Looks up each submitted domain in the TunnelMind tracker database, aggregates risk
metrics (avg score, max score, fingerprinters, high-risk domains, entity ownership),
and issues a signed surveillance receipt. The receipt is stored in the public registry
and can be verified at `/verify/{receipt_id}`.
Use this tool when:
- You want a verifiable record of which trackers were observed in a context (page, app, session).
- You need a signed evidence artifact for a privacy audit or compliance report.
- You want to know the overall surveillance exposure level for a set of domains.
- You are generating a receipt to share with a user as evidence of tracker presence.
Do NOT use this tool when:
- You want full tracker details per domain — use `get_domain` instead.
- You want to look up an existing receipt — use `get_receipt` instead.
- You need live probes (HTTP headers, stack detection) — use `/v1/intel/*` instead.
Inputs:
- `domains` (body, required): Array of 1–50 fully qualified domain names.
Duplicates are deduplicated. URLs are stripped to host component.
- `domain` (body, alternative): Single domain string (shorthand for `domains: [domain]`).
Returns:
- `receipt_id`: Unique receipt ID (e.g. `rcpt_01JXYZ...`).
- `receipt`: Full receipt document including domains submitted, tracker findings,
high-risk domains, fingerprinters, unique entities, and exposure metrics.
- `content_hash`: SHA-256 of the canonical receipt JSON.
- `signature`: Base64 Ed25519 signature (empty string if signing key not configured).
- `signed`: Boolean — true if the receipt is cryptographically signed.
- `verify_url`: Path to retrieve this receipt from the public registry.
Exposure levels: `minimal` / `moderate` / `high` / `critical`
Based on average tracker score and proportion of high-risk domains (score ≥ 70).
Cost:
- Counts as one request against the daily limit regardless of domain count.
Latency:
- Typical: <100ms (pure D1 lookup, no outbound probing). p99: <300ms.
Connector