All servers · Marketing & SEO · Security · Monitoring & logs

TunnelMind Data API

ai.tunnelmind/data · v1.0.1

Measured by MCP Station

Instruction-like text was found in get_analyst_config, scan_injection. This is a pattern match, not a verdict. What we look for

Description written by the publisher, not verified

Tracker / Sigil / Cross-lens — every TunnelMind Data API operation as one MCP surface.

Connect

claude mcp add --transport http data https://mcp-data.tunnelmind.ai/mcp

{
  "mcpServers": {
    "data": {
      "url": "https://mcp-data.tunnelmind.ai/mcp"
    }
  }
}

Tools as reported by the server

• health_check
  Returns a minimal status object confirming the API is alive. Use this to verify connectivity before chaining other calls, or as a liveness check in a workflow. Use this tool when: - You need to verify the API is reachable before starting a multi-step investigation. - A prior call failed with a 503 o
• get_domain
  Returns the complete surveillance intelligence record for a domain name. If the domain is in TunnelMind's tracker database (80,000+ entries), the response includes tracker category, risk score, fingerprinting data, cookie persistence, IAB TCF purposes, and the owning corporate entity. If the domain
• list_domains
  Returns a paginated list of domains from the tracker database. Results are ordered alphabetically by domain name and support cursor-based pagination for full traversal. Filtering by category and minimum score allows targeted data extraction. Use this tool when: - You want to enumerate all known ad-t
• get_entity
  Returns an entity record for a surveillance company or data broker, including its industry, estimated annual data value per user (in USD), categories of personal data collected, and the full list of domains it controls. Free tier returns 5 domains, paid returns up to 200. Use this tool when: - You w
• list_entities
  Returns a paginated list of corporate entities in the TunnelMind surveillance database. Includes data categories, estimated data value, and industry classification. Useful for enumerating the surveillance ecosystem by sector. Use this tool when: - You want to enumerate all entities in a specific ind
• search
  Searches both the domains table and the entities table simultaneously. Returns matching domains (by domain name) and entities (by name or slug) in a single response. Minimum 2 characters, maximum 100 characters. Use this tool when: - You have a partial name and need to identify what tracker or entit
• intel_http
  Makes a live HEAD request to the target domain from the Cloudflare edge, follows up to 5 redirects, and returns the full redirect chain, final HTTP status, key response headers, a security header score, and any third-party surveillance actors referenced in the Content-Security-Policy header. Use thi
• intel_stack
  Fetches up to 32KB of the domain's HTML and response headers from the edge, then fingerprints the content for known CMS platforms, JavaScript frameworks, CDN providers, and analytics tools. Detection is based on meta generator tags, script src patterns, response headers, and cookie names. Use this t
• intel_robots
  Retrieves the target domain's `robots.txt` file and parses it for AI crawler disallow rules. Specifically detects policies for known AI crawlers (GPTBot, ClaudeBot, CCBot, Bytespider, etc.) and returns a structured summary of the crawling policy. Use this tool when: - You need to know whether a doma
• intel_agent
  Probes a domain for known AI agent integration signals: `llms.txt`, `ai.txt`, `/.well-known/ai-plugin.json`, `openapi.json`, `swagger.json`, MCP manifest, MCP SSE endpoint. Returns a score based on the count of signals detected. Use this to assess whether a domain is ready for agent-to-agent interac
• intel_inject
  Fetches a domain's homepage and checks for content patterns that could constitute prompt injection attacks against AI agents that visit and ingest the page. Signals include hidden text, invisible divs, `<!-- AI: ignore -->` style comments, and known injection patterns. Use this tool when: - You are
• intel_optout
  Checks a domain for all known AI training data opt-out mechanisms beyond robots.txt: TDM (Text and Data Mining) reservation headers, `<meta name="ai">` tags, Creative Commons NonCommercial licenses, and other machine-readable opt-out signals. Use this tool when: - You need to determine whether a dom
• get_receipt
  Returns metadata for a TunnelMind surveillance receipt — a signed document proving that a specific user's surveillance exposure was observed, measured, and recorded at a specific time. Does NOT return the receipt's signature (anti-phishing protection). To verify a receipt's content integrity, use `v
• verify_receipt
  Tamper-detection verification for TunnelMind surveillance receipts. Submit the receipt ID, the SHA-256 content hash, and the Ed25519 signature from the receipt document. The registry compares these against what was recorded at issuance time. Returns VALID if both match exactly, INVALID with a specif
