TunnelMind Data API
Tracker / Sigil / Cross-lens — every TunnelMind Data API operation as one MCP surface.
| Endpoint | https://mcp-data.tunnelmind.ai/mcp (streamable-http) |
|---|---|
| Registry version | 1.0.1 |
| Now | 104 tools · grade F (8) · pin ts_3b01e17023c22caa5d4672f35fc6c252 · protocol 2025-03-26 |
| First / last listed | 2026-10-25 06:21 UTC / 2026-10-25 06:21 UTC |
| Grade over time | 2026-10-25: F (8), 104 tools |
Is this your server? Own a server? ToolFit hosted watch re-checks it every 24 h ($0.25 per 30 days) or 6 h ($0.60) and sends you an HMAC-signed webhook when its tools or grade change: POST https://api.youraitools.co/toolfit/v1/watch. To opt out, see About & opt-out.
Tools: health_check get_domain list_domains get_entity list_entities search intel_http intel_stack intel_robots intel_agent intel_inject intel_optout get_receipt verify_receipt create_free_key get_api_key revoke_api_key get_task cancel_task stream_task audit_export generate_receipt sigil_verify_ads_txt sigil_verify_ads_txt_batch traction tollbooth_stats tollbooth_export tollbooth_sites snapshot_manifest snapshot_data snapshot_diff status_history get_self_view agent_registries_lookup verify_agent verify_agent_signature create_subscription list_subscriptions get_subscription delete_subscription receipt_log_sth receipt_log_inclusion_proof receipt_log_consistency_proof receipt_lookup attributes_lookup tracker_verify sigil_verify_domain sigil_verify_ip_type sigil_verify_adscert sigil_verify_app_bundle cross_lens_verify cross_lens_lookup verdict_lookup preflight_should_i_act explain_verdict profile_entity signal_tracker_density signal_dark_pool_risk signal_halo_score signal_team_signal sigil_verify_supply_path sigil_verify_token sigil_verify_supply_chain sigil_traverse get_stats get_website_history get_freshness get_tool_registry get_pricing get_demand_aggregate get_changes get_referral_log get_referral ghostroute_check ghostroute_verify ghostroute_asn_lookup ghostroute_cert_lookup ghostroute_batch_check ghostroute_ai_lookup ghostroute_ct_witness ghostroute_ct_proofs ghostroute_ct_alerts get_bgp_events sigil_ads_txt_history sigil_score_weights sigil_score_entity sigil_score_batch sigil_atap_register_ait sigil_atap_witness sigil_atap_roll_block sigil_atap_ait_status sigil_receipt_generate compliance_profile compliance_configure compliance_ledger compliance_export compliance_verify get_analyst_config check_receipt_revoked scan_injection scan_mcp submit_feedback get_feedback x402_echo
health_check | Returns a minimal status object confirming the API is alive. Use this to verify
connectivity before chaining other calls, or as a liveness check in a workflow.
Use this tool when:
- You need to verify the API is reachable before starting a multi-step investigation.
- A prior call failed with a 503 or 504 and you want to confirm the service recovered.
- You are debugging connectivity from a new en params: none |
get_domain | Returns the complete surveillance intelligence record for a domain name. If the
domain is in TunnelMind's tracker database (80,000+ entries), the response includes
tracker category, risk score, fingerprinting data, cookie persistence, IAB TCF
purposes, and the owning corporate entity. If the domain is not in the database,
a live probe is automatically run: RDAP registration data, DNS records (MX, params: domain* |
list_domains | Returns a paginated list of domains from the tracker database. Results are ordered
alphabetically by domain name and support cursor-based pagination for full traversal.
Filtering by category and minimum score allows targeted data extraction.
Use this tool when:
- You want to enumerate all known ad-tech or analytics domains above a risk threshold.
- You need a dataset of tracker domains for offlin params: category, min_score, limit, cursor |
get_entity | Returns an entity record for a surveillance company or data broker, including its
industry, estimated annual data value per user (in USD), categories of personal data
collected, and the full list of domains it controls. Free tier returns 5 domains,
paid returns up to 200.
Use this tool when:
- You want to understand what corporate entity owns or controls a tracker domain.
- You need to assess the params: slug* |
list_entities | Returns a paginated list of corporate entities in the TunnelMind surveillance
database. Includes data categories, estimated data value, and industry classification.
Useful for enumerating the surveillance ecosystem by sector.
Use this tool when:
- You want to enumerate all entities in a specific industry (e.g., all ad-tech companies).
- You need a dataset of surveillance entities for analysis or params: industry, limit, cursor |
search | Searches both the domains table and the entities table simultaneously. Returns
matching domains (by domain name) and entities (by name or slug) in a single
response. Minimum 2 characters, maximum 100 characters.
Use this tool when:
- You have a partial name and need to identify what tracker or entity it belongs to.
- You want to find all TunnelMind records related to a company name like "Google" params: q* |
intel_http | Makes a live HEAD request to the target domain from the Cloudflare edge, follows
up to 5 redirects, and returns the full redirect chain, final HTTP status, key
response headers, a security header score, and any third-party surveillance
actors referenced in the Content-Security-Policy header.
Use this tool when:
- You want to verify whether a site enforces HTTPS and HSTS.
- You need to inspect wha params: receipt, domain*, async |
intel_stack | Fetches up to 32KB of the domain's HTML and response headers from the edge, then
fingerprints the content for known CMS platforms, JavaScript frameworks, CDN
providers, and analytics tools. Detection is based on meta generator tags, script
src patterns, response headers, and cookie names.
