From 8ff2e81525686433c07856043b366917aa9b2f23 Mon Sep 17 00:00:00 2001 From: chrisjleal <184772742+chrisjleal@users.noreply.github.com> Date: Sat, 24 Oct 2026 16:52:24 -0500 Subject: [PATCH 1/5] Say what the hosted MCP tools cost and where the plan boundary is Search and page reads record 1 credit, a connected-app action records 2, a call relayed through a saved MCP server records 1, and a call on your own provider key records nothing. Saving a remote MCP server and running its tools are on Pro; listing, using and removing a saved server stay on every plan, and every other tool runs on credits on every plan. The research tools are a fallback for a client with none, and the page says so, because preferring the client's own search and fetch is what keeps the bill honest. --- mcp/tools.mdx | 4 ++++ pricing.mdx | 16 +++++++++++++++- 2 files changed, 19 insertions(+), 1 deletion(-) diff --git a/mcp/tools.mdx b/mcp/tools.mdx index b77cfb8..a59ada4 100644 --- a/mcp/tools.mdx +++ b/mcp/tools.mdx @@ -44,6 +44,10 @@ These reach the public web. Use search and fetch for reading, and the browser on An action that would create an external side effect needs approval first. Actions that reach another business system go through `proofable_composio_execute`, which is permissioned. +Prefer your own client's search, page fetch and browser. These are here for a client that has none, and each call is metered: `proofable_web_search` and `proofable_url_fetch` record 1 credit, `proofable_composio_execute` records 2, and a call relayed through a saved MCP server records 1. [Pricing](/pricing) lists the rates. + +Saving a remote MCP server and running its tools (`proofable_mcp_connection_create`, `proofable_mcp_tool_execute`) are on [Pro](/pricing). Listing, using and removing a saved server stay on every plan, and every other tool here runs on credits on every plan. + ## Job tools Signed-in connections get the job tools on every plan. Each run uses your credits and stays within the permissions on your profile. `tools/list` returns the full set your connection can call. diff --git a/pricing.mdx b/pricing.mdx index e5121a6..decab7e 100644 --- a/pricing.mdx +++ b/pricing.mdx @@ -22,7 +22,7 @@ Agent identity and permission proofs are public checks. They are available on ev ## Included on every plan -Hosted sign-in and profile, Hosted Verify and reusable proofs, agent identity and permission proofs, the Proof Graph, agent composing with your own model key, hosted AI on the Default tier, jobs in the background or on a schedule, and the hosted computer. Everything runs on your credits; Pro adds the Advanced tier, credits and throughput. +Hosted sign-in and profile, Hosted Verify and reusable proofs, agent identity and permission proofs, the Proof Graph, agent composing with your own model key, hosted AI on the Default tier, jobs in the background or on a schedule, and the hosted computer. Everything runs on your credits; Pro adds the Advanced tier, credits, throughput, and remote MCP servers you can save and run. ## What a job costs @@ -34,6 +34,20 @@ Hosted sign-in and profile, Hosted Verify and reusable proofs, agent identity an | Your own model key | 0 for tokens | | Hosted computer or job machine | 2 per vCPU for each started minute; the standard browser machine is 2 vCPUs, so 4 a minute | +## What a tool call costs + +Signing in, checking a saved proof, and reading your own profile, proofs, agents, jobs, connections and secret names are free. The calls that reach another service are metered per call: + +| Call | Credits | +|---|---| +| Web search (`proofable_web_search`) | 1 | +| Read a page (`proofable_url_fetch`) | 1 | +| Run a connected-app action (`proofable_composio_execute`) | 2 | +| A call relayed through a saved MCP server (`proofable_mcp_tool_execute`, Pro) | 1 | +| A call on your own provider key (`proofable_capability_call`) | 0 | + +Operating a page with `proofable_browser` runs inside a job machine and is charged as a job above. + ## What checks cost One credit lists at $0.0025. From 508a34d8a701069026faa52b512de95d2d7628c2 Mon Sep 17 00:00:00 2001 From: chrisjleal <184772742+chrisjleal@users.noreply.github.com> Date: Sat, 24 Oct 2026 20:51:44 -0500 Subject: [PATCH 2/5] The docs stop selling the platform runtime as the MCP surface The tool reference advertised the vault, the sandbox, connected apps, the job executor, remote MCP servers and web search as the hosted MCP surface, and the pricing page priced those calls. They now run on the Proofable platform, not on a connection: the endpoint carries the trust layer, and a call to a runtime tool answers platform_only. The reference, the secrets page, the jobs page, the pricing page and the privacy table all say where the work belongs. --- jobs.mdx | 2 +- learn/legal/privacy-policy.mdx | 2 +- mcp/secrets.mdx | 56 +++++----------------------------- mcp/tools.mdx | 50 ++++++++---------------------- pricing.mdx | 14 ++------- 5 files changed, 24 insertions(+), 100 deletions(-) diff --git a/jobs.mdx b/jobs.mdx index 2a23cfa..007f14c 