• create_free_key
  Self-serve free tier — the rung between anonymous access and paid blocks. One email in, one API key out, shown exactly once. Use this tool when: - You are calling anonymously and hitting the anonymous rate limit. - You want your calls identified so usage survives IP changes. Limits: - 50 requests/da
• get_api_key
  Returns the tier, label, masked owner email, creation date, last-used timestamp, today's request count, and daily request limit for the API key used in this request. Useful for agents that need to monitor their own quota consumption. Use this tool when: - You want to check how many requests your key
• revoke_api_key
  Permanently deactivates the API key used to make this request. This action is irreversible. After revocation, the key will return 401 on all subsequent calls. Use this tool when: - You want to rotate your API key (revoke old, then provision a new one). - You believe your key has been compromised. Do
• get_task
  Returns the current status of a task created by an `?async=true` intel request. Poll this endpoint until `status` is one of: `complete`, `failed`, `cancelled`, `expired`. On `complete`, the `result` field contains the same payload the sync endpoint would have returned. On `failed`, `error.message` e
• cancel_task
  Marks the task as `cancelled`. If the task is already in a terminal state (`complete`, `failed`, `expired`), returns 409 Conflict. Only the identity that created the task may cancel it. Use this tool when: - You submitted a probe with `?async=true` and no longer need the result. - You want to free u
• stream_task
  Opens a persistent SSE connection that emits events as the task progresses. The stream closes automatically when the task reaches a terminal state or after ~90 seconds (timeout). Heartbeat comments are sent every ~15 seconds to keep the connection alive through proxies. Event types: - `status` — emi
• audit_export
  Returns NDJSON (one JSON object per line) of audit log entries. Each entry records the operation called, the identity, hashes of the request and response, duration, and an Ed25519 signature over the canonical entry JSON. Entries are hash-chained: each entry's `prev_entry_hash` is SHA-256 of the prev
• generate_receipt
  Looks up each submitted domain in the TunnelMind tracker database, aggregates risk metrics (avg score, max score, fingerprinters, high-risk domains, entity ownership), and issues a signed surveillance receipt. The receipt is stored in the public registry and can be verified at `/verify/{receipt_id}`
• sigil_verify_ads_txt
  Confirms whether an SSP/exchange is authorized to sell a publisher's inventory according to that publisher's ads.txt. This is a cache lookup against ads.txt files crawled daily across the top 10,000 publisher domains — it does NOT fetch the publisher's ads.txt live, so it is fast and adds no latency
• sigil_verify_ads_txt_batch
  Runs up to 100 ads.txt verifications in a single call — the endpoint an ad-buying agent uses for pre-bid checks across a whole campaign's supply. Each item is the same shape as `sigil_verify_ads_txt`. Per-item validation failures are reported inline; the batch never fails as a whole. Publisher recor
• traction
  Live traction numbers computed from sources the Worker owns: the hash-chained D1 audit log (7-day call volume, distinct identified callers, top operations), the stored-receipt table, and Stripe (succeeded charges → paying customers, gross USD). Ed25519-signed with the same attestation envelope as /v
• tollbooth_stats
  The public read over the Conduct Log Commons: which agents knocked on attested tollbooth sites in the last 7 days, what they did when offered paid access, and what they would have paid. First-party monitors and credential-scanning recon are classified and EXCLUDED from the headline (reported separat
• tollbooth_export
  Free bulk read of the commons — the raw record is never paywalled. Every row is a tollbooth document exactly as its site signed it (Ed25519 over RFC 8785 JCS, key = the row's own `site`), wrapped in a `_commons` envelope naming the tier and vouching domain. Nothing in a row requires trusting TunnelM
• tollbooth_sites
  Membership of the commons: every signing key that has reported, the domain that vouched for it (by serving the key in its /.well-known/tollbooth-site.json), and when it was last re-checked. Attested only by default; tier=all adds unattested keys with the domain they CLAIMED but that did not (yet) vo
• snapshot_manifest
  P4 corpus replication, the OPA "push data into the PDP" pattern. A daily snapshot of the domain corpus (domain, score, category, fingerprinting, entity) is published as deterministic JSONL with a manifest carrying row_count, sha256 over the exact bytes, a diff summary vs the previous day, and an Ed2
• snapshot_data
  The exact bytes the manifest's sha256 commits to. Content-Type `application/x-ndjson`; rows ordered by domain. Verify: `sha256(body) == manifest.sha256`.