Use this tool when:
- You need to know what CMS (WordPress, Drupal, Shopify) a site runs.
- You are assessing params: receipt, domain*, async |
intel_robots | Retrieves the target domain's `robots.txt` file and parses it for AI crawler
disallow rules. Specifically detects policies for known AI crawlers (GPTBot,
ClaudeBot, CCBot, Bytespider, etc.) and returns a structured summary of the
crawling policy.
Use this tool when:
- You need to know whether a domain has opted out of AI training data collection.
- You want to check if a specific AI crawler is bl params: receipt, domain*, async |
intel_agent | Probes a domain for known AI agent integration signals: `llms.txt`, `ai.txt`,
`/.well-known/ai-plugin.json`, `openapi.json`, `swagger.json`, MCP manifest, MCP
SSE endpoint. Returns a score based on the count of signals detected. Use this to
assess whether a domain is ready for agent-to-agent interaction.
Use this tool when:
- You want to know whether a domain exposes an MCP server or OpenAPI spec params: receipt, domain*, async |
intel_inject | Fetches a domain's homepage and checks for content patterns that could constitute
prompt injection attacks against AI agents that visit and ingest the page. Signals
include hidden text, invisible divs, `<!-- AI: ignore -->` style comments, and
known injection patterns.
Use this tool when:
- You are vetting a domain before feeding its content into an LLM context.
- You want to assess the prompt in params: receipt, domain*, async |
intel_optout | Checks a domain for all known AI training data opt-out mechanisms beyond robots.txt:
TDM (Text and Data Mining) reservation headers, `<meta name="ai">` tags, Creative
Commons NonCommercial licenses, and other machine-readable opt-out signals.
Use this tool when:
- You need to determine whether a domain has opted out of AI training data collection.
- You are checking compliance before using a doma params: receipt, domain*, async |
get_receipt | Returns metadata for a TunnelMind surveillance receipt — a signed document proving
that a specific user's surveillance exposure was observed, measured, and recorded at
a specific time. Does NOT return the receipt's signature (anti-phishing protection).
To verify a receipt's content integrity, use `verify_receipt` with the hash and
signature from the receipt document itself.
Use this tool when:
- params: receipt_id* |
verify_receipt | Tamper-detection verification for TunnelMind surveillance receipts. Submit the
receipt ID, the SHA-256 content hash, and the Ed25519 signature from the receipt
document. The registry compares these against what was recorded at issuance time.
Returns VALID if both match exactly, INVALID with a specific mismatch reason otherwise.
Use this tool when:
- You received a surveillance receipt document an params: receipt_id*, content_hash*, signature* |
create_free_key | Self-serve free tier — the rung between anonymous access and paid
blocks. One email in, one API key out, shown exactly once.
Use this tool when:
- You are calling anonymously and hitting the anonymous rate limit.
- You want your calls identified so usage survives IP changes.
Limits:
- 50 requests/day, counted per key rather than per IP (same endpoints
as anonymous; anonymous is 10/min and 100/ params: email* |
get_api_key | Returns the tier, label, masked owner email, creation date, last-used timestamp,
today's request count, and daily request limit for the API key used in this request.
Useful for agents that need to monitor their own quota consumption.
Use this tool when:
- You want to check how many requests your key has used today.
- You need to know your current tier or daily limit.
- You want to confirm that yo params: none |
revoke_api_key | Permanently deactivates the API key used to make this request. This action is
irreversible. After revocation, the key will return 401 on all subsequent calls.
Use this tool when:
- You want to rotate your API key (revoke old, then provision a new one).
- You believe your key has been compromised.
Do NOT use this tool when:
- You want to check quota — use `get_api_key` instead.
- You intend to ke params: none |
get_task | Returns the current status of a task created by an `?async=true` intel request.
Poll this endpoint until `status` is one of: `complete`, `failed`, `cancelled`,
`expired`. On `complete`, the `result` field contains the same payload the sync
endpoint would have returned. On `failed`, `error.message` explains the failure.
Use this tool when:
- You submitted an intel probe with `?async=true` and need params: task_id* |
cancel_task | Marks the task as `cancelled`. If the task is already in a terminal state
(`complete`, `failed`, `expired`), returns 409 Conflict. Only the identity
that created the task may cancel it.
Use this tool when:
- You submitted a probe with `?async=true` and no longer need the result.
- You want to free up a pending task before it expires.
Do NOT use this tool when:
- The task is already complete — ca params: task_id* |
stream_task | Opens a persistent SSE connection that emits events as the task progresses.
The stream closes automatically when the task reaches a terminal state or after
~90 seconds (timeout). Heartbeat comments are sent every ~15 seconds to keep
the connection alive through proxies.
Event types:
- `status` — emitted when status changes (pending → running → complete/failed)
- `result` — emitted on `complete` w params: task_id* |
audit_export | Returns NDJSON (one JSON object per line) of audit log entries. Each entry records
the operation called, the identity, hashes of the request and response, duration,
and an Ed25519 signature over the canonical entry JSON. Entries are hash-chained:
each entry's `prev_entry_hash` is SHA-256 of the previous entry's signature,
making deletion of any entry detectable offline.
Authenticated callers rece params: from, to, limit |
generate_receipt | Looks up each submitted domain in the TunnelMind tracker database, aggregates risk
metrics (avg score, max score, fingerprinters, high-risk domains, entity ownership),
and issues a signed surveillance receipt. The receipt is stored in the public registry
and can be verified at `/verify/{receipt_id}`.
