Evidence row 751562

What was observed

{
  "endpoints": [
    [
      "x402",
      "https://api.agentstools.dev/mcp/scan"
    ]
  ],
  "name": "mcp-scan",
  "owner_address": "0xf22e558a00d91ee12a1f50c52186fecb8ddff493",
  "raw": {
    "accepts": [
      {
        "amount": "10000",
        "asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
        "extra": {
          "name": "USD Coin",
          "version": "2"
        },
        "maxTimeoutSeconds": 300,
        "network": "eip155:8453",
        "payTo": "0xF22e558a00D91Ee12A1F50C52186FecB8dDFf493",
        "scheme": "exact"
      }
    ],
    "description": "Static security scan of an MCP manifest or tool list. Detects tool poisoning, hidden unicode instructions, prompt injection, data-exfiltration directives, dangerous capabilities, tool shadowing and post-approval rug-pull drift. Returns a 0-100 risk score, category, per-tool findings and content hashes. Security indicators, not a guarantee.",
    "extensions": {
      "bazaar": {
        "info": {
          "input": {
            "body": {
              "manifest": {
                "tools": [
                  {
                    "description": "Get the weather for a city.",
                    "inputSchema": {
                      "properties": {
                        "city": {
                          "type": "string"
                        }
                      },
                      "type": "object"
                    },
                    "name": "get_weather"
                  }
                ]
              }
            },
            "bodyType": "json",
            "method": "POST",
            "type": "http"
          },
          "output": {
            "example": {
              "coverage": {
                "dimensions_flagged": [],
                "dimensions_total": 8,
                "tools_scanned": 1
              },
              "disclaimer": "Automated security indicators, not a guarantee.",
              "findings": [],
              "manifest_hash": "sha256:…",
              "object": "manifest",
              "per_tool": {
                "get_weather": {
                  "category": "clean",
                  "findings": [],
                  "score": 0,
                  "tool_hash": "sha256:…"
                }
              },
              "reasons": [],
              "risk_category": "clean",
              "risk_score": 0,
              "tool_count": 1
            },
            "type": "json"
          }
        },
        "schema": {
          "$schema": "https://json-schema.org/draft/2020-12/schema",
          "properties": {
            "input": {
              "additionalProperties": false,
              "properties": {
                "body": {
                  "properties": {
                    "known_hashes": {
                      "description": "Optional map of tool name to a previously pinned tool_hash, to detect rug-pull drift",
                      "type": "object"
                    },
                    "manifest": {
                      "description": "MCP manifest object (with a tools list) or a single tool object",
                      "type": "object"
                    },
                    "tools": {
                      "description": "Alternatively, a list of tool objects (name, description, inputSchema)",
                      "items": {
                        "type": "object"
                      },
                      "type": "array"
                    }
                  }
                },
                "bodyType": {
                  "enum": [
                    "json",
                    "form-data",
                    "text"
                  ],
                  "type": "string"
                },
                "method": {
                  "enum": [
                    "POST",
                    "PUT",
                    "PATCH"
                  ],
                  "type": "string"
                },
                "type": {
                  "const": "http",
                  "type": "string"
                }
              },
              "required": [
                "type",
                "method",
                "bodyType",
                "body"
              ],
              "type": "object"
            },
            "output": {
              "properties": {
                "example": {
                  "type": "object"
                },
                "type": {
                  "type": "string"
                }
              },
              "required": [
                "type"
              ],
              "type": "object"
            }
          },
          "required": [
            "input"
          ],
          "type": "object"
        }
      }
    },
    "lastUpdated": "2026-10-08T06:08:38.293Z",
    "quality": {
      "l30DaysTotalCalls": 2,
      "l30DaysUniquePayers": 2,
      "lastCalledAt": "2026-10-08T06:08:38.04Z"
    },
    "resource": "https://api.agentstools.dev/mcp/scan",
    "serviceName": "mcp-scan",
    "tags": [
      "mcp",
      "security",
      "tool-poisoning",
      "prompt-injection",
      "scanner"
    ],
    "type": "http",
    "x402Version": 2
  },
  "source": "x402_bazaar",
  "summary": "Static security scan of an MCP manifest or tool list. Detects tool poisoning, hidden unicode instructions, prompt injection, data-exfiltration directives, dangerous capabilities, tool shadowing and post-approval rug-pull drift. Returns a 0-100 risk score, category, per-tool findings and content hashes. Security indicators, not a guarantee."
}

What the leaf hashes

{"body":"7af9a3fe4ef80174f17bc0a5090f9ca75654ae3599209aa8877cd604481f3bf2","id":751562,"kind":"listing","method":"sync.x402_bazaar/1","observed_us":1793178757480837,"prev":64685,"subject":"x402_bazaar:https://api.agentstools.dev/mcp/scan","subject_kind":"source_record"}

Proof

Fold these into the leaf in order, hashing each sorted pair with keccak256, to reach the root of 2026-10-28 (231336 rows).

1. 0xc934379df7c92fb5ca801e13e72c5fa60461e9f66fd0e35623186214527d686e
2. 0xdadd48a82d6235f34366952a343036efe3301b50ab2be3e445a4e44242b025a7
3. 0x0a0ba4b81827f6aed5022aa365bd735bab6c1eba1fcf601a27fc0735ce32f609
4. 0xca0b68d802ef87cf24e13e4780ebc29b78c672d0c25b9c70448b6dbbc440920c
5. 0xb19141d0fc4b3aeda8f13b7cb9a569a4112f4fc22a0b621cfa7285210bd34a2c
6. 0x43bfb6dd4827b4fa9d395d0e2d8b50357863e71f75209e0dd21c38891d820f56
7. 0x252cacd34cc8b92789b3758572d166d37e6162d6808764b7e108128bfba5c41b
8. 0xb1bd3525f8dce6358024b859594f04f6e634b93dcc8e0d991eb96a6218928527
9. 0xe97d2ac0f924c6e05f781a2736a44114ac77e9ea20896111492760f3c47ca365
10. 0x5053ceadd4070277388526757a5547f2023610e0cc86241c8cb6ddf23e528037
11. 0x0304e075f912419d1549bfc8ade89c8822e77f71f26d1de34d37e1638dc4e79c
12. 0x4a243266328b748b77feea27d81730e25ab3bb67e7d665543bbf624e2632d6d3
13. 0x1f99df47306e7104ac9c626f7183c80611a0f90b978c68f0770fd8379ecbaeb9
14. 0x8e49280a62bd5d52127f332ab6aea9d7c57381f541e0178094a62272a9d2e741
15. 0x6d86d2282dd724b1b80d031e4e3cf9ed095b746e38c9e58d933efb597daff87f
16. 0x32beeeb960280bc48748681cb10297ede9403461fe9c8143fdf946548e552926
17. 0xe08e8bd91858a8a10c46ecde9c29a6288b960987303173c5e882afb46ce91fa0
18. 0xe6cfe00ae4e02bc12327e45b5f3334ea5850ba3bcc8e3101d30a8189856a95af

Day root

0x2c19037464cc4c493624565f01775d6446fc78eaa118fc6865bfe2bfca9ff78e

Chained

0xd1d7dee8322ceff8f4c8d83aa1fe4a4466825c2af1c97dbde3d35db61234f7be

Published

On Arc Testnet, block 69584042: 0x8bae2b1d097834c8b458513862d70d29ee807e98dc2e863b27250131c15b35ae