• snapshot_diff
  JSONL diff vs the previous snapshot — apply +/~/- lines instead of re-pulling the corpus.
• status_history
  One sample per 20-minute monitor sweep. `uptime_pct` is the share of sweeps in which every fail point was green (the strictest read); `per_monitor` lists only monitors that failed at least once in the window. History begins at feature deploy and is never extrapolated backwards — an empty window retu
• get_self_view
  P83 Gate 1. The caller is the subject: every fact here comes from the TLS handshake and headers the caller has already sent, so there is no render, no browser, and nothing to authorize. Three surfaces: - `client` — user-agent, HTTP protocol, TLS version/cipher, ClientHello length, the pre-hashed JA3
• agent_registries_lookup
  P75 registry aggregation: the cross-lens join applied to agent identity. Incumbent providers each consult only their own registry; this endpoint checks every registry TunnelMind can reach and labels each answer with an explicit state, so a gap can never be mistaken for a clean result: - `observed` —
• verify_agent
  Reconciles a claimed bot User-Agent against the operator's OWN published IP-range feed (Googlebot, GPTBot, OAI-SearchBot, ChatGPT-User, PerplexityBot, Perplexity-User, Bingbot). A User-Agent is trivial to forge; membership in the operator's published CIDR ranges is not. This exposes the common attac
• verify_agent_signature
  Neutral third-party Web Bot Auth verification. An origin — or the PDP deciding for it — received a request from a claimed agent carrying the Web Bot Auth headers (Signature, Signature-Input, Signature-Agent). Relay those headers here, plus the authority the request was addressed to, and TunnelMind v
• create_subscription
  Subscribe to a node (ip, domain, asn, or entity slug). On a recurring sweep (~20 min) TunnelMind re-runs the fused `POST /v1/verify` verdict and, when the *material* result changes — the verdict label flips, the trust score crosses a band, or the signal set changes — POSTs a signed event to your `ca
• list_subscriptions
  Returns the caller's active and inactive subscriptions (signing_key redacted). Requires an API key.
• get_subscription
  Read one of your subscriptions (signing_key redacted).
• delete_subscription
  Cancel a subscription.
• receipt_log_sth
  P72 RFC 6962 transparency log over the unified receipt ledger (ADR-010). The STH commits to the entire log: `tree_size`, `root_hash` (`0x` + SHA-256), `timestamp`, and an Ed25519 signature (with `key_id` and embedded public key) over the RFC 8785 canonicalization of the body. Hashes only — receipt b
• receipt_log_inclusion_proof
  Proves a specific receipt (by unified `receipt_id`, lens alias, or raw `leaf_index`) is included in the tree at `tree_size` (default: the latest STH's). Returns `leaf_hash`, the `audit_path`, the recomputed `root_hash`, and the matching STH. What this proves: the receipt in your hand is byte-identic
• receipt_log_consistency_proof
  Proves the log at size `second` is an append-only extension of the log at size `first` — history was never rewritten. Returns both roots and the proof path. Verify offline with `scripts/verify-log.mjs consistency <proof.json>`.