Use this tool when:
- You want a verifiable record of which trackers were observed in a context ( params: domains, domain |
sigil_verify_ads_txt | Confirms whether an SSP/exchange is authorized to sell a publisher's
inventory according to that publisher's ads.txt. This is a cache lookup
against ads.txt files crawled daily across the top 10,000 publisher
domains — it does NOT fetch the publisher's ads.txt live, so it is fast
and adds no latency to a real-time bidding decision.
Use this tool when:
- You are an ad-buying agent and want to conf params: receipt, publisher_domain*, exchange_domain*, seller_id*, seller_type, resolve_chain |
sigil_verify_ads_txt_batch | Runs up to 100 ads.txt verifications in a single call — the endpoint an
ad-buying agent uses for pre-bid checks across a whole campaign's supply.
Each item is the same shape as `sigil_verify_ads_txt`. Per-item
validation failures are reported inline; the batch never fails as a
whole. Publisher records are fetched once per unique domain.
Use this tool when:
- You are evaluating many supply paths a params: items*, resolve_chain |
traction | Live traction numbers computed from sources the Worker owns: the
hash-chained D1 audit log (7-day call volume, distinct identified
callers, top operations), the stored-receipt table, and Stripe
(succeeded charges → paying customers, gross USD). Ed25519-signed
with the same attestation envelope as /v1/status so the numbers can
be replayed to an auditor.
Use this tool when:
- You are evaluating whe params: none |
tollbooth_stats | The public read over the Conduct Log Commons: which agents knocked on
attested tollbooth sites in the last 7 days, what they did when offered
paid access, and what they would have paid. First-party monitors and
credential-scanning recon are classified and EXCLUDED from the headline
(reported separately, never conflated). Attested tier only — keys a
domain has vouched for via /.well-known/tollbooth params: none |
tollbooth_export | Free bulk read of the commons — the raw record is never paywalled. Every
row is a tollbooth document exactly
as its site signed it (Ed25519 over RFC 8785 JCS, key = the row's own
`site`), wrapped in a `_commons` envelope naming the tier and vouching
domain. Nothing in a row requires trusting TunnelMind.
Use this tool when:
- You want the raw record behind the stats, or to verify it yourself.
- Yo params: day, kind, tier, limit, format |
tollbooth_sites | Membership of the commons: every signing key that has reported, the
domain that vouched for it (by serving the key in its
/.well-known/tollbooth-site.json), and when it was last re-checked.
Attested only by default; tier=all adds unattested keys with the domain
they CLAIMED but that did not (yet) vouch for them.
Use this tool when:
- You want to know whose data is in the exhibit, or whether a giv params: tier |
snapshot_manifest | P4 corpus replication, the OPA "push data into the PDP" pattern. A
daily snapshot of the domain corpus (domain, score, category,
fingerprinting, entity) is published as deterministic JSONL with a
manifest carrying row_count, sha256 over the exact bytes, a diff
summary vs the previous day, and an Ed25519-signed Receipt v1.0
committed to the transparency log — a PDP that replicates the data
can veri params: date* |
snapshot_data | The exact bytes the manifest's sha256 commits to. Content-Type
`application/x-ndjson`; rows ordered by domain. Verify:
`sha256(body) == manifest.sha256`.
params: date* |
snapshot_diff | JSONL diff vs the previous snapshot — apply +/~/- lines instead of re-pulling the corpus. params: date* |
status_history | One sample per 20-minute monitor sweep. `uptime_pct` is the share of
sweeps in which every fail point was green (the strictest read);
`per_monitor` lists only monitors that failed at least once in the
window. History begins at feature deploy and is never extrapolated
backwards — an empty window returns `uptime_pct: null`, not 100.
params: days |
get_self_view | P83 Gate 1. The caller is the subject: every fact here comes from the
TLS handshake and headers the caller has already sent, so there is no
render, no browser, and nothing to authorize.
Three surfaces:
- `client` — user-agent, HTTP protocol, TLS version/cipher, ClientHello
length, the pre-hashed JA3/JA4 input components, header order.
- `state` — how many cookies were sent (never their values), params: receipt |
agent_registries_lookup | P75 registry aggregation: the cross-lens join applied to agent identity.
Incumbent providers each consult only their own registry; this endpoint
checks every registry TunnelMind can reach and labels each answer with
an explicit state, so a gap can never be mistaken for a clean result:
- `observed` — the subject IS in this registry (record attached)
- `not_present` — checked, and it isn't (an obse params: subject*, receipt |
verify_agent | Reconciles a claimed bot User-Agent against the operator's OWN published
IP-range feed (Googlebot, GPTBot, OAI-SearchBot, ChatGPT-User,
PerplexityBot, Perplexity-User, Bingbot). A User-Agent is trivial to
forge; membership in the operator's published CIDR ranges is not. This
exposes the common attack: a scraper sending `User-Agent: Googlebot` from
an IP in none of Google's ranges.
Use this tool w params: ip*, ua |
verify_agent_signature | Neutral third-party Web Bot Auth verification. An origin — or the PDP
deciding for it — received a request from a claimed agent carrying the
Web Bot Auth headers (Signature, Signature-Input, Signature-Agent).
Relay those headers here, plus the authority the request was addressed
to, and TunnelMind verifies the Ed25519 signature against the agent's
own published key directory
(https://<agent>/.well params: signature*, signature_input*, signature_agent*, authority*, method, path, scheme |
create_subscription | Subscribe to a node (ip, domain, asn, or entity slug). On a recurring
sweep (~20 min) TunnelMind re-runs the fused `POST /v1/verify` verdict and,
when the *material* result changes — the verdict label flips, the trust
score crosses a band, or the signal set changes — POSTs a signed event to
your `callback_url`.