100644 --- a/jobs.mdx +++ b/jobs.mdx @@ -70,7 +70,7 @@ Completed runs keep a receipt: a proof of what the job did. Open it from the run Cancel a run to stop it and keep the receipt. Remove a run only when you want to delete that receipt. Stop a recurring schedule, or queue a run again from the job. -Through MCP, any signed-in profile has the same four job actions: `proofable_job_create`, `proofable_job_list`, `proofable_job_get`, and `proofable_job_cancel`. Other app tools stay on proofable.me. +Jobs are platform runtime: they run here, under the permissions on your profile, and each completed run keeps a receipt you can open and verify. An MCP connection does not carry the job tools — a connection is for proof and permission, so `proofable_job_create` on that endpoint answers `platform_only`. Start and manage runs in Proofable, or through the product API. ## Next diff --git a/learn/legal/privacy-policy.mdx b/learn/legal/privacy-policy.mdx index dd40709..7ee1c8c 100644 --- a/learn/legal/privacy-policy.mdx +++ b/learn/legal/privacy-policy.mdx @@ -93,7 +93,7 @@ The tool names above map to this policy as follows, so you can check any single | `proofable_mcp_connection_create`, `proofable_mcp_connections_list`, `proofable_mcp_connection_delete` | MCP connection | | `proofable_mcp_tools_list`, `proofable_mcp_tool_execute` | Capability call and tool execution | -These are the tools the hosted Proofable MCP service exposes. A client may show a different subset depending on whether you are signed in and what your client supports. +This table covers Proofable's tools, whether a connection can call them or not, because the data each one handles is disclosed the same way either way. The proof and permission tools — reading the profile, the verifier catalog, proofs, agents, and creating, updating or revoking a proof — are the ones the hosted MCP service exposes. The platform tools (jobs, the browser, connected apps, provider calls, saved secrets, saved tools, session receipts, page fetch and web search) run inside Proofable rather than over a connection. A client may show a different subset depending on whether you are signed in and what your client supports. ## How We Use Information diff --git a/mcp/secrets.mdx b/mcp/secrets.mdx index c123889..37669a5 100644 --- a/mcp/secrets.mdx +++ b/mcp/secrets.mdx @@ -16,16 +16,16 @@ Save a key once and use it everywhere you work with Proofable. Nothing needs to | ----- | ------------------- | | **Proofable assistant** | Pick the provider in the assistant. Proofable calls it with your saved key instead of the included model access. | | **Jobs** | A job that runs on your provider uses the same saved key for its model calls. | -| **ChatGPT, Claude, Cursor, and other MCP apps** | **`proofable_capability_call`** calls the provider with your saved key. The app receives the provider's answer, never the key. | -| **Remote MCP connections** | Headers for a saved MCP connection are stored the same way and sent only to that server. | +| **Proofable platform** | A job, an agent, a connected app or the assistant uses the key on your behalf. You receive the answer, never the key. | | **Agents you create** | Bind a secret to an agent. The agent can use it through Proofable, but cannot read it. | ## Add a key -- **Profile → Secrets (recommended).** The value goes from your browser straight to Proofable. -- **From an AI app with `proofable_secret_create`.** This works, but the value you type passes through that app's conversation first. Use the Secrets page for production credentials. +- **Profile → Secrets.** The value goes from your browser straight to Proofable. -Name a key after its provider, such as `OPENAI_API_KEY` or `ANTHROPIC_API_KEY`, so Proofable knows which provider it belongs to. For a provider Proofable does not recognize, pass `tags: ["provider:"]` to `proofable_secret_create`. +Saving a key is a platform action, not a connection tool: the agent never handles the value. That is the point — a key typed into an AI app's conversation has already been disclosed to that app, so this endpoint deliberately carries no way to submit one. + +Name a key after its provider, such as `OPENAI_API_KEY` or `ANTHROPIC_API_KEY`, so Proofable knows which provider it belongs to. For a provider Proofable does not recognize, add a `provider:` tag when you save it. ## Common questions @@ -41,51 +41,9 @@ Name a key after its provider, such as `OPENAI_API_KEY` or `ANTHROPIC_API_KEY`, **Does Proofable use its own keys?