• receipt_lookup
  P72 unified receipt ledger (ADR-010): every receipt-issuing surface (cross-lens verify, tracker verify, verdict, profile, explain, GhostRoute, Sigil/ATAP, compliance export) records the exact signed document it returned, keyed by one ID space. Use this tool when: - An agent holds a receipt and wants
• attributes_lookup
  P73 fast attributes endpoint (PIP-PLAN P3): a full `POST /v1/verify` resolve fans out across four lenses (~2s) — fine for preflight, fatal inside a per-request authorization loop. This endpoint serves the last-known signed bundle from a single KV read, with the P69 freshness contract deciding how mu
• tracker_verify
  The Tracker lens-owned verify surface: a per-node verdict over the normalized DDG Tracker Radar / IAB TCF / Disconnect.me corpus, with an optional signed TunnelMind Receipt v1.0. This is the single-lens ground truth the fused `POST /v1/verify` cites for its tracker block. Use this tool when: - You n
• sigil_verify_domain
  Confirms a publisher controls a domain by checking for a DNS TXT record the owner publishes under `_tunnelmind.{domain}`. A DNS record can only be set by whoever controls the zone, so its presence proves control — a stronger signal than ads.txt, which is just a file anything in the request path can
• sigil_verify_ip_type
  Classifies an IPv4 or IPv6 address by network type — the high-value ad-fraud signal being datacenter traffic posing as residential or living-room (CTV) devices. IP→ASN resolution uses Team Cymru's public service; the ASN is then classified by its registered organization name. It also cross-reference
• sigil_verify_adscert
  Reports whether a domain publishes ads.cert (IAB Tech Lab Authenticated Connections) DNS records — a readiness signal showing the domain supports cryptographically authenticated ad-tech connections. This is not signature verification: ads.cert is pairwise, so verifying a signed bid request requires
• sigil_verify_app_bundle
  Verifies that a mobile or CTV app bundle ID actually exists in the relevant app store — used to detect bundle spoofing in bid requests. Platform support (v1): - `ios`: verified live via Apple's iTunes Lookup API. - `android`: verified live via the Google Play store listing page. - `ctv_*` / `web`: n
• cross_lens_verify
  A2 — the cross-lens join. TunnelMind owns multiple halves of the open-web graph: Scry sees who is on every IP (attacker intelligence, actor class, Augur threat-intel overlap); Sigil sees the supply graph (publishers, SSPs, DSPs, ads.txt + sellers.json + SupplyChain Object); GhostRoute sees routing i
• cross_lens_lookup
  Returns all three lens views for a single node key without computing a fused verdict. Use this when you want raw transparency — the Tracker catalog presence, Scry attacker observations, and Sigil supply-graph position — and intend to make your own decision. For an opinionated verdict, call `cross_le
• verdict_lookup
  The reconciliation layer in one call. Where `cross_lens_verify` answers "what is this network destination," `verdict_lookup` answers a different, sharper question about a key-addressed ACTOR: **does what this key claims about itself match what the network has seen it do?** It fuses two sides: - **cl
• preflight_should_i_act
  The single call an agent makes before transacting with a destination on the open web. Composes the cross-lens verdict with a bounded Tracker-presence bonus, maps the adjusted trust score to a tri-state decision (`allow` / `caution` / `deny`), and returns a 5-minute signed consultation receipt (`sigi
• explain_verdict
  Call this when you need to ACT ON a verdict and prove why. It returns the exact verdict `/v1/verify/{node}` computes (same fusion, same weights) PLUS a traced evidence chain: every claim is attributed to where it came from — the attested sensor fleet (with attestation tier), a named Augur threat fee