Webhook authenticity: every delivery carries an `X-TunnelMind-Signature:
sha256=<hex>` params: node*, callback_url*, events |
list_subscriptions | Returns the caller's active and inactive subscriptions (signing_key redacted). Requires an API key. params: none |
get_subscription | Read one of your subscriptions (signing_key redacted). params: id* |
delete_subscription | Cancel a subscription. params: id* |
receipt_log_sth | P72 RFC 6962 transparency log over the unified receipt ledger
(ADR-010). The STH commits to the entire log: `tree_size`, `root_hash`
(`0x` + SHA-256), `timestamp`, and an Ed25519 signature (with `key_id`
and embedded public key) over the RFC 8785 canonicalization of the
body. Hashes only — receipt bodies are never on this surface.
Verify offline with `scripts/verify-log.mjs sth` (zero TunnelMind
params: none |
receipt_log_inclusion_proof | Proves a specific receipt (by unified `receipt_id`, lens alias, or raw
`leaf_index`) is included in the tree at `tree_size` (default: the
latest STH's). Returns `leaf_hash`, the `audit_path`, the recomputed
`root_hash`, and the matching STH. What this proves: the receipt in
your hand is byte-identical to the one sequenced into the log — not
that the observation inside it was correct (ADR-010).
Ve params: receipt_id, leaf_index, tree_size |
receipt_log_consistency_proof | Proves the log at size `second` is an append-only extension of the log
at size `first` — history was never rewritten. Returns both roots and
the proof path. Verify offline with
`scripts/verify-log.mjs consistency <proof.json>`.
params: first*, second* |
receipt_lookup | P72 unified receipt ledger (ADR-010): every receipt-issuing surface
(cross-lens verify, tracker verify, verdict, profile, explain,
GhostRoute, Sigil/ATAP, compliance export) records the exact signed
document it returned, keyed by one ID space.
Use this tool when:
- An agent holds a receipt and wants to confirm TunnelMind logged it
(existence + canonical hash) before trusting it in an audit trai params: id* |
attributes_lookup | P73 fast attributes endpoint (PIP-PLAN P3): a full `POST /v1/verify`
resolve fans out across four lenses (~2s) — fine for preflight, fatal
inside a per-request authorization loop. This endpoint serves the
last-known signed bundle from a single KV read, with the P69 freshness
contract deciding how much to trust it.
Use this tool when:
- A policy decision point (OPA, Cerbos, Cedar) needs node attri params: node* |
tracker_verify | The Tracker lens-owned verify surface: a per-node verdict over the
normalized DDG Tracker Radar / IAB TCF / Disconnect.me corpus, with an
optional signed TunnelMind Receipt v1.0. This is the single-lens ground
truth the fused `POST /v1/verify` cites for its tracker block.
Use this tool when:
- You need to know whether a domain is tracking/surveillance infrastructure
and which entity operates it params: node*, receipt |
sigil_verify_domain | Confirms a publisher controls a domain by checking for a DNS TXT record
the owner publishes under `_tunnelmind.{domain}`. A DNS record can only
be set by whoever controls the zone, so its presence proves control — a
stronger signal than ads.txt, which is just a file anything in the
request path can serve.
Use this tool when:
- You want proof a publisher actually owns the domain it claims.
- You a params: domain* |
sigil_verify_ip_type | Classifies an IPv4 or IPv6 address by network type — the high-value ad-fraud
signal being datacenter traffic posing as residential or living-room
(CTV) devices. IP→ASN resolution uses Team Cymru's public service; the
ASN is then classified by its registered organization name.
It also cross-references the Scry attacker-observation corpus to detect
anonymizing EGRESS — the thing a rotating-resident params: ip* |
sigil_verify_adscert | Reports whether a domain publishes ads.cert (IAB Tech Lab Authenticated
Connections) DNS records — a readiness signal showing the domain
supports cryptographically authenticated ad-tech connections. This is
not signature verification: ads.cert is pairwise, so verifying a signed
bid request requires Sigil to be a delegated participant (a future
build). DNS-only and stateless.
Inputs:
- `domain` (q params: domain* |
sigil_verify_app_bundle | Verifies that a mobile or CTV app bundle ID actually exists in the
relevant app store — used to detect bundle spoofing in bid requests.
Platform support (v1):
- `ios`: verified live via Apple's iTunes Lookup API.
- `android`: verified live via the Google Play store listing page.
- `ctv_*` / `web`: no public store API — returns verified=null.
