TunnelMind

Showing 25 of 93 from the live probe.

• Health Check

  Returns a minimal status object confirming the API is alive. Use this to verify connectivity before chaining other calls, or as a liveness check in a workflow. Use this tool when: - You need to verify the API is reachable before starting a multi-step investigation. - A prior call failed with a 503 or 504 and you want to confirm the service recovered. - You are debugging connectivity from a new environment. Do NOT use this tool when: - You want actual tracker data — use `get_domain` or `search`

• Get Domain

  Returns the complete surveillance intelligence record for a domain name. If the domain is in TunnelMind's tracker database (80,000+ entries), the response includes tracker category, risk score, fingerprinting data, cookie persistence, IAB TCF purposes, and the owning corporate entity. If the domain is not in the database, a live probe is automatically run: RDAP registration data, DNS records (MX, SPF, TXT verification tokens), HTTP headers, and CSP third-party actors are fetched fresh from the e

• List Domains

  Returns a paginated list of domains from the tracker database. Results are ordered alphabetically by domain name and support cursor-based pagination for full traversal. Filtering by category and minimum score allows targeted data extraction. Use this tool when: - You want to enumerate all known ad-tech or analytics domains above a risk threshold. - You need a dataset of tracker domains for offline analysis. - You are paginating through a category to build a block list. Do NOT use this tool whe

• Get Entity

  Returns an entity record for a surveillance company or data broker, including its industry, estimated annual data value per user (in USD), categories of personal data collected, and the full list of domains it controls. Free tier returns 5 domains, paid returns up to 200. Use this tool when: - You want to understand what corporate entity owns or controls a tracker domain. - You need to assess the total surveillance footprint of a company (e.g., Alphabet, Meta, Oracle). - You are building a co

• List Entities

  Returns a paginated list of corporate entities in the TunnelMind surveillance database. Includes data categories, estimated data value, and industry classification. Useful for enumerating the surveillance ecosystem by sector. Use this tool when: - You want to enumerate all entities in a specific industry (e.g., all ad-tech companies). - You need a dataset of surveillance entities for analysis or reporting. - You are building a comprehensive surveillance landscape map. Do NOT use this tool when

• Search

  Searches both the domains table and the entities table simultaneously. Returns matching domains (by domain name) and entities (by name or slug) in a single response. Minimum 2 characters, maximum 100 characters. Use this tool when: - You have a partial name and need to identify what tracker or entity it belongs to. - You want to find all TunnelMind records related to a company name like "Google" or "Oracle". - You are resolving an ambiguous domain (e.g., does `criteo.com` appear in the tracker

• Intel Http

  Makes a live HEAD request to the target domain from the Cloudflare edge, follows up to 5 redirects, and returns the full redirect chain, final HTTP status, key response headers, a security header score, and any third-party surveillance actors referenced in the Content-Security-Policy header. Use this tool when: - You want to verify whether a site enforces HTTPS and HSTS. - You need to inspect what third-party scripts a site loads via its CSP header. - You are assessing a domain's security postu

• Intel Stack

  Fetches up to 32KB of the domain's HTML and response headers from the edge, then fingerprints the content for known CMS platforms, JavaScript frameworks, CDN providers, and analytics tools. Detection is based on meta generator tags, script src patterns, response headers, and cookie names. Use this tool when: - You need to know what CMS (WordPress, Drupal, Shopify) a site runs. - You are assessing a domain's infrastructure before a security review. - You want to identify analytics or marketing t

• Intel Robots

  Retrieves the target domain's `robots.txt` file and parses it for AI crawler disallow rules. Specifically detects policies for known AI crawlers (GPTBot, ClaudeBot, CCBot, Bytespider, etc.) and returns a structured summary of the crawling policy. Use this tool when: - You need to know whether a domain has opted out of AI training data collection. - You want to check if a specific AI crawler is blocked before citing the domain. - You are building a dataset of AI-accessible vs AI-blocked domains.

• Intel Agent

  Probes a domain for known AI agent integration signals: `llms.txt`, `ai.txt`, `/.well-known/ai-plugin.json`, `openapi.json`, `swagger.json`, MCP manifest, MCP SSE endpoint. Returns a score based on the count of signals detected. Use this to assess whether a domain is ready for agent-to-agent interaction. Use this tool when: - You want to know whether a domain exposes an MCP server or OpenAPI spec for agents. - You are cataloguing the AI-agent-ready surface of a set of domains. - You need to dec

• Intel Inject

  Fetches a domain's homepage and checks for content patterns that could constitute prompt injection attacks against AI agents that visit and ingest the page. Signals include hidden text, invisible divs, `<!-- AI: ignore -->` style comments, and known injection patterns. Use this tool when: - You are vetting a domain before feeding its content into an LLM context. - You want to assess the prompt injection risk of a URL before browsing it with an agent. - You are auditing a set of domains for adve

• Intel Optout

  Checks a domain for all known AI training data opt-out mechanisms beyond robots.txt: TDM (Text and Data Mining) reservation headers, `<meta name="ai">` tags, Creative Commons NonCommercial licenses, and other machine-readable opt-out signals. Use this tool when: - You need to determine whether a domain has opted out of AI training data collection. - You are checking compliance before using a domain's content in a training dataset. - You want a comprehensive opt-out status (robots.txt + TDM + me

• Get Receipt

  Returns metadata for a TunnelMind surveillance receipt — a signed document proving that a specific user's surveillance exposure was observed, measured, and recorded at a specific time. Does NOT return the receipt's signature (anti-phishing protection). To verify a receipt's content integrity, use `verify_receipt` with the hash and signature from the receipt document itself. Use this tool when: - You have a receipt ID and want to confirm it was genuinely issued by TunnelMind. - You need the issu