• profile_entity
  Call this before routing traffic, bidding on inventory, or trusting a counterparty. It fuses ALL THREE TunnelMind lenses for one subject — Scry (attacker intelligence + threat feeds + open ports), Sigil (ad-supply-chain position + trust score + ATAP witness count), and Tracker (DDG/IAB catalog + pre
• signal_tracker_density
  Observed component counts first, a labelled derived roll-up second. The components — `data_categories`, supply-surface counts (ssp + publisher + dsp + owns_seat + buys_through), and corroborating `sources` — are facts. `derived.tracker_density` (0–100) is a weighted blend of those counts, not a meas
• signal_dark_pool_risk
  Reconciles every sell path a publisher declares (`sells_through`) against each SSP's own sellers.json (`exchange_seat`) and keeps three classes strictly separate: `corroborated` (seat present), `contradicted` (SSP crawled but seller_id absent — real risk), and `unchecked` (SSP not yet crawled — excl
• signal_halo_score
  Scores an entity by the trust character of its neighbours — the SSPs its publishers sell through and the DSPs it buys through. Reports neighbour counts, mean/min neighbour trust, and how many neighbours are adversary-classified (P46). `derived.halo_score` (0–100, or null when no neighbour has a comp
• signal_team_signal
  Surfaces other entities that operate as a coordinated team with this one: they share a NARROWLY-held direct seller account (2–8 entities — network house accounts shared by hundreds are separated into `house_accounts_excluded`, not counted) or co-own an exchange seat. `derived.team_signal` (0–100) is
• sigil_verify_supply_path
  The core Sigil pre-bid call. Submit a supply path; Sigil composes its individual checks into one trust verdict and returns a signed `sigil_token` the agent can attach to its bid as proof of verification. Checks composed: - `ads_txt` — exchange authorized in the publisher's ads.txt. - `datacenter_ip`
• sigil_verify_token
  Verifies the authenticity and expiry of a `sigil_token` returned by `sigil_verify_supply_path`. Anyone can call this — no key needed; Sigil verifies the Ed25519 signature server-side. Tokens live 5 minutes. Returns `valid` (boolean), `reason` (when invalid: malformed / expired / bad_signature / unsi
• sigil_verify_supply_chain
  The bid-time contract. Pass the SupplyChain object from an OpenRTB bid request (`source.ext.schain`) verbatim, plus the originating site domain or app bundle. Sigil verifies, per node and in aggregate: - origin ads.txt — the publisher's ads.txt authorizes node[0] (asi + sid). - per node — the node's
• sigil_traverse
  Reconstructs the supply paths for a publisher domain from Sigil's own crawl and returns them ITEMIZED — distinct from `sigil_verify_supply_chain` (which verifies a schain the caller brings) and from `signal_dark_pool_risk` (which returns only aggregate counts). Every SSP the publisher declares it se
• get_stats
  One public "state of the corpus" readout — the whole graph in a single call. Distinct from the Scry-only sensor stats at api.tunnelmind.ai/v1/stats (which this reuses for the `scry` block): this spans Scry, Sigil, and Tracker plus the attestation and routing layers. Use it to cite live coverage — ho
• get_website_history
  The over-time layer behind the site's website map (the radar's evolution). Every domain verify appends the domain's machinery tuple — origin AS, RPKI state, announced prefix, network country, CDN, certificate authority, registrar, owning entity, and the per-lens coverage tri-states — to an append-on
• get_freshness
  D4 — the freshness contract a PDP can gate on. For each lens (Scry / Sigil / Tracker / GhostRoute) this reports the newest observation timestamp in the corpus, the declared ingest cadence (taken from the ingester's own code and cron schedules, never asserted), the published SLO, the current corpus a