Inputs:
- `bundle_id` (body, required): e.g. `com.nyti params: bundle_id*, platform*, claimed_developer |
cross_lens_verify | A2 — the cross-lens join. TunnelMind owns multiple halves of the
open-web graph: Scry sees who is on every IP (attacker intelligence,
actor class, Augur threat-intel overlap); Sigil sees the supply graph
(publishers, SSPs, DSPs, ads.txt + sellers.json + SupplyChain Object);
GhostRoute sees routing integrity & sovereignty (RPKI origin validity,
BGP prefix, claimed sovereign zone, sanctions, AI-infr params: node*, weights, thresholds, claimed_zone, ait |
cross_lens_lookup | Returns all three lens views for a single node key without computing a
fused verdict. Use this when you want raw transparency — the Tracker
catalog presence, Scry attacker observations, and Sigil supply-graph
position — and intend to make your own decision. For an opinionated
verdict, call `cross_lens_verify` instead. For an agent-side
allow/caution/deny gate plus signed consultation receipt, call params: node* |
verdict_lookup | The reconciliation layer in one call. Where `cross_lens_verify` answers
"what is this network destination," `verdict_lookup` answers a different,
sharper question about a key-addressed ACTOR: **does what this key claims
about itself match what the network has seen it do?**
It fuses two sides:
- **claim** — what the key can prove about itself: its `attestation_tier`
across roots of trust (bare E params: key*, subject, nonce, sig, eat, claims |
preflight_should_i_act | The single call an agent makes before transacting with a destination
on the open web. Composes the cross-lens verdict with a bounded
Tracker-presence bonus, maps the adjusted trust score to a tri-state
decision (`allow` / `caution` / `deny`), and returns a 5-minute signed
consultation receipt (`sigil_token` with `sub: preflight:consulted`).
The receipt is the load-bearing artifact: the agent atta params: node*, intent, agent_id, thresholds, ait |
explain_verdict | Call this when you need to ACT ON a verdict and prove why. It returns the
exact verdict `/v1/verify/{node}` computes (same fusion, same weights)
PLUS a traced evidence chain: every claim is attributed to where it came
from — the attested sensor fleet (with attestation tier), a named Augur
threat feed, sellers.json/ads.txt supply-graph presence, the cross-lens
co-observation join, the DDG/IAB track params: node* |
profile_entity | Call this before routing traffic, bidding on inventory, or trusting a
counterparty. It fuses ALL THREE TunnelMind lenses for one subject —
Scry (attacker intelligence + threat feeds + open ports), Sigil
(ad-supply-chain position + trust score + ATAP witness count), and
Tracker (DDG/IAB catalog + prevalence + categories) — into a single
confidence-scored profile plus a signed P38 receipt.
The `cro params: ip, domain, entity |
signal_tracker_density | Observed component counts first, a labelled derived roll-up second. The
components — `data_categories`, supply-surface counts (ssp + publisher +
dsp + owns_seat + buys_through), and corroborating `sources` — are facts.
`derived.tracker_density` (0–100) is a weighted blend of those counts, not
a measurement; `data_cost_usd` is deliberately excluded (non-zero only for
a curated seed, so weighting by params: entity_slug* |
signal_dark_pool_risk | Reconciles every sell path a publisher declares (`sells_through`) against
each SSP's own sellers.json (`exchange_seat`) and keeps three classes
strictly separate: `corroborated` (seat present), `contradicted` (SSP
crawled but seller_id absent — real risk), and `unchecked` (SSP not yet
crawled — excluded from risk, lowers confidence). Combined with
publisher-side ads.txt opacity. Two-sided corrobor params: domain* |
signal_halo_score | Scores an entity by the trust character of its neighbours — the SSPs its
publishers sell through and the DSPs it buys through. Reports neighbour
counts, mean/min neighbour trust, and how many neighbours are
adversary-classified (P46). `derived.halo_score` (0–100, or null when no
neighbour has a computed trust) is mean neighbour trust dragged down by
adversary-neighbour share. Evidence about an ent params: entity_slug* |
signal_team_signal | Surfaces other entities that operate as a coordinated team with this one:
they share a NARROWLY-held direct seller account (2–8 entities — network
house accounts shared by hundreds are separated into
`house_accounts_excluded`, not counted) or co-own an exchange seat.
`derived.team_signal` (0–100) is a coordination magnitude over teammate
count, shared-account breadth, and co-owned seats.
params: entity_slug* |
sigil_verify_supply_path | The core Sigil pre-bid call. Submit a supply path; Sigil composes its
individual checks into one trust verdict and returns a signed
`sigil_token` the agent can attach to its bid as proof of verification.
Checks composed:
- `ads_txt` — exchange authorized in the publisher's ads.txt.
- `datacenter_ip` — is the IP a datacenter posing as a real user.
- `fraud_signals` — is the IP in Scry's attacker-i params: receipt, supply_path*, weights, thresholds, ait, buyer |
sigil_verify_token | Verifies the authenticity and expiry of a `sigil_token` returned by
`sigil_verify_supply_path`. Anyone can call this — no key needed; Sigil
verifies the Ed25519 signature server-side. Tokens live 5 minutes.
Returns `valid` (boolean), `reason` (when invalid: malformed / expired /
bad_signature / unsigned), and the decoded `payload`.
params: token* |
sigil_verify_supply_chain | The bid-time contract. Pass the SupplyChain object from an OpenRTB bid
request (`source.ext.schain`) verbatim, plus the originating site domain
or app bundle. Sigil verifies, per node and in aggregate:
- origin ads.txt — the publisher's ads.txt authorizes node[0] (asi + sid).
- per node — the node's `asi` sellers.json declares the node's `sid`.
- owner-domain — node[0]'s sellers.json seller `doma params: site_domain, app_bundle, schain*, buyer |
sigil_traverse | Reconstructs the supply paths for a publisher domain from Sigil's own
crawl and returns them ITEMIZED — distinct from `sigil_verify_supply_chain`
(which verifies a schain the caller brings) and from `signal_dark_pool_risk`
(which returns only aggregate counts). Every SSP the publisher declares it
sells through is joined to that SSP's identity and classified two-sided
against the SSP's sellers.json params: domain*, limit |
get_stats | One public "state of the corpus" readout — the whole graph in a single
call. Distinct from the Scry-only sensor stats at
api.tunnelmind.ai/v1/stats (which this reuses for the `scry` block): this
spans Scry, Sigil, and Tracker plus the attestation and routing layers.
