{"id":542669,"recorded_at":"2026-10-27T19:57:03.509066Z","observed_at":"2026-10-27T19:57:03.508947Z","subject_kind":"endpoint","subject":"b8b6b6bb-3800-48dd-9cbc-052940cd49b3","kind":"mcp.tools","method":"probe.mcp/1","body":{"count":13,"tools":[{"description":"Check up to 100 domains or IPv4 addresses at once against ThreatCluster's high-confidence 30-day IOC feed; each domain is resolved and its IPv4 matched too. IOC only (no ransomware-claim lookups; use threat_check for one domain). Stale feed returns an error and is not charged. Costs $0.50 USDC per call via x402 (payment goes in _meta[\"x402/payment\"]); invalid input or an upstream failure returns an error and is not charged.","inputSchema":{"$schema":"https://json-schema.org/draft/2020-12/schema","properties":{"items":{"description":"Up to 100 domains/IPv4, comma or newline separated","maxLength":20000,"minLength":1,"type":"string"}},"required":["items"],"type":"object"},"name":"bulk_threat_check"},{"description":"Check the TLS certificate of one hostname: issuer, validity dates, days left, % of lifetime used, renewal cadence and a renewal-stall flag, plus a live HTTPS pass/fail probe. Use it when you only need certificate health; use site_health for cert + DNS + expiry together, or domain_grade for a scored A-F result. Certificate details come from public Certificate Transparency logs (Cert Spotter, crt.sh fallback), not from the live connection, so a brand-new cert may not show yet. Read-only; makes one HTTPS request to the host and one CT-log query, usually 1-5 s. Costs $0.01 USDC per call via x402 (payment goes in _meta[\"x402/payment\"]); invalid input or an upstream failure returns an error and is not charged.","inputSchema":{"$schema":"https://json-schema.org/draft/2020-12/schema","properties":{"domain":{"description":"Hostname or URL, e.g. example.com or https://www.example.com/path","maxLength":300,"minLength":1,"type":"string"}},"required":["domain"],"type":"object"},"name":"check_cert"},{"description":"Look up the live DNS of a domain: NS, A/AAAA/CNAME, MX, SPF, DMARC, CAA (climbing to the parent zone) and DNSSEC status, with plain-English findings. Use it for a DNS inventory or to debug resolution; use check_email_auth for a deeper SPF/DMARC/DKIM/MTA-STS review. Queries Cloudflare DNS-over-HTTPS (1.1.1.1) at call time; read-only, nothing is stored. Costs $0.01 USDC per call via x402 (payment goes in _meta[\"x402/payment\"]); invalid input or an upstream failure returns an error and is not charged.","inputSchema":{"$schema":"https://json-schema.org/draft/2020-12/schema","properties":{"domain":{"description":"Hostname or URL, e.g. example.com or https://www.example.com/path","maxLength":300,"minLength":1,"type":"string"}},"required":["domain"],"type":"object"},"name":"check_dns"},{"description":"Check when a domain registration expires: registrar, registered and expiry dates, days left, EPP status codes and nameservers, from the registry's RDAP server. Use it for renewal risk on the registered domain (not the certificate; use check_cert for that). Some TLDs publish no RDAP service, in which case found=false explains why. Read-only. Costs $0.01 USDC per call via x402 (payment goes in _meta[\"x402/payment\"]); invalid input or an upstream failure returns an error and is not charged.","inputSchema":{"$schema":"https://json-schema.org/draft/2020-12/schema","properties":{"domain":{"description":"Hostname or URL, e.g. example.com or https://www.example.com/path","maxLength":300,"minLength":1,"type":"string"}},"required":["domain"],"type":"object"},"name":"check_domain_expiry"},{"description":"Review the email authentication setup of a domain: SPF validity and DNS-lookup count (limit 10), DMARC policy, pct and reporting, DKIM on common selector names, MTA-STS mode, TLS-RPT and BIMI, with a rough 0-100 score and plain-English fixes. Use it before sending mail from a domain or when mail lands in spam. DKIM is only checked on common selectors, so \"not found\" is not proof DKIM is missing. Live DNS via Cloudflare DoH; read-only, no email is sent. Costs $0.01 USDC per call via x402 (payment goes in _meta[\"x402/payment\"]); invalid input or an upstream failure returns an error