• get_tool_registry
  Spec 097 FR-010 / ADR-034. Returns the tool registry generated from openapi.yaml: one entry per operation with its version, status (active / deprecated / retired), lens and schema hash, plus the `registry_hash` over the whole set. Retired entries stay listed. No database read: the registry is compil
• get_pricing
  Spec 097 / ADR-035 Amendment C8. Returns the usage-tiered price schedule for paid calls. Prices are integer strings of USDC atomic units (6 decimals). Rows are `{tier, from, to, price_atomic}`; `to` is null for the open tier. `anonymous` is the price a call without an API key pays. The schedule is t
• get_demand_aggregate
  Weekly public aggregate of demand: what callers asked this API for that it did not have or rejected (ghost routes, rejected arguments, ghost MCP tools, tools/list counts). One ISO week, Monday 00:00 UTC to the next Monday 00:00 UTC (`?week=` picks the week containing a date; default is the current w
• get_changes
  The change ledger, read back: what TunnelMind itself changed in the window, newest first, as one Ed25519-signed document. Use this tool when: - you need to know what changed in TunnelMind's site, prices, tools or operations, and want it signed rather than asserted. - you are checking whether a tool
• get_referral_log
  Weekly public aggregate of demand: what callers asked this API for that it did not have or rejected on paid referrals (kinds referral and ghost_referral only). One ISO week, Monday 00:00 UTC to the next Monday 00:00 UTC (`?week=` picks the week containing a date; default is the current week). Aggreg
• get_referral
  For a capability TunnelMind does not provide itself, returns the destination's endpoint and schema URL from a reviewed catalog, plus facts TunnelMind itself observed: when its own probe last reached the destination, whether the destination advertises x402 or Web Bot Auth, and the origin ASN and RPKI
• ghostroute_check
  GhostRoute is TunnelMind's fourth lens: routing-integrity / sovereignty verification. It answers "is this infrastructure where it claims to be, owned by who it claims, routing where it says — and does that match the sovereign jurisdiction it asserts?" It resolves the originating ASN owner, RPKI vali
• ghostroute_verify
  Retrieves a previously-issued, signed GhostRoute receipt by its GR-YYYY-NNNNNNN id, for independent audit of a past sovereignty verdict. Use this tool when: - You hold a GhostRoute receipt id and want to confirm its contents/signature. - You are reconciling an agent's action log against the attestat
• ghostroute_asn_lookup
  Returns GhostRoute's ownership-graph record for an autonomous system: the registrant/parent organisation, its HQ country and sovereign zone, RIR, and cloud/AI-infrastructure flags. The long-term moat — who actually owns the network a route originates from. Use this tool when: - You have an origin AS
• ghostroute_cert_lookup
  Returns the five most recent CT certificate observations GhostRoute has recorded for a domain (issuer CA, its jurisdiction, validity), newest first. The certificate leg of the sovereignty check, on its own. Use this tool when: - You want to know which CA has been issuing certificates for a domain. -
• ghostroute_batch_check
  Batch form of `ghostroute_check`: one verdict per subject, aligned to input order. The batch is validated whole before anything is charged, run or signed: an empty or non-array `subjects`, or any invalid subject, fails the entire batch with 400 `invalid_request` (the message names `subjects[i]`), an
• ghostroute_ai_lookup
  Checks whether a domain or ASN belongs to a known AI company's infrastructure and what sovereignty it CLAIMS (program, zone, HQ), the baseline GhostRoute scores routing reality against. Use this tool when: - You want to know "whose AI infrastructure is this, and what does it claim?" - You are enrich