Use it to cite live coverage — how many publishers / SSPs / DSPs / sell
paths / sellers.json seats are in the Sigil supply graph, ho params: none |
get_website_history | The over-time layer behind the site's website map (the radar's
evolution). Every domain verify appends the domain's machinery tuple
— origin AS, RPKI state, announced prefix, network country, CDN,
certificate authority, registrar, owning entity, and the per-lens
coverage tri-states — to an append-only change-log, one row per
observed change (plus a daily heartbeat row per looked-up domain).
Hones params: domain* |
get_freshness | D4 — the freshness contract a PDP can gate on. For each lens (Scry /
Sigil / Tracker / GhostRoute) this reports the newest observation
timestamp in the corpus, the declared ingest cadence (taken from the
ingester's own code and cron schedules, never asserted), the published
SLO, the current corpus age in seconds, and whether the SLO holds.
GhostRoute reports its three corpus workers (CT hourly, RP params: none |
get_tool_registry | Spec 097 FR-010 / ADR-034. Returns the tool registry generated from
openapi.yaml: one entry per operation with its version, status
(active / deprecated / retired), lens and schema hash, plus the
`registry_hash` over the whole set. Retired entries stay listed.
No database read: the registry is compiled into the running Worker.
Freshness: `observed_at` is the response time, `valid_until` is 24 hour params: receipt |
get_pricing | Spec 097 / ADR-035 Amendment C8. Returns the usage-tiered price schedule
for paid calls. Prices are integer strings of USDC atomic units
(6 decimals). Rows are `{tier, from, to, price_atomic}`; `to` is null for
the open tier. `anonymous` is the price a call without an API key pays.
The schedule is the compiled-in default unless a validated override is held
in KV (one KV read, no database read); `s params: receipt |
get_demand_aggregate | Weekly public aggregate of demand: what callers asked this API for that it
did not have or rejected (ghost routes, rejected arguments, ghost MCP tools, tools/list counts). One ISO week, Monday 00:00 UTC to the next Monday
00:00 UTC (`?week=` picks the week containing a date; default is the current
week). Aggregate rows only: a row is published only when at least
`n_threshold` (3) distinct actors p params: week, receipt |
get_changes | The change ledger, read back: what TunnelMind itself changed in the window,
newest first, as one Ed25519-signed document.
Use this tool when:
- you need to know what changed in TunnelMind's site, prices, tools or operations, and want it signed rather than asserted.
- you are checking whether a tool or price you rely on moved recently.
Items come from receipts with lens `config`: the four recorde params: days, kind, limit |
get_referral_log | Weekly public aggregate of demand: what callers asked this API for that it
did not have or rejected on paid referrals (kinds referral and ghost_referral only). One ISO week, Monday 00:00 UTC to the next Monday
00:00 UTC (`?week=` picks the week containing a date; default is the current
week). Aggregate rows only: a row is published only when at least
`n_threshold` (3) distinct actors produced it i params: week, receipt |
get_referral | For a capability TunnelMind does not provide itself, returns the destination's
endpoint and schema URL from a reviewed catalog, plus facts TunnelMind
itself observed: when its own probe last reached the destination, whether the
destination advertises x402 or Web Bot Auth, and the origin ASN and RPKI state
of the host. Every fact carries `{value, tier, source}` and a coverage state.
The response ca params: capability*, X-PAYMENT |
ghostroute_check | GhostRoute is TunnelMind's fourth lens: routing-integrity / sovereignty
verification. It answers "is this infrastructure where it claims to be,
owned by who it claims, routing where it says — and does that match the
sovereign jurisdiction it asserts?" It resolves the originating ASN owner,
RPKI validity, the certificate-issuing CA's jurisdiction, and matches the
subject against a curated AI-infras params: entity*, receipt |
ghostroute_verify | Retrieves a previously-issued, signed GhostRoute receipt by its
GR-YYYY-NNNNNNN id, for independent audit of a past sovereignty verdict.
Use this tool when:
- You hold a GhostRoute receipt id and want to confirm its contents/signature.
- You are reconciling an agent's action log against the attestation layer.
Inputs:
- `receipt_id` (path, required): GR-YYYY-NNNNNNN.
Returns:
- Owner (the authen params: receipt_id* |
ghostroute_asn_lookup | Returns GhostRoute's ownership-graph record for an autonomous system: the
registrant/parent organisation, its HQ country and sovereign zone, RIR,
and cloud/AI-infrastructure flags. The long-term moat — who actually owns
the network a route originates from.
Use this tool when:
- You have an origin ASN and need its corporate owner + jurisdiction.
- You are assessing whether an ASN belongs to a clou params: asn* |
ghostroute_cert_lookup | Returns the five most recent CT certificate observations GhostRoute has
recorded for a domain (issuer CA, its jurisdiction, validity), newest
first. The certificate leg of the sovereignty check, on its own.
Use this tool when:
- You want to know which CA has been issuing certificates for a domain.
- You are checking whether a domain's cert issuer sits in the jurisdiction it claims.
Inputs:
- `do params: domain* |
ghostroute_batch_check | Batch form of `ghostroute_check`: one verdict per subject, aligned to
input order. The batch is validated whole before anything is charged,
run or signed: an empty or non-array `subjects`, or any invalid subject,
fails the entire batch with 400 `invalid_request` (the message names
`subjects[i]`), and more than 50 subjects fails it with 413
`payload_too_large`. A `{ok:false, error}` entry appears i params: subjects*, receipt |
ghostroute_ai_lookup | Checks whether a domain or ASN belongs to a known AI company's
infrastructure and what sovereignty it CLAIMS (program, zone, HQ), the
baseline GhostRoute scores routing reality against.