• Verify Receipt

  Tamper-detection verification for TunnelMind surveillance receipts. Submit the receipt ID, the SHA-256 content hash, and the Ed25519 signature from the receipt document. The registry compares these against what was recorded at issuance time. Returns VALID if both match exactly, INVALID with a specific mismatch reason otherwise. Use this tool when: - You received a surveillance receipt document and want to verify it hasn't been altered. - You are programmatically checking receipt authenticity in

• Create Free Key

  Self-serve free tier — the rung between anonymous access and paid blocks. One email in, one API key out, shown exactly once. Use this tool when: - You are calling anonymously and hitting the anonymous rate limit. - You want your calls identified so usage survives IP changes. Limits: - 50 requests/day (same endpoints as anonymous, higher ceiling). - One active free key per email; 3 signups per IP per day. - The raw key is returned once and stored only as a SHA-256 hash — it cannot be recovere

• Get Api Key

  Returns the tier, label, masked owner email, creation date, last-used timestamp, today's request count, and daily request limit for the API key used in this request. Useful for agents that need to monitor their own quota consumption. Use this tool when: - You want to check how many requests your key has used today. - You need to know your current tier or daily limit. - You want to confirm that your API key is active. Do NOT use this tool when: - You want to manage multiple keys — this endpoint

• Revoke Api Key

  Permanently deactivates the API key used to make this request. This action is irreversible. After revocation, the key will return 401 on all subsequent calls. If you have an active Stripe subscription, you must separately cancel it at stripe.com — revoking the key does not cancel billing. Use this tool when: - You want to rotate your API key (revoke old, then provision a new one). - You believe your key has been compromised. Do NOT use this tool when: - You want to check quota — use `get_api_k

• Get Task

  Returns the current status of a task created by an `?async=true` intel request. Poll this endpoint until `status` is one of: `complete`, `failed`, `cancelled`, `expired`. On `complete`, the `result` field contains the same payload the sync endpoint would have returned. On `failed`, `error.message` explains the failure. Use this tool when: - You submitted an intel probe with `?async=true` and need to retrieve the result. - You want to check whether a background task finished without opening an S

• Cancel Task

  Marks the task as `cancelled`. If the task is already in a terminal state (`complete`, `failed`, `expired`), returns 409 Conflict. Only the identity that created the task may cancel it. Use this tool when: - You submitted a probe with `?async=true` and no longer need the result. - You want to free up a pending task before it expires. Do NOT use this tool when: - The task is already complete — cancellation is not possible. Inputs: - `task_id` (path, required): 26-char ULID. Returns: - `task_i

• Stream Task

  Opens a persistent SSE connection that emits events as the task progresses. The stream closes automatically when the task reaches a terminal state or after ~90 seconds (timeout). Heartbeat comments are sent every ~15 seconds to keep the connection alive through proxies. Event types: - `status` — emitted when status changes (pending → running → complete/failed) - `result` — emitted on `complete` with the full result payload - `error` — emitted on `failed`, `cancelled`, or `expired` with error in

• Audit Export

  Returns NDJSON (one JSON object per line) of audit log entries. Each entry records the operation called, the identity, hashes of the request and response, duration, and an Ed25519 signature over the canonical entry JSON. Entries are hash-chained: each entry's `prev_entry_hash` is SHA-256 of the previous entry's signature, making deletion of any entry detectable offline. Authenticated callers receive only their own entries (`identity_sub` match). Admin key holders receive all entries. Use this

• Generate Receipt

  Looks up each submitted domain in the TunnelMind tracker database, aggregates risk metrics (avg score, max score, fingerprinters, high-risk domains, entity ownership), and issues a signed surveillance receipt. The receipt is stored in the public registry and can be verified at `/verify/{receipt_id}`. Use this tool when: - You want a verifiable record of which trackers were observed in a context (page, app, session). - You need a signed evidence artifact for a privacy audit or compliance report.

• Sigil Verify Ads Txt

  Confirms whether an SSP/exchange is authorized to sell a publisher's inventory according to that publisher's ads.txt. This is a cache lookup against ads.txt files crawled daily across the top 10,000 publisher domains — it does NOT fetch the publisher's ads.txt live, so it is fast and adds no latency to a real-time bidding decision. Use this tool when: - You are an ad-buying agent and want to confirm, pre-bid, that a supply path (publisher → exchange → seller_id) is legitimate. - You are detec

• Sigil Verify Ads Txt Batch

  Runs up to 100 ads.txt verifications in a single call — the endpoint an ad-buying agent uses for pre-bid checks across a whole campaign's supply. Each item is the same shape as `sigil_verify_ads_txt`. Per-item validation failures are reported inline; the batch never fails as a whole. Publisher records are fetched once per unique domain. Use this tool when: - You are evaluating many supply paths at once (campaign setup, SPO sweep). - You want one round-trip instead of N calls to `sigil_verify_ad

• Traction

  Live traction numbers computed from sources the Worker owns: the hash-chained D1 audit log (7-day call volume, distinct identified callers, top operations), the stored-receipt table, and Stripe (succeeded charges → paying customers, gross USD). Ed25519-signed with the same attestation envelope as /v1/status so the numbers can be replayed to an auditor. Use this tool when: - You are evaluating whether anyone actually uses and pays for this API. - You need a signed, re-checkable statement of usag