• ghostroute_ct_witness
  Returns GhostRoute's first-party Certificate-Transparency witness state: the latest signature-verified Signed Tree Head (STH) for every trusted, non-Google CT log TunnelMind independently witnesses, plus a regression scan over our own append-only history. Proof the platform holds its own signature-c
• ghostroute_ct_proofs
  Returns GhostRoute's per-cert inclusion proofs: each is a cryptographic demonstration that the exact certificate a host serves is included in an append-only CT log whose root TunnelMind signature-verified — upgrading "a monitor said this cert exists" to "proven in a log we witness". Failed attempts
• ghostroute_ct_alerts
  Returns the durable, deduplicated ledger of CT equivocation events the GhostRoute witness worker detects and pushes — a tree_size_rewind (an append-only log shrank), a root_fork (one tree_size witnessed with two different Merkle roots = a split-view log), or an sth_signature_invalid (a log's latest
• get_bgp_events
  Returns the routing anomalies the bgp-monitor has observed against TunnelMind's BGP watchlist — the witnessability layer's routing dimension. The monitor polls RIPEstat (RIPE NCC) on a cron, self-baselines each watched prefix's origin set on first sight, then records an event whenever a later poll d
• sigil_ads_txt_history
  Returns a publisher's ads.txt change log — one entry per crawl in which its authorized-seller set changed. A publisher quietly adding a reseller line is a real fraud signal; this is how a buyer audits supply over time. Inputs: - `domain` (path, required): publisher domain. - `since` (query, optional
• sigil_score_weights
  Returns the active, versioned default weights used to combine an entity's trust-score components, plus the list of spec components that are not yet evaluated. Pass a custom `weights` object to `sigil_score_batch` to re-weight without changing the defaults.
• sigil_score_entity
  Returns the pre-computed 0.0–1.0 trust score for one entity, its component breakdown, and the 14-day trend. Scores are refreshed daily by a database job — this endpoint never recomputes from raw data, so it is fast and deterministic. `entity_id` is `{entity_type}:{key}` — e.g. `publisher:nytimes.com
• sigil_score_batch
  Scores up to 200 entities in one round-trip — built for agents evaluating many supply sources during campaign setup. Per-item parse failures (e.g. a bad domain) are returned inline, with one exception: a malformed `app_bundle` id rejects the whole batch with 400. An optional `weights` object re-weig
• sigil_atap_register_ait
  Registers an ATAP v0.1 AIT for a media-buying agent under the `sigil:media_buyer:v1` profile. Sigil validates the capability set and constraints against the published profile, signs the AIT as the witness (`OAI-2026-0000201`), stores it, and returns the signed token. Sigil is the ATAP witness — ther
• sigil_atap_witness
  Ingests one agent-reported event (`bid:submitted`, `bid:won`, `bid:lost`, `budget:decremented`) into an AIT's hash-chained attestation log. Sigil validates the payload (rejecting any PII per ATAP §7.6), classifies the evidence tier — `anchored` if a `bid:submitted` cites a valid Sigil token issued f
• sigil_atap_roll_block
  Rolls every not-yet-blocked Witness Event for an AIT into one signed ATAP Attestation Block with a profile `period_summary`, chained onto the prior block. **Holder authentication (2026-10-16).** Writes to an AIT's chain require `Authorization: Bearer <holder_secret>`, the secret `sigil_atap_register
• sigil_atap_ait_status
  Returns an AIT's status, chain head hash, event count, pending-event count, per-tier event counts, and the anchored-bid coverage ratio.