Use this tool when:
- You want to know "whose AI infrastructure is this, and what does it claim?"
- You are enriching an endpoint before deciding whether to send it inference.
Inputs:
- `entity` (path, required): params: entity* |
ghostroute_ct_witness | Returns GhostRoute's first-party Certificate-Transparency witness state:
the latest signature-verified Signed Tree Head (STH) for every trusted,
non-Google CT log TunnelMind independently witnesses, plus a regression
scan over our own append-only history. Proof the platform holds its own
signature-checked roots rather than reselling crt.sh/certspotter.
Use this tool when:
- You want corpus-wide C params: none |
ghostroute_ct_proofs | Returns GhostRoute's per-cert inclusion proofs: each is a cryptographic
demonstration that the exact certificate a host serves is included in an
append-only CT log whose root TunnelMind signature-verified — upgrading
"a monitor said this cert exists" to "proven in a log we witness". Failed
attempts are included with a `reason`; a cert that suddenly cannot be
proven is itself a signal.
Use this to params: domain, limit |
ghostroute_ct_alerts | Returns the durable, deduplicated ledger of CT equivocation events the
GhostRoute witness worker detects and pushes — a tree_size_rewind (an
append-only log shrank), a root_fork (one tree_size witnessed with two
different Merkle roots = a split-view log), or an sth_signature_invalid
(a log's latest Signed Tree Head failed signature verification). Where
`/v1/ghostroute/witness` shows live computed params: limit |
get_bgp_events | Returns the routing anomalies the bgp-monitor has observed against
TunnelMind's BGP watchlist — the witnessability layer's routing
dimension. The monitor polls RIPEstat (RIPE NCC) on a cron, self-baselines
each watched prefix's origin set on first sight, then records an event
whenever a later poll deviates from that baseline.
Use this to check whether a prefix or ASN you depend on (an SSP's egres params: resource, since_ms, limit |
sigil_ads_txt_history | Returns a publisher's ads.txt change log — one entry per crawl in which
its authorized-seller set changed. A publisher quietly adding a reseller
line is a real fraud signal; this is how a buyer audits supply over time.
Inputs:
- `domain` (path, required): publisher domain.
- `since` (query, optional): ISO date / date-time lower bound on `observed_at`.
- `limit` (query, optional): max entries — de params: domain*, since, limit |
sigil_score_weights | Returns the active, versioned default weights used to combine an
entity's trust-score components, plus the list of spec components that
are not yet evaluated. Pass a custom `weights` object to
`sigil_score_batch` to re-weight without changing the defaults.
params: none |
sigil_score_entity | Returns the pre-computed 0.0–1.0 trust score for one entity, its
component breakdown, and the 14-day trend. Scores are refreshed daily
by a database job — this endpoint never recomputes from raw data, so it
is fast and deterministic.
`entity_id` is `{entity_type}:{key}` — e.g. `publisher:nytimes.com` or
`ssp:pubmatic.com`. Entity types: `publisher`, `ssp`, `dsp`,
`app_bundle` (publishers and SSPs params: entity_id*, weights |
sigil_score_batch | Scores up to 200 entities in one round-trip — built for agents
evaluating many supply sources during campaign setup. Per-item parse
failures (e.g. a bad domain) are returned inline, with one exception:
a malformed `app_bundle` id rejects the whole batch with 400.
An optional `weights` object re-weights every entity in the call.
Cost:
- Each entity costs one rate-limit unit (the first is the requ params: entity_ids*, weights |
sigil_atap_register_ait | Registers an ATAP v0.1 AIT for a media-buying agent under the
`sigil:media_buyer:v1` profile. Sigil validates the capability set and
constraints against the published profile, signs the AIT as the witness
(`OAI-2026-0000201`), stores it, and returns the signed token.
Sigil is the ATAP witness — there is no kernel observer. See
https://github.com/TunnelMind/atap-profiles.
The response carries `ho params: profile*, operator*, agent_type, capabilities*, constraints*, attestation_policy*, expires_at* |
sigil_atap_witness | Ingests one agent-reported event (`bid:submitted`, `bid:won`,
`bid:lost`, `budget:decremented`) into an AIT's hash-chained
attestation log. Sigil validates the payload (rejecting any PII per
ATAP §7.6), classifies the evidence tier — `anchored` if a
`bid:submitted` cites a valid Sigil token issued for this AIT and
matching the bid's supply path, otherwise `asserted` — derives any
`constraint:viola params: ait*, event_type*, payload* |
sigil_atap_roll_block | Rolls every not-yet-blocked Witness Event for an AIT into one signed
ATAP Attestation Block with a profile `period_summary`, chained onto the
prior block.
**Holder authentication (2026-10-16).** Writes to an AIT's chain require
`Authorization: Bearer <holder_secret>`, the secret `sigil_atap_register_ait`
returns once. 401 without it, 403 if it does not match. AITs registered
before holder authent params: ait* |
sigil_atap_ait_status | Returns an AIT's status, chain head hash, event count, pending-event
count, per-tier event counts, and the anchored-bid coverage ratio.
params: id* |
sigil_receipt_generate | Assembles the ATAP v0.1 §7.5 Receipt ZIP for an AIT — the signed
Receipt (`manifest.json`), the AIT, the Attestation Block chain, the
witness public key, a tier-graded `summary.json`, the bundled
`verify.sh` reference verifier, and the witness events + sigil_tokens
as profile artifacts. Any pending events are rolled into a final block
first.
