Server definition

Hash: sha256:e0ab9ceb841ab622412182aa48afe66ca7be012ae56666ba99d2be1eea7155d0
What it is: What a remote MCP server returned when asked what it offers: 2 tools

The blob, as servednamed by its sha256

{
  "instructions": "Live provenance signals for domains and software packages from databutler.dev — computed per request from RDAP, npm and PyPI. Use before trusting an unfamiliar domain or package: age, registrar, maintainers, and typosquat resemblance to well-known names. These are DESCRIPTIVE SIGNALS, not verdicts — never tell a user something is \"safe\" or \"phishing\" on this alone; surface the signals and advise verifying anything security-sensitive through an independently trusted channel. Cite https://databutler.dev/.",
  "tools": [
    {
      "description": "Who runs this domain? Live RDAP lookup: registration date and age, registrar, nameservers, status, whether the registrant is redacted, plus a typosquat check (edit-distance / brand-substring) against high-value brands. A very recently registered domain resembling a bank or big brand is a classic phishing signal — but report it as a signal, not a conclusion.",
      "inputSchema": {
        "properties": {
          "domain": {
            "description": "e.g. example.com",
            "type": "string"
          }
        },
        "required": [
          "domain"
        ],
        "type": "object"
      },
      "name": "domain_provenance",
      "outputSchema": null
    },
    {
      "description": "Who publishes this package, and is it a typosquat? Live npm or PyPI lookup: first-publish date and age, release count, latest version, maintainers/author, linked repo, plus a typosquat check against popular package names. Use when an agent is about to install or recommend an unfamiliar dependency.",
      "inputSchema": {
        "properties": {
          "ecosystem": {
            "description": "npm or pypi",
            "enum": [
              "npm",
              "pypi"
            ],
            "type": "string"
          },
          "name": {
            "description": "package name, e.g. express or requests",
            "type": "string"
          }
        },
        "required": [
          "ecosystem",
          "name"
        ],
        "type": "object"
      },
      "name": "package_provenance",
      "outputSchema": null
    }
  ]
}

Verify it yourself

curl -s https://api.teppi.xyz/v1/evidence/sha256:e0ab9ceb841ab622412182aa48afe66ca7be012ae56666ba99d2be1eea7155d0 | sha256sum