Every change Wellknown observed on this MCP server, newest first, with what it was before and what it became. Tool-surface changes carry the definition diff. Nothing here is edited after the fact.
Changed the definition of "create_free_key", "get_domain", "get_entity" and 6 more
⟨44 unchanged words⟩ usage survives IP changes. Limits: - 50 requests/day, counted per key rather than per IP (same endpointsas anonymous; anonymous,higherisceiling10/min and 100/day per IP). - One active free key per email; ⟨44 unchanged words⟩
⟨258 unchanged words⟩ (unknown TLD, unreachable). Cost: -FreeAnonymoustier(no key):included10/min,in100/day.50Freereq/daykey:limit.50/day. Pro/enterprise: included in plan. Latency: - Database ⟨16 unchanged words⟩
⟨182 unchanged words⟩ return `website` and `description` fields. Cost: -FreeAnonymoustier(no key):included10/min,in100/day.50Freereq/daykey:limit.50/day. Pro/enterprise: included in plan. Latency: - Typical ⟨3 unchanged words⟩
⟨5 unchanged words⟩ verdict per subject, aligned to input order.AThe batch is validated whole before anything is charged, run or signed: an empty or non-array `subjects`, or any invalid subject, failsthatthe entire batch with 400 `invalid_request` (the message names `subjects[i]`), and more than 50 subjects failsreturnsit with 413 `payload_too_large`. A `{ok:false, error}`inline;entry appears inline only when thebatchcheckneverfor an already-valid subject failsasataruntime;
⟨215 unchanged words⟩ Cost: - Free tier: up to 20results/pageresults/page. Anonymous (no key): 10/min,50100/day.req/day.Free key: 50/day. Pro/enterprise: up to 100results/page.results/page, included in plan. Latency: - Typical: <200ms, p99: <500ms.
⟨170 unchanged words⟩ Cost: - Free tier: up to 20results/pageresults/page. Anonymous (no key): 10/min,50100/day.req/day.Free key: 50/day. Pro/enterprise: up to 100results/page.results/page, included in plan. Latency: - Typical: <150ms, p99: <400ms.
⟨17 unchanged words⟩ key will return 401 on all subsequent calls.If you have an active Stripe subscription, you must separately cancel it at stripe.com — revoking the key does not cancel billing.Use this tool when: - You want ⟨63 unchanged words⟩ Returns: - `revoked`: true. - `note`:reminderconfirmationaboutthatStripethesubscriptionkeycancellation.is permanently revoked. Cost: - Free. Does not count against ⟨10 unchanged words⟩
⟨186 unchanged words⟩ capped at 20 per type. Cost: -FreeAnonymoustier(no key):included10/min,in100/day.50Freereq/day.key: 50/day. Pro/enterprise: included in plan. Latency: - Typical ⟨3 unchanged words⟩
⟨32 unchanged words⟩ @authority\" \"signature-agent\");created=1735689600;keyid=\"poqkLGiymh_W0uP6PZFw-dvez3QJT5SolqXBCW38r0U\";alg=\"ed25519\";expires=1735693200;tag=\;expires=1735689900;tag=\"web-bot-auth\"","type":"string"}}," ⟨7 unchanged words⟩
Added "ghostroute_batch_check" and "ghostroute_cert_lookup"; changed the definition of "cross_lens_verify", "ghostroute_verify", "preflight_should_i_act" and 4 more (102 tools before, 104 now)
⟨48 unchanged words⟩ (v1.0) commits to the verdict for long-termaudit.\naudit.\nWriting to an AIT requires `Authorization: Bearer\n<holder_secret>` (issued once at AIT registration);\nwithout it the call is 401, with a wrong one 403, and\nnothing is appended.\nBecause the bearer carries the holder secret, a `tm_live_`\nAPI key cannot be sent in the same call (it is checked as the\nholder secret and fails 403), and the call is rate-limited\nand audited as anonymous tier.\n","example":"AIT-0192f5d3-2c1e-7af6-bd84-9c4a3e8b7d12","type":"string ⟨120 unchanged words⟩
⟨50 unchanged words⟩ Changed the definition of "scan_mcp", "sigil_atap_register_ait", "sigil_atap_roll_block" and 2 more
⟨72 unchanged words⟩ does not follow links or enumerate other servers.LoopbackThe target must be https on port 443 or 8443 at a public hostname: IP literals (in any encoding), loopback / private /internalhosts/ special-use names, and credentials in the URL arerejected.rejected, and every redirect hop is checked against the same rules. Replies are read for at most 5 s and 1 MB. Use this tool when: - You are ⟨57 unchanged words⟩ body, required): the MCP server endpoint (http/httpshttps, port 443 or 8443). Returns: - `server`: `{ name, ⟨54 unchanged words⟩