and is not charged.","inputSchema":{"$schema":"https://json-schema.org/draft/2020-12/schema","properties":{"domain":{"description":"Hostname or URL, e.g. example.com or https://www.example.com/path","maxLength":300,"minLength":1,"type":"string"}},"required":["domain"],"type":"object"},"name":"check_email_auth"},{"description":"Check the HTTP security headers of a website with one live HTTPS GET: redirect chain (up to 5 hops), final status, HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy and COOP, with a simple A-F header grade and findings. Use it for web-hardening checks; it is not a vulnerability scan. The page body is not read or stored. Costs $0.01 USDC per call via x402 (payment goes in _meta[\"x402/payment\"]); invalid input or an upstream failure returns an error and is not charged.","inputSchema":{"$schema":"https://json-schema.org/draft/2020-12/schema","properties":{"domain":{"description":"Hostname or URL, e.g. example.com or https://www.example.com/path","maxLength":300,"minLength":1,"type":"string"}},"required":["domain"],"type":"object"},"name":"check_security_headers"},{"description":"Grade a domain's security posture A-F in one call, for vendor-risk or due-diligence checks. Runs the TLS, DNS (DNSSEC, CAA), registration-expiry, email-auth and HTTP-header checks and returns one letter, a 0-100 score, points per category (TLS 25, email 25, headers 20, DNS 15, registration 15) and the top fixes. Use it when you want a verdict; use site_health or the single checks when you need raw data. Unavailable categories are left out of the percentage (partial=true). Read-only; takes about 3-10 s. Costs $0.03 USDC per call via x402 (payment goes in _meta[\"x402/payment\"]); invalid input or an upstream failure returns an error and is not charged.","inputSchema":{"$schema":"https://json-schema.org/draft/2020-12/schema","properties":{"domain":{"description":"Hostname or URL, e.g. example.com or https://www.example.com/path","maxLength":300,"minLength":1,"type":"string"}},"required":["domain"],"type":"object"},"name":"domain_grade"},{"description":"Full site audit report for one domain, for client reports, vendor reviews or a pre-launch check. Runs every check (TLS from CT logs + live probe, DNS/DNSSEC/CAA, registration expiry and transfer lock, SPF/DMARC/DKIM/MTA-STS, security headers) plus HTTP->HTTPS redirect, www/apex consistency, RFC 9116 security.txt, robots.txt and sitemap. Returns the A-F grade and score (same weights as domain_grade), an action plan sorted critical > high > medium > low where each item has the exact fix and effort, and every raw section. Use domain_grade for just the letter. Fails (not charged) if 3+ core checks fail. Read-only; about 5-15 s. Costs $2 USDC per call via x402 (payment goes in _meta[\"x402/payment\"]); invalid input or an upstream failure returns an error and is not charged.","inputSchema":{"$schema":"https://json-schema.org/draft/2020-12/schema","properties":{"domain":{"description":"Hostname or URL, e.g. example.com or https://www.example.com/path","maxLength":300,"minLength":1,"type":"string"}},"required":["domain"],"type":"object"},"name":"full_site_audit"},{"description":"Free. Return the price of every paid tool, the payment network (Base) and the receiving address, so you can budget before calling. No input, no network request, no payment.","inputSchema":{"$schema":"https://json-schema.org/draft/2020-12/schema","properties":{},"type":"object"},"name":"pricing"},{"description":"Run check_cert, check_dns and check_domain_expiry together and return their raw results plus a short summary, the renewal-stall flag and the Let's Encrypt 64-day certificate note (from 2027-02-10). Use it for a full data dump in one call; use domain_grade if you want a single scored A-F answer that also covers email auth and HTTP headers. If one or two sources fail you get partial=true with the rest. Read-only. Costs $0.03 USDC per call via x402 (payment goes in _meta[\"x402/payment\"]); invalid input or an upstream failure returns an error and is not charged.","inputSchema":{"$schema":"https://json-schema.org/draft/2020-12/schema","properties":{"domain":{"description":"Hostname or URL, e.g. example.com or