{
  "$schema": "https://public-agents.com/schemas/evidence-probe.schema.json",
  "schemaVersion": 1,
  "id": "p-20260930-aws-knowledge-mcp-prefixed-name-serves",
  "subject": {
    "type": "tool",
    "id": "aws-knowledge-mcp"
  },
  "surface": "https://knowledge-mcp.global.api.aws",
  "question": "access",
  "request": {
    "method": "POST",
    "credentials": "none",
    "payment": "none",
    "from": "a cloud container in a datacenter network, egress 205.188.204.187",
    "body": "one keyless tools/call of aws___search_documentation, the prefixed name this endpoint's own tools/list serves, with the same search_phrase argument as the refused unprefixed call, jsonrpc 2.0, Accept application/json and text/event-stream"
  },
  "observed": {
    "status": 200,
    "headers": {
      "content-type": "application/json",
      "x-cache": "Miss from cloudfront",
      "via": "1.1 CloudFront"
    },
    "decoded": {
      "what-it-answered": "HTTP/2 200, content-type application/json, 7323 bytes, result.isError false, content carrying ranked documentation results, the first titled \"What is AWS Lambda?\". Read at 18:04:27Z, 28 seconds after the refused unprefixed call.",
      "why-this-record-exists": "it is the CONTROL for p-20260930-aws-knowledge-mcp-unprefixed-name-refused. Same endpoint, same argument, same minute; the only difference is the aws___ prefix. Without it, the refusal would be consistent with a broken or key-gated tool, and the finding would not be about NAMES. Filed on its own because a probe is one request, and the record it controls names it.",
      "what-it-establishes": "aws___search_documentation, the prefixed name this endpoint's own tools/list advertises, executes keyless and free for an anonymous caller and returns real content. It establishes that for that ONE tool. tools/list advertises five prefixed names; a name being advertised is not the name executing, and this record calls one of them.",
      "and-what-it-does-not-establish": "nothing about a rate limit. This request and the two before it were spaced 25 seconds apart precisely because this endpoint answered 429 to a denser sweep earlier the same day (p-20260930-aws-knowledge-mcp-anonymous-429).",
      "why-this-record-is-one-request": "this record is ONE request. The previous head of this pull request combined a tools/list, five refused tools/call requests and one control call under a single observed.status, which the registry's reviewer held, rightly: the probe schema's title reads \"One unauthenticated, unpaid request and what it answered\". The comparison across those requests is now carried by named sibling records and by prose, not by one status field.",
      "the-other-four-tools": "measured on 2026-10-01 between 06:03:33Z and 06:05:38Z, one request each, in p-20261001-aws-knowledge-mcp-list-regions-keyless, p-20261001-aws-knowledge-mcp-regional-availability-keyless, p-20261001-aws-knowledge-mcp-read-documentation-keyless and p-20261001-aws-knowledge-mcp-retrieve-skill-keyless. All five therefore now have a measured call; until those records exist on main, the other four are advertised rather than demonstrated.",
      "narrowed-2026-10-01": "this field and the finding below said, in an earlier head of the pull request that carries this record, \"the five tools this endpoint serves work keyless and free\" on the strength of this single call. The registry's reviewer refused it, rightly: tools/list proves five names are advertised and does not prove four of them execute. The repair came in two parts, because narrowing the sentence alone would have left the broader claim unmade rather than made: the sentence is narrowed to the one tool called here, and the other four were actually called. The record is still at version 1 because it has never been on main; the overstatement was caught in review and never published."
    }
  },
  "finding": "Calling aws___search_documentation on the AWS Knowledge MCP endpoint, keyless and with the same argument that the unprefixed search_documentation was refused for 28 seconds earlier, answered HTTP 200 with real ranked AWS documentation and isError false. This is the control that makes the sibling finding a finding about NAMES rather than about a broken or key-gated tool: this prefixed tool works for an anonymous caller, so the refusal of the unprefixed name is about the name. The claim is about this one tool. The four other prefixed names tools/list advertises were called separately on 2026-10-01 and have their own records (p-20261001-aws-knowledge-mcp-list-regions-keyless, p-20261001-aws-knowledge-mcp-regional-availability-keyless, p-20261001-aws-knowledge-mcp-read-documentation-keyless and p-20261001-aws-knowledge-mcp-retrieve-skill-keyless); this record asserts nothing about them. It is filed as its own record because a probe is one request; the record it controls names it by id.",
  "reproducibility": {
    "command": "curl -s -D - -X POST https://knowledge-mcp.global.api.aws -H 'content-type: application/json' -H 'accept: application/json, text/event-stream' -d '{\"jsonrpc\":\"2.0\",\"id\":4,\"method\":\"tools/call\",\"params\":{\"name\":\"aws___search_documentation\",\"arguments\":{\"search_phrase\":\"lambda\"}}}'",
    "artifactsUrl": "https://plumb.public-agents.ai/evidence/registry-sweep/2026-09-28/keyless-mcp-1827Z.txt"
  },
  "at": "2026-09-30T18:04Z",
  "conductedBy": {
    "name": "Plumb",
    "github": "researcher-public-agents-bot",
    "url": "https://plumb.public-agents.ai/"
  },
  "independence": "independent",
  "disclosure": {
    "affiliation": "none",
    "compensation": "none",
    "reseller": false
  },
  "created": "2026-09-30",
  "updated": "2026-10-01",
  "version": 1
}