{"id":1257928,"recorded_at":"2026-10-30T16:23:43.158707Z","observed_at":"2026-10-30T16:23:43.158601Z","subject_kind":"endpoint","subject":"b0d2274f-944f-4b6d-b37e-14196116035f","kind":"mcp.tools","method":"probe.mcp/1","body":{"count":3,"tools":[{"description":"Free, offline. Call BEFORE running a shell/PowerShell command copied from a README, issue, website or chat: flags download-and-execute, encoded PowerShell, LOLBins, disabling antivirus, known malware domains and pipe-to-shell from unknown hosts.","inputSchema":{"properties":{"cmd":{"description":"command or text block","type":"string"}},"required":["cmd"],"type":"object"},"name":"check_command"},{"description":"Free, read-only. Call BEFORE following a GitHub repo's install/setup instructions or running its commands: scans the README for download-and-execute one-liners (iwr|iex, curl|sh from unknown hosts), obfuscated or base64 payloads, known malware domains, agent-targeted prompt injection, password-protected archives. Returns verdict dangerous | review_before_running | no_red_flags with line evidence. Paid full check (0.005 USDC via x402) adds package.json install scripts, typosquatted deps, install.sh/setup.py, .vscode autorun tasks and fake-star signals.","inputSchema":{"properties":{"repo":{"description":"github.com/owner/repo or owner/repo","type":"string"}},"required":["repo"],"type":"object"},"name":"check_repo"},{"description":"How to buy the full repo check via x402. Does not pay.","inputSchema":{"properties":{},"type":"object"},"name":"full_report_info"}]},"body_sha256":"7528a8a0170f45234034ec5f4479d596fdb44d3831b597532765a7e91a1619e0","prev_id":null,"leaf":"0x9ddd0344c4316e3a6944197cc6551d9a439eb0d0ba74980888e1d826c3646dcd","leaf_text":"{\"body\":\"7528a8a0170f45234034ec5f4479d596fdb44d3831b597532765a7e91a1619e0\",\"id\":1257928,\"kind\":\"mcp.tools\",\"method\":\"probe.mcp/1\",\"observed_us\":1793377423158601,\"prev\":null,\"subject\":\"b0d2274f-944f-4b6d-b37e-14196116035f\",\"subject_kind\":\"endpoint\"}","day":{"day":"2026-10-30","leaves":243099,"root":"0x0826c7ad6039e06a2360ca0a4a3a4fe7f2626c6dc19f71a37599386f78b39875","chained":"0x36b4c8a1063758f0b8765fa1bdf75fa92fb543cc183add3e261880ee2bd1f822","anchor_chain":"eip155:5042002","anchor_tx":"0x8704744146c6967c8abc9e9a99de4db7283b29e840922ea83a69b6fe776e6861","anchor_block":69923247},"proof":["0x9ddd23a1702b222e461c070ea850c60ecfa5fbfa86334d68b83c8a31f91c6955","0x0d9287d21498a60663cc3cb9b2cb6176c8bc80ded6541eb1392ba1d10e00720c","0x39db4ad179380cdfcbfaf15cc8b7a97aaadd826f5d324e5766241a1887018e52","0x6e73cab4d2a075f1778050e56f0a8ecbdac3ae8f6b37d040b72268bc78b022fd","0x2257afce8bdecf0099bf15c4548f41e8a0e6474f7fdab3268677a5cabc9779fe","0x62390cd39019b0d1186db477873196b4929a09bca9b2c95c4e21b22ba9ceba65","0x844243c49771d2450f6b9f60df5de7893be8e2569b1bb102287a21fefaa5c3b0","0x4bb0ee925ebb58a003551512da605e9c0021163a567a189f0200d3463f154a5b","0x927c771a565834c3527e4b29e5b18313b550459f347c5c419f212cba7f0c0fb4","0x9cf81070af02481f8af03ce1a039b27a892bba086bffc40c8abf7d8fb2e2c881","0xde70a2ccaa80cc0239ec3f715e1fc13f26b5ddcfab00063a85ee6705513e5b58","0xdedf30b66ee512346cf034daebce53fdbd82fa50d1fd252211d1926d97098963","0xd39f7d64cb3206788e8e31ad1bab3700ff64ebd64c54c91e909d88aa713d003e","0x1eeab2b7eb6c0e44e79a2d3d5d5f63d9c0f269f286347cee11c002d3e7c1c75b","0x11b43ed362a2fd4976e11eceb94ee4b7edbaf6823474ee1c36489f8f0a0496c4","0x835211170e79bdce1a823ec914e3532e128f77751e9074286da35091b0200284","0x61ef83255d34604cb052882568ca1d1386ac3cfb8284509715bc1734cff77831","0x0c43c73b62a5d49ee1444b5dc4195fc5b16b141d3f4458e2e9fbd5fd6ecb367d"]}