• sigil_receipt_generate
  Assembles the ATAP v0.1 §7.5 Receipt ZIP for an AIT — the signed Receipt (`manifest.json`), the AIT, the Attestation Block chain, the witness public key, a tier-graded `summary.json`, the bundled `verify.sh` reference verifier, and the witness events + sigil_tokens as profile artifacts. Any pending
• compliance_profile
  Returns your current compliance configuration (regime, retention_days, export_formats, enabled) and the catalog of supported regimes (EU AI Act Art.12, DORA, NYDFS 500, HIPAA, PCI DSS, SOC 2, generic) and export formats (signed_json, csv, eat, stix). Authenticated. The compliance ledger is a tamper-
• compliance_configure
  Set the customizable knob: which regulatory regime your auditor maps to, how long to retain decision content, and which export formats to offer. Body: { enabled?, regime?, retention_days?, export_formats? }. retention_days is 1..3650; regime is one of the catalog ids; export_formats is a non-empty s
• compliance_ledger
  Returns your hash-chained decision records — one per verdict-bearing call (/v1/verify, /v1/explain, /v1/preflight, /v1/profile) made while compliance is enabled. Each entry carries its node, verdict, scores, receipt_id, the full decision record, and the chain hashes (prev_hash, entry_hash). Filter w
• compliance_export
  Generates a signed export bundle of your ledger over an optional time window, mapped to your regime's field names and citation, with a manifest + chain-integrity proof + the latest signed checkpoint. Choose the format with ?format= (signed_json | csv | eat | stix; defaults to your profile's first) a
• compliance_verify
  Recomputes your entire hash chain server-side and reports integrity ({ intact, entry_count, chain_head_hash } — plus reason + first_break_seq if a record was altered or deleted), alongside the most recent Ed25519 checkpoint signed with the TunnelMind receipt key. This is the auditor's "prove it" but
• get_analyst_config
  Returns the TunnelMind analyst config bundle. Configures any LLM (Claude, GPT, Gemini, local) to behave as a TunnelMind analyst that knows the data graph, follows the 5-call golden path, and surfaces attestation_tier on every claim. The bundle is signed inline (Ed25519, key_id from /.well-known/rece
• check_receipt_revoked
  Single-item revocation lookup per Receipt Format v1.0 §8.2. Verifiers that do not want to maintain a local mirror of `/.well-known/receipt-revocations.json` call this endpoint instead. The response includes `feed_version` for cache coherence. Use this tool when: - You are verifying a receipt and nee
• scan_injection
  Runs a curated signature corpus over a piece of untrusted text — content an agent is about to consume, a retrieved document, a tool result, an email body — and returns the matched injection patterns plus a bounded 0..1 risk score. This is a signal, never a policy decision: the caller decides what to
• scan_mcp
  Connect to a caller-supplied MCP server (Streamable-HTTP transport), read its advertised tools, and run the injection corpus over every tool name / description / input schema — plus a capability heuristic that flags broad, dangerous powers (shell execution, filesystem write, credential access, arbit
• submit_feedback
  Close the loop: after you acted on a TunnelMind verdict, tell us how it went. Reports aggregate per node into an advisory second opinion that any caller can read back via `GET /v1/feedback/{node}`. Advisory only. In v0 a negative aggregate does NOT silently lower the fused trust score — it's a human
• get_feedback
  Public read of the crowd-sourced outcome aggregate for a node — how callers reported their real-world results after acting on its verdict. Advisory signal, not a trust verdict. An empty aggregate returns cleanly with `total: 0` and `signal: none`. `signal` is derived: `none` (no reports), `insuffici
• x402_echo
  Validates an agent's x402 v1 client implementation against a TunnelMind surface end-to-end. Two operating modes: - `mode: "demo"` — HMAC over a nonce against a publicly-published secret. Does not move USDC. Smoke proves the WIRE works, not money movement. - `mode: "x402"` — real Coinbase facilitator

Tool changes

• 2026-10-22: health_check, get_domain, list_domains, get_entity, list_entities, search, intel_http, intel_stack, intel_robots, intel_agent, intel_inject, intel_optout
• 2026-10-18: health_check, get_domain, list_domains, get_entity, list_entities, search, intel_http, intel_stack, intel_robots, intel_agent, intel_inject, intel_optout
• 2026-10-18: health_check, get_domain, list_domains, get_entity, list_entities, search, intel_http, intel_stack, intel_robots, intel_agent, intel_inject, intel_optout
• 2026-10-16: health_check, get_domain, list_domains, get_entity, list_entities, search, intel_http, intel_stack, intel_robots, intel_agent, intel_inject, intel_optout

Website · JSON · Text for agents · Registry updated 2026-08-03