "reasons": [],
              "risk_category": "clean",
              "risk_score": 0,
              "tool_count": 1
            },
            "type": "json"
          }
        },
        "schema": {
          "$schema": "https://json-schema.org/draft/2020-12/schema",
          "properties": {
            "input": {
              "additionalProperties": false,
              "properties": {
                "body": {
                  "properties": {
                    "known_hashes": {
                      "description": "Optional map of tool name to a previously pinned tool_hash, to detect rug-pull drift",
                      "type": "object"
                    },
                    "manifest": {
                      "description": "MCP manifest object (with a tools list) or a single tool object",
                      "type": "object"
                    },
                    "tools": {
                      "description": "Alternatively, a list of tool objects (name, description, inputSchema)",
                      "items": {
                        "type": "object"
                      },
                      "type": "array"
                    }
                  }
                },
                "bodyType": {
                  "enum": [
                    "json",
                    "form-data",
                    "text"
                  ],
                  "type": "string"
                },
                "method": {
                  "enum": [
                    "POST",
                    "PUT",
                    "PATCH"
                  ],
                  "type": "string"
                },
                "type": {
                  "const": "http",
                  "type": "string"
                }
              },
              "required": [
                "type",
                "method",
                "bodyType",
                "body"
              ],
              "type": "object"
            },
            "output": {
              "properties": {
                "example": {
                  "type": "object"
                },
                "type": {
                  "type": "string"
                }
              },
              "required": [
                "type"
              ],
              "type": "object"
            }
          },
          "required": [
            "input"
          ],
          "type": "object"
        }
      }
    },
    "lastUpdated": "2026-10-08T06:08:38.293Z",
    "quality": {
      "l30DaysTotalCalls": 3,
      "l30DaysUniquePayers": 2,
      "lastCalledAt": "2026-10-08T06:08:38.04Z"
    },
    "resource": "https://api.agentstools.dev/mcp/scan",
    "serviceName": "mcp-scan",
    "tags": [
      "mcp",
      "security",
      "tool-poisoning",
      "prompt-injection",
      "scanner"
    ],
    "type": "http",
    "x402Version": 2
  },
  "source": "x402_bazaar",
  "summary": "Static security scan of an MCP manifest or tool list. Detects tool poisoning, hidden unicode instructions, prompt injection, data-exfiltration directives, dangerous capabilities, tool shadowing and post-approval rug-pull drift. Returns a 0-100 risk score, category, per-tool findings and content hashes. Security indicators, not a guarantee."
}

What the leaf hashes

{"body":"93f1b07f480bc5f71643e3a3495809298bc9ee8a988f00732f4b8a97b2259206","id":64685,"kind":"listing","method":"baseline/1","observed_us":1793025457159609,"prev":null,"subject":"x402_bazaar:https://api.agentstools.dev/mcp/scan","subject_kind":"source_record"}

Proof

Fold these into the leaf in order, hashing each sorted pair with keccak256, to reach the root of 2026-10-26 (296695 rows).

1. 0x544aef40a100a50462e71101b5b435b0a411f4f50f0f5504b2cdfed3fdc28c55
2. 0x90f85d58332e647757706f5bcf40e162c8e6a68fa5eb8fba3beb1ef59a5c05a5
3. 0x4610fdb1dd82cdef8d4842d4cffa2e030b62edf8857fa62c22b5e849d075d7a1
4. 0x01fecd2c7e145787e8c5691323eeda99a539c9ed42bdb376f702afe8544b29dc
5. 0xcac457cb1f34813a48622cf06166cffc1a5158132cafd0dff3304968366a2254
6. 0x2e1892743cf11175020880a2c750bb71d643a3a4deea8592b9682ac1c64cfc87
7. 0x681c928cf0dc6839d1fb705ea2508a9c479fb2d0af501f454a708fba2e8e4306
8. 0x0b38222ef6cdb87ace762836edd6c5ce4e905be4c60135d199fb0b285a532947
9. 0x40581d4b92f98d03f4d30c02fe130618ca6e557f88c320ec8e64c0093ec35134
10. 0xbe52a1de9424037e1e4260713fa281437aa5a001a2cf6c6f46bcd832ee5770bd
11. 0xec824c3c9c635c0935294afc42b42d41176d63a67e608b45abf49b05e262e664
12. 0x774d66905c34a786c6d34bf1c4491dbdb08f534c9eb5f76cf3de03385d28f388
13. 0xd830c52e1e8095e014510110592485afcb02b9c9a36f85653e4891a8de941246
14. 0x0733993143f0230e79482cef2c38e95d98f9eafbe64a43cdc74a4545938a4167
15. 0x2be1e80e065dd6b2cc75a7142be22225acd144ac975d70bf24b4f01fd76dc497
16. 0x2e6a32eb32761c210560e852405e2f865f958ddbe01027894f8b9c1b3433b9f0
17. 0x9a83be955a206deb65b995adfd92c58fa31c95fbbf926bd199d300e70b08b26d
18. 0x20704208aa6923d6b2450ef74ede87a6e0265d46447926038fe9506e9e154b2d
19. 0x9b9ce5b74b9bab5121612ef6b64920a8d453cbf311096a423eef9702747e868a

Day root

0xf43e8dcc3d451a4788b26be904c55e8c4c0fa75c9666796c51db38d37e2c0df8

Chained

0x702d5ac508f08b0d1accf36af25822d8e5660367494edd17a642fb61e158a57a

Published

On Arc Testnet, block 69251483: 0x495162f8936e19f0039918feebe6c307f327cd6bf8c37219620b1970041fa9ae