Changed the definition of "get_pricing"
⟨43 unchanged words⟩ price a call without an API key pays.NoThedatabasescheduleoris the compiled-in default unless a validated override is held in KV (one KV read:, no database read); `schedule_source` says which. `band` is theschedulefloor and ceiling every tier price sits inside. `schedule_hash` iscompiledtheinto
Added "get_changes" (101 tools before, 102 now)
The change ledger, read back: what TunnelMind itself changed in the window, newest first, as one Ed25519-signed document. Use this tool when: - you need to know what changed in TunnelMind's site, prices, tools or operations, and want it signed rather than asserted. - you are checking whether a tool or price you rely on moved recently. Items come from receipts with lens `config`: the four recorded kinds plus `toolset_change` (derived from the tool registry; its `agent`, `class`, `reversible` and `revert_ref` are null). `truncated` is true when more rows exist than `limit`; `skipped` counts r…
Changed the definition of "get_analyst_config"
⟨263 unchanged words⟩ `graph_state` — live corpus counts at serve time (best-effort, any may be absent: `observations_total` from the scry stats cache, with `observations_as_of` = the ISO time that cached scry block was fetched, which may lag `as_of_ms` by up to the KV TTL (~30 days); `tracker_entities_total`, `sells_through_total`, `oai_registry_total` from Supabase estimated counts) - `references` — URLs to the rest of ⟨66 unchanged words⟩
Changed the definition of "sigil_verify_app_bundle"
⟨144 unchanged words⟩ | bad_response. Present only on the degraded path. When the relay was also tried and failed it is `<worker reason>+relay_<relay reason>`, e.g. `http_403+relay_timeout`. - `source` (iOS only): `worker` | `relay`. When the Worker's own iTunes lookup ends in http_403, http_429 or network_* and the relay is configured, the lookup is retried once through TunnelMind's relay; `relay` means the relay was consulted (success or failure). - `store_listing`: name, developer, developer_match, store_url.
Changed the definition of "sigil_verify_app_bundle"
⟨94 unchanged words⟩ Returns: - `verified`: true | false | null. null(notmeanscheckableoneonofthistwo things: the platform has no store API (confidence `low`, warning `no_store_api_available`), or the store lookup failed (confidence `degraded`, warning `store_api_unavailable`, with `reason`). - `reason`: why the store lookup failed — http_<status> | timeout | network_<error name> | bad_response. Present only on the degraded path. - `store_listing`: name, developer, developer_match, store_url.
Added "get_demand_aggregate", "get_pricing", "get_referral" and 2 more (96 tools before, 101 now)
Weekly public aggregate of demand: what callers asked this API for that it did not have or rejected (ghost routes, rejected arguments, ghost MCP tools, tools/list counts). One ISO week, Monday 00:00 UTC to the next Monday 00:00 UTC (`?week=` picks the week containing a date; default is the current week). Aggregate rows only: a row is published only when at least `n_threshold` (3) distinct actors produced it in the window. Rows below that are omitted, and their count is published in `suppressed` ({rows, events}). No actor identifier, IP, raw path, query string, timestamp or per-row user agent …
Spec 097 / ADR-035 Amendment C8. Returns the usage-tiered price schedule for paid calls. Prices are integer strings of USDC atomic units (6 decimals). Rows are `{tier, from, to, price_atomic}`; `to` is null for the open tier. `anonymous` is the price a call without an API key pays. No database or KV read: the schedule is compiled into the running Worker. `counting_rule`: the tier is set by settled paid calls per API key in the current UTC calendar month; a call without a key pays the top-tier price; a call counts only after a successful settle; the 402 response quotes the price of the caller…
For a capability TunnelMind does not provide itself, returns the destination's endpoint and schema URL from a reviewed catalog, plus facts TunnelMind itself observed: when its own probe last reached the destination, whether the destination advertises x402 or Web Bot Auth, and the origin ASN and RPKI state of the host. Every fact carries `{value, tier, source}` and a coverage state. The response carries a signed Receipt v1.0. The signature attests what TunnelMind recorded, not that the destination's claims are true. TunnelMind never calls the destination on your behalf and never carries your t…