https://www.example.com/path","maxLength":300,"minLength":1,"type":"string"}},"required":["domain"],"type":"object"},"name":"site_health"},{"description":"Is this domain known-bad? Resolves the hostname (A/AAAA), matches the name, its parent domains and resolved IPv4 against ThreatCluster's high-confidence 30-day IOC feed (cached, refreshed about hourly), and looks up ransomware leak-site claims naming the domain (commercially reusable sources via Dragons Eye). Returns verdict listed, claimed, listed_and_claimed or no_known_threat with the matching reports. No match is not proof of safety; claims are unverified attacker assertions. Stale feed or source failure returns an error and is not charged. Costs $0.02 USDC per call via x402 (payment goes in _meta[\"x402/payment\"]); invalid input or an upstream failure returns an error and is not charged.","inputSchema":{"$schema":"https://json-schema.org/draft/2020-12/schema","properties":{"domain":{"description":"Hostname or URL, e.g. example.com or https://www.example.com/path","maxLength":300,"minLength":1,"type":"string"}},"required":["domain"],"type":"object"},"name":"threat_check"},{"description":"Free. Check that a domain or URL is well-formed and get the normalized hostname, before calling a paid check. Offline: no network request, no payment. Rejects IP addresses, single-label names and URLs with credentials.","inputSchema":{"$schema":"https://json-schema.org/draft/2020-12/schema","properties":{"domain":{"description":"Hostname or URL to normalize, e.g. example.com or https://www.example.com/path","maxLength":300,"type":"string"}},"required":["domain"],"type":"object"},"name":"validate_target"},{"description":"Free. Status of a paid domain watch (created with HTTP POST /v1/watch): items, expiry, last check, current DNS/IOC/claim state, last webhook delivery.","inputSchema":{"$schema":"https://json-schema.org/draft/2020-12/schema","properties":{"watch_id":{"description":"Watch id, e.g. ocw_abcdefghijklmnop","pattern":"^ocw_[a-z2-7]{16}$","type":"string"}},"required":["watch_id"],"type":"object"},"name":"watch_status"}]},"body_sha256":"ef60639e0881d9ff6e79bbe3569dcb6d5065eec6e8f3fb936e547a0aa476a96c","prev_id":null,"leaf":"0x20bc12468d002c2b21054a9e894933b5fba72c1d37b749add959de6f008007d7","leaf_text":"{\"body\":\"ef60639e0881d9ff6e79bbe3569dcb6d5065eec6e8f3fb936e547a0aa476a96c\",\"id\":542669,\"kind\":\"mcp.tools\",\"method\":\"probe.mcp/1\",\"observed_us\":1793131023508947,\"prev\":null,\"subject\":\"b8b6b6bb-3800-48dd-9cbc-052940cd49b3\",\"subject_kind\":\"endpoint\"}","day":{"day":"2026-10-27","leaves":273461,"root":"0xdd77e5e99da32c3f154180d63e3c3e6fe11e896a2c6896412ef6b5c4bcf7e795","chained":"0x23bb4dfd09f55c15ac3962f53578e02c6114d5bfd9bb451cf8794fb6e2817ef4","anchor_chain":"eip155:5042002","anchor_tx":"0xb2ebd83aafeb765a0ce66e76aefb133ed06606c98038fd56191e2bcd1dcb77b4","anchor_block":69414147},"proof":["0x20bbe2dbdb4c4f672f6fb82c9dbbed7ada0d6f0c7264fd194267f6be9ca940ab","0xfb6941b0126b72cc0d07bc0902ef9f24a5d922470957c45c4384426b0f1d8cf0","0x8cb2f45f4dffe37f37810cf11e55f3fac6a7828886a0d9e03e3aa2f2144a7073","0x51e5c9b5f2a76eaf655456246270bd18ae97e8b7b46bbe2aa9b476f42749f2d0","0x577a9af9bea9b5fd73b49cae31ebab92ba1769059e4350232034c71439e6a488","0xa177328c088f11ff8781be89612766df150aaad2afa3aeb67cc1bc4d7ab6be43","0x68826985269aa4887fc781e1abd98d1c5384eef3ec40fab883f5f223a781478f","0xa3f2150c92b13dca701b2460424613d1db6565fe54042cc7e3499243d4ca5975","0xebd2260d02ea2a82fb7040953a3c54037b1ea798b4c0388374dcd706c997f5ac","0x1b988ecad90134ffab61568269963f788ff682e879f6b40e10a928fd89837e2c","0x5b0b64ab1e36bf2ec3c04be82716d130476b3af9a60be0d19dcbdf8a3b7e3da9","0xd4460ea292e8308ed2accdcd5b386b0914636a5b8cec975011dff814c29ff99a","0x20ca24353b8aca3e061eedf55f49b69ae8369b88135dfdabf30039ed34db329a","0xe8ee6f6ed50253c5ee2d1aa85a4b1a38ce94bca7f3b72fd1850f496152dbe285","0xa383a1cfe9b3f6af67eb4c7642564b9424d46d7fca90e7ba175d549f8b67dd0c","0x52efa60e0c3d8525486d2310eb3b6b566c9677c64fd1f819edb072cf101bcbdb","0x22c1fb9487ee0b9732fa017a0cc321eb27a60c08450d112f755089796e12cb1c","0xa20d48798a34aba12eb9c7297722982d910f06c148f5e27ac59307422964a585","0x9fc354c0ea3efc3f1b6548bb77ea902a50f2c9647647ea61592efce2bd795699"]}