The ZIP verifies offline — unpack it and run `verify.sh params: ait*, format |
compliance_profile | Returns your current compliance configuration (regime, retention_days,
export_formats, enabled) and the catalog of supported regimes (EU AI Act
Art.12, DORA, NYDFS 500, HIPAA, PCI DSS, SOC 2, generic) and export
formats (signed_json, csv, eat, stix). Authenticated. The compliance
ledger is a tamper-evident, retained record of every verdict you make —
configure it once, then it self-maintains.
params: none |
compliance_configure | Set the customizable knob: which regulatory regime your auditor maps to,
how long to retain decision content, and which export formats to offer.
Body: { enabled?, regime?, retention_days?, export_formats? }. retention_days
is 1..3650; regime is one of the catalog ids; export_formats is a non-empty
subset of [signed_json, csv, eat, stix]. No bespoke engineering — you pick,
the ledger adapts.
params: enabled, regime, retention_days, export_formats |
compliance_ledger | Returns your hash-chained decision records — one per verdict-bearing call
(/v1/verify, /v1/explain, /v1/preflight, /v1/profile) made while compliance
is enabled. Each entry carries its node, verdict, scores, receipt_id, the
full decision record, and the chain hashes (prev_hash, entry_hash). Filter
with from/to (ISO8601) and page with cursor (a seq) + limit (≤1000).
params: from, to, cursor, limit |
compliance_export | Generates a signed export bundle of your ledger over an optional time
window, mapped to your regime's field names and citation, with a manifest
+ chain-integrity proof + the latest signed checkpoint. Choose the format
with ?format= (signed_json | csv | eat | stix; defaults to your profile's
first) and override the regime with ?regime=. The response is a downloadable
artifact your auditor can verif params: format, regime, from, to |
compliance_verify | Recomputes your entire hash chain server-side and reports integrity
({ intact, entry_count, chain_head_hash } — plus reason + first_break_seq
if a record was altered or deleted), alongside the most recent Ed25519
checkpoint signed with the TunnelMind receipt key. This is the auditor's
"prove it" button — and even TunnelMind cannot rewrite history before a
signed checkpoint without detection.
params: none |
get_analyst_config | Returns the TunnelMind analyst config bundle. Configures any LLM
(Claude, GPT, Gemini, local) to behave as a TunnelMind analyst that
knows the data graph, follows the 5-call golden path, and surfaces
attestation_tier on every claim.
The bundle is signed inline (Ed25519, key_id from
/.well-known/receipt-signing-key.json). Add `?receipt=true` to wrap
the response in a Receipt v1.0 envelope for end- params: surface, version, receipt |
check_receipt_revoked | Single-item revocation lookup per Receipt Format v1.0 §8.2. Verifiers that
do not want to maintain a local mirror of `/.well-known/receipt-revocations.json`
call this endpoint instead. The response includes `feed_version` for cache
coherence.
Use this tool when:
- You are verifying a receipt and need to confirm its `signature.key_id` is still trusted.
- You are verifying a receipt and need to con params: key_id, id |
scan_injection | Runs a curated signature corpus over a piece of untrusted text — content
an agent is about to consume, a retrieved document, a tool result, an
email body — and returns the matched injection patterns plus a bounded
0..1 risk score. This is a signal, never a policy decision: the caller
decides what to do with a flagged input.
Detected classes: instruction_override (ignore/override previous rules),
params: text* |
scan_mcp | Connect to a caller-supplied MCP server (Streamable-HTTP transport),
read its advertised tools, and run the injection corpus over every tool
name / description / input schema — plus a capability heuristic that
flags broad, dangerous powers (shell execution, filesystem write,
credential access, arbitrary network, destructive DB ops). Returns a
per-tool safety report. A caution to review, never a ve params: url* |
submit_feedback | Close the loop: after you acted on a TunnelMind verdict, tell us how it
went. Reports aggregate per node into an advisory second opinion that any
caller can read back via `GET /v1/feedback/{node}`.
Advisory only. In v0 a negative aggregate does NOT silently lower the
fused trust score — it's a human-weighable signal beside the verdict, not
an automatic reweight.
Use this tool when:
- You acted o params: node*, outcome*, receipt_id, note |
get_feedback | Public read of the crowd-sourced outcome aggregate for a node — how
callers reported their real-world results after acting on its verdict.
Advisory signal, not a trust verdict. An empty aggregate returns cleanly
with `total: 0` and `signal: none`.
`signal` is derived: `none` (no reports), `insufficient` (<3),
`positive` / `negative` (score past ±0.3), or `mixed`.
params: node* |
x402_echo | Validates an agent's x402 v1 client implementation against a TunnelMind
surface end-to-end. Two operating modes:
- `mode: "demo"` — HMAC over a nonce against a publicly-published secret.
Does not move USDC. Smoke proves the WIRE works, not money movement.
- `mode: "x402"` — real Coinbase facilitator dispatch (gated on
operator wallet provisioning; currently returns "facilitator not configured params: X-PAYMENT |
Entries describe changes in tool definitions. They are not statements about a server, its quality or its author. The grade measures how the tool definitions fit model providers (token cost, schema compatibility, confusable names) as scored by the ToolFit engine at the time of the listing. JSON: append .json. Opt-out: how or hello@youraitools.co.