Certificate changed, valid to 2026-12-19
Added "tollbooth_export", "tollbooth_sites" and "tollbooth_stats" (93 tools before, 96 now)
Free bulk read of the commons — the raw record is never paywalled. Every row is a tollbooth document exactly as its site signed it (Ed25519 over RFC 8785 JCS, key = the row's own `site`), wrapped in a `_commons` envelope naming the tier and vouching domain. Nothing in a row requires trusting TunnelMind. Use this tool when: - You want the raw record behind the stats, or to verify it yourself. - You are building your own exhibit or comparison over attested sites. Returns: - `rows[]`: `{_commons: {tier, domain, received_at}, receipt | snapshot}`. - `rows_returned`, `limit`, `capped` (true when…
Membership of the commons: every signing key that has reported, the domain that vouched for it (by serving the key in its /.well-known/tollbooth-site.json), and when it was last re-checked. Attested only by default; tier=all adds unattested keys with the domain they CLAIMED but that did not (yet) vouch for them. Use this tool when: - You want to know whose data is in the exhibit, or whether a given site reports. - You are verifying an export row's `site` key against a domain. Returns: - `sites[]`: site (public key), domain, status, attested_at, last_checked_at, first_seen_at. Cost: - Count…
The public read over the Conduct Log Commons: which agents knocked on attested tollbooth sites in the last 7 days, what they did when offered paid access, and what they would have paid. First-party monitors and credential-scanning recon are classified and EXCLUDED from the headline (reported separately, never conflated). Attested tier only — keys a domain has vouched for via /.well-known/tollbooth-site.json. Use this tool when: - You want to know how AI crawlers actually behave when a site asks them to pay. - You need the current commons membership (sites by tier) and the export pointers. R…
Certificate recorded, valid to 2026-10-21
Authorization not required
First tool surface recorded: 93 tools (server version 1.0.0)
Showing the latest 14 events. The API returns up to 500 and filters by kind: ?kind=tool_surface_changed
⟨31 unchanged words⟩ , chains a witness-tier\n`preflight:consulted` event onto theAIT.\nAIT. Requires\n`Authorization: Bearer <holder_secret>` (issued once at\nAIT registration); nothing is appended without it.\nBecause the bearer carries the holder secret, a `tm_live_`\nAPI key cannot be sent in the same call (it is checked as the\nholder secret and fails 403), and the call is rate-limited\nand audited as anonymous tier.\n","example":"AIT-0192f5d3-2c1e-7af6-bd84-9c4a3e8b7d12","type":"string ⟨71 unchanged words⟩
⟨14 unchanged words⟩ supply sources during campaign setup. Per-item parse failures (e.g. a bad domain) are returnedinline;inline,thewithbatchoneneverexception: afailsmalformedas`app_bundle`aidwhole.rejects the whole batch with 400. An optional `weights` object re-weights every entity in the call. Cost: - Each entity costs one rate-limit unit (the first is the request itself). A batch larger than the remaining budget is refused whole with 429 and charges nothing beyond that first unit, so the effective maximum per call is min(200, remaining + 1): anonymous 10/min, free 50/day, supporter 500/day, pro 5,000/day, enterprise unlimited.
⟨167 unchanged words⟩ }` for an invalid item. Cost: -CountsEachasitem costs one rate-limit unit (the first is the requestagainstitself). A batch larger than thedailyremainingratebudgetlimit.is refused whole with 429 and charges nothing beyond that first unit, so the effective maximum per call is min(100, remaining + 1): anonymous 10/min, free 50/day, supporter 500/day, pro 5,000/day, enterprise unlimited. Latency: - Typical: <150ms. With `resolve_chain: ⟨15 unchanged words⟩
⟨139 unchanged words⟩ , `recommendations`, `sigil_token` (signed, 5-minute lifetime). Overriding `weights` or `thresholds` still returns the score and verdict, but no token: `sigil_token` is null and `token_withheld` is `custom_scoring`.
{"properties":{"ait":{"description":"Optional ATAP AIT id (`AIT-<uuidv7>`). When present, the\n`sigil_token` is bound to the AIT and a witness-tier\n`supply:verified` / `supply:rejected` event is chained onto\nit (when publisher_domain, exchange and seller_id are all\ngiven). Requires `Authorization: Bearer <holder_secret>`\n(issued once at AIT registration); nothing is appended\nwithout it. With an AIT, a present publisher_domain /\nexchange must be a bare domain and seller_id 1-128\ncharacters, else 400.\nBecause the bearer carries the holder secret, a `tm_live_`\nAPI key cannot be sent in the same call (it is checked as the\nholder secret and fails 403), and the call is rate-limited\nand audited as anonymous tier.\n","example":"AIT-0192f5d3-2c1e-7af6-bd84-9c4a3e8b7d12","type":"string"},"buyer":{"description":"Optional. When present and ⟨164 unchanged words⟩
⟨267 unchanged words⟩ do not parse as a Web Bot Authsignature.signature, or the signature does not cover `@authority` and `signature-agent`, lacks `created`/`expires`, has a validity window over 300 s, or has a `created` more than 60 s in the future. - `replayed` — the signature verifies but was already seen (same keyid + nonce, or same signature) within its validity window. - `key_id`: the claimed RFC 7638 JWK ⟨60 unchanged words⟩
Batch form of `ghostroute_check`: one verdict per subject, aligned to input order. A subject that fails returns `{ok:false, error}` inline; the batch never fails as a whole. Use this tool when: - You need routing-integrity / sovereignty verdicts for many endpoints at once. Inputs: - `subjects` (body, required): 1-50 IPs, domains, ASNs (AS####) or cert hashes. - `receipt` (body, optional): when `true`, each verdict is a signed, persisted GhostRoute receipt. Returns: - `count`, `results[]` — each `{ok, subject, ...verdict}` (plus `receipt_id`, `signature` when receipts were requested). Cost…
Returns the five most recent CT certificate observations GhostRoute has recorded for a domain (issuer CA, its jurisdiction, validity), newest first. The certificate leg of the sovereignty check, on its own. Use this tool when: - You want to know which CA has been issuing certificates for a domain. - You are checking whether a domain's cert issuer sits in the jurisdiction it claims. Inputs: - `domain` (path, required): a hostname. Returns: - `domain`, `observations[]` (newest first, at most 5; empty when none recorded). Latency: - Typical <300ms (cached corpus read).
⟨2 unchanged words⟩ "description":"MCP server endpoint (Streamable-HTTP).httphttps only, port 443 orhttps.8443, public hostname.","format":"uri","type":"string ⟨4 unchanged words⟩
⟨46 unchanged words⟩ there is no kernel observer. See https://github.com/TunnelMind/atap-profiles. The response carries `holder_secret` **once** (32 random bytes, base64url; only its SHA-256 is stored). It is what every later write to this AIT — `sigil_atap_witness`, `sigil_atap_roll_block`, `sigil_receipt_generate` — must present as `Authorization: Bearer`. Lose it and the AIT is frozen; register a new one. `operator_status` is `asserted`: Sigil signs the AIT but does not verify that the holder controls the operator OAI it names.
⟨15 unchanged words⟩ a profile `period_summary`, chained onto the prior block. **Holder authentication (2026-10-16).** Writes to an AIT's chain require `Authorization: Bearer <holder_secret>`, the secret `sigil_atap_register_ait` returns once. 401 without it, 403 if it does not match. AITs registered before holder authentication have no secret and are frozen for writes (403): register a new AIT to continue.
⟨80 unchanged words⟩ that is what makes the `witnessed` tier non-bypassable. **Holder authentication (2026-10-16).** Writes to an AIT's chain require `Authorization: Bearer <holder_secret>`, the secret `sigil_atap_register_ait` returns once. 401 without it, 403 if it does not match. AITs registered before holder authentication have no secret and are frozen for writes (403): register a new AIT to continue.
⟨75 unchanged words⟩ or `asserted` and reports the anchored-bid coverage ratio. **Holder authentication (2026-10-16).** Writes to an AIT's chain require `Authorization: Bearer <holder_secret>`, the secret `sigil_atap_register_ait` returns once. 401 without it, 403 if it does not match. AITs registered before holder authentication have no secret and are frozen for writes (403): register a new AIT to continue.
Weekly public aggregate of demand: what callers asked this API for that it did not have or rejected on paid referrals (kinds referral and ghost_referral only). One ISO week, Monday 00:00 UTC to the next Monday 00:00 UTC (`?week=` picks the week containing a date; default is the current week). Aggregate rows only: a row is published only when at least `n_threshold` (3) distinct actors produced it in the window. Rows below that are omitted, and their count is published in `suppressed` ({rows, events}). No actor identifier, IP, raw path, query string, timestamp or per-row user agent is ever retu…
Spec 097 FR-010 / ADR-034. Returns the tool registry generated from openapi.yaml: one entry per operation with its version, status (active / deprecated / retired), lens and schema hash, plus the `registry_hash` over the whole set. Retired entries stay listed. No database read: the registry is compiled into the running Worker. Freshness: `observed_at` is the response time, `valid_until` is 24 hours later, `stale_if_error` is 86400 seconds. `deployed_at` is the Worker version timestamp, or null when the runtime does not expose it. Add `?receipt=true` for a signed Receipt v1.0 over the same pay…