** The included assistant tiers use Proofable's model access. When you add your own key for a provider, your requests to that provider use your key. -## MCP tools - -Sign in first with OAuth or a server key ([Auth](./auth)). When signed in, omit `walletAddress`; secrets bind to the profile from **`proofable_context`**. - -| Tool | Purpose | -| ---- | ------- | -| **`proofable_secret_create`** | Save or replace a named secret | -| **`proofable_secret_list`** | List secret names, types, and update times. No values | -| **`proofable_secret_revoke`** | Permanently delete a secret by proof ID | - -### Create - -```json -{ - "alias": "OPENAI_API_KEY", - "secretType": "single", - "content": "" -} -``` - -| Field | Notes | -| ----- | ----- | -| `alias` | Letters, numbers, and underscores; starts with a letter | -| `secretType` | `single` (default), `bundle` (key-value JSON), or `json` (one sealed JSON document) | -| `content` | The value to save. It is never returned | -| `tags` | Optional. `provider:` links the secret to a provider Proofable does not infer from the alias | -| `walletAddress` | Optional when signed in; must match the signed-in profile if set | - -Saving the same alias again revokes the older record. The result lists revoked proof IDs in `superseded`. If revocation fails after the new save, the tool reports `secret_replacement_incomplete` with both proof IDs so you can retry or revoke the older one. - -### List - -```json -{ "limit": 50, "offset": 0 } -``` - -Without sign-in, the tool returns an empty list with `authRequired: true` and no metadata. - -### Revoke - -```json -{ "qHash": "..." } -``` +## Where a saved key is used -Requires ownership of the secret. Omit `walletAddress` when signed in. +The vault is a Proofable platform feature, not part of an MCP connection. A saved key is used by runs the platform performs for you — the assistant, a job, an agent, a connected app — and it is never returned to a client, an agent, or the app you are using. A connection cannot create, list or revoke a secret: those tools answer `platform_only` and point at [Proofable](https://proofable.me) and the [product API](/reference). diff --git a/mcp/tools.mdx b/mcp/tools.mdx index a59ada4..43ad327 100644 --- a/mcp/tools.mdx +++ b/mcp/tools.mdx @@ -1,9 +1,11 @@ --- title: MCP tools -description: "The complete hosted MCP tool reference: reuse current proofs before creating new ones, then verify, mount agents, and manage secrets." +description: "The hosted MCP trust layer: prove something once, reuse the proof, and hold an agent to a scoped permission." icon: wrench --- +Proofable's MCP endpoint carries the trust layer. Prove identity, ownership or permission once; reuse the proof instead of verifying again; hold an agent to a permission you can revoke. Work that needs the Proofable platform to *run* something happens in Proofable — the proof it produces comes back here to be checked, shared and reused. + Call **`proofable_context`** once, then pick the tool for the job. | Job | Tool | What it does | @@ -17,48 +19,24 @@ Call **`proofable_context`** once, then pick the tool for the job. | Submit an outside signature | `proofable_verify_submit` | Creates the proof from a signed prepared check. | | Read a proof | `proofable_proofs_get` | Current proof records and status. | | Update or review a proof | `proofable_proofs_update` | Change title/tags, vote, or comment on the same proof. | +| Revoke a proof | `proofable_proof_revoke` | Removes a proof from public access. | | Create or import an agent | `proofable_agent_create` | Links the agent to your profile. Optional separate spend account and controls. Pass an existing account address for dedicated spend. | | Confirm the agent is ready | `proofable_agent_link` | Identity and the permissions that account needs. | | Load the agent | `proofable_agent_mount` | Identity, permissions, skills, and current settings. | -| Store or replace a secret | `proofable_secret_create` | Encrypted Vault secret; the same alias replaces its prior value. | -| List secrets | `proofable_secret_list` | Stored names and details. Never the secret itself. | -| Revoke a secret | `proofable_secret_revoke` | Removes a stored secret by proof ID. | | List agents | `proofable_agents_list` | Agent identities and delegations on the profile. | -| Revoke a proof | `proofable_proof_revoke` | Removes a proof from public access. | -| Save a session note | `proofable_session_receipt_create` / `proofable_session_receipt_append` | Private receipt in your account; append adds to an existing one. | -| Create or update a tool | `proofable_skill_tool_create_or_update` | A JavaScript tool or skill, run only when you or an agent invokes it. | - -## Research and browsing tools - -These reach the public web. Use search and fetch for reading, and the browser only when a page needs a click, JavaScript, or a visual check. - -| Job | Tool | What it does | -|---|---|---| -| Search the web | `proofable_web_search` | Structured results; optionally retrieves each page as text. | -| Read a page | `proofable_url_fetch` | Clean page text from a public URL. Private and metadata hosts are refused. | -| Operate a page | `proofable_browser` | Open, observe, click, type, screenshot and read console in an isolated job session. | -| Call a connected app | `proofable_composio_search` / `proofable_composio_execute` | Find and run an action on Gmail, Drive, GitHub, Slack and similar apps. | -| Call a saved provider key | `proofable_capability_call` | Sends a request to a BYOK provider with the API key you saved for it. | -| Add an MCP server | `proofable_mcp_connection_create` / `proofable_mcp_connections_list` / `proofable_mcp_connection_delete` | Save, list or remove a remote MCP server for this account. | -| Use an MCP server | `proofable_mcp_tools_list` / `proofable_mcp_tool_execute` | List that server's tools and run one. | - -An action that would create an external side effect needs approval first. Actions that reach another business system go through `proofable_composio_execute`, which is permissioned. -Prefer your own client's search, page fetch and browser. These are here for a client that has none, and each call is metered: `proofable_web_search` and `proofable_url_fetch` record 1 credit, `proofable_composio_execute` records 2, and a call relayed through a saved MCP server records 1. [Pricing](/pricing) lists the rates. +## What this endpoint does not carry -Saving a remote MCP server and running its tools (`proofable_mcp_connection_create`, `proofable_mcp_tool_execute`) are on [Pro](/pricing). Listing, using and removing a saved server stay on every plan, and every other tool here runs on credits on every plan. +The platform runtime stays in the product, not on the protocol surface: -## Job tools +- **Work the platform runs** — background and scheduled jobs, the hosted browser, sandboxes, hosted model inference. +- **Integrations** — connected apps (Gmail, Drive, GitHub, Slack and similar), a saved provider key, remote MCP servers. +- **Storage** — the encrypted vault, and the private records Proofable writes to hold something for you. +- **What your client already does** — web search and page fetch. -Signed-in connections get the job tools on every plan. Each run uses your credits and stays within the permissions on your profile. `tools/list` returns the full set your connection can call. +Those run in Proofable or in the SDK against the product API, where the run holds its own permission, a human approves side effects, and the result is a proof — which comes back to this endpoint to be checked and reused. Calling one of them here returns `platform_only` and says where the work belongs. -| Job | Tool | What it does | -|---|---|---| -| Start work | `proofable_job_create` | Run agent work now or on a schedule. | -| List work | `proofable_job_list` | List jobs available to the signed-in profile. | -| Inspect work | `proofable_job_get` | Read one job and its latest run state. | -| Approve a step | `proofable_job_decide` | Approve or deny a run that is waiting for approval. | -| Stop work | `proofable_job_cancel` | Cancel a run or recurring schedule. | +That is a boundary, not a plan limit: no plan unlocks the runtime through a connection, and the refusal never sells one. A connection should carry proof and authority. A general execution surface would rent out the platform, bill for work the client can already do, and turn a trust primitive into a proxy. | Topic | Detail | |-------|--------| @@ -84,7 +62,6 @@ Wallet address in native format, or `did:pkh:…`. Delegated reads: **`agentWall | Default | Connect → **`proofable_context`** → **`proofable_agent_link`** for agents → **`proofable_verify_or_guide`** before sensitive actions | | Project agent | **`proofable_agent_mount`** or `proofable mount --apply ` in the repo | | Details | **`proofable_proofs_get`** for proof records, tags, delegated context, and proof fields | -| Secrets | **`proofable_secret_list`** / **`proofable_secret_create`** / **`proofable_secret_revoke`** when auth is configured ([Secrets](./secrets)) | | Fallback | **`proofable_verify_or_guide`** only when something is missing | | Catalog | **`proofable_verifiers_catalog`** only when you need raw schemas beyond the compact `verifierSummary` in `proofable_context` | @@ -123,7 +100,4 @@ Same flow as [Overview](./overview). Load identity, permissions, and skills into a project. - - Store and revoke encrypted Vault secrets. - diff --git a/pricing.mdx b/pricing.mdx index decab7e..48afc4d 100644 --- a/pricing.mdx +++ b/pricing.mdx @@ -22,7 +22,7 @@ Agent identity and permission proofs are public checks. They are available on ev ## Included on every plan -Hosted sign-in and profile, Hosted Verify and reusable proofs, agent identity and permission proofs, the Proof Graph, agent composing with your own model key, hosted AI on the Default tier, jobs in the background or on a schedule, and the hosted computer. Everything runs on your credits; Pro adds the Advanced tier, credits, throughput, and remote MCP servers you can save and run. +Hosted sign-in and profile, Hosted Verify and reusable proofs, agent identity and permission proofs, the Proof Graph, agent composing with your own model key, hosted AI on the Default tier, jobs in the background or on a schedule, and the hosted computer. Everything runs on your credits; Pro adds the Advanced tier, credits and throughput. ## What a job costs @@ -36,17 +36,9 @@ Hosted sign-in and profile, Hosted Verify and reusable proofs, agent identity an ## What a tool call costs -Signing in, checking a saved proof, and reading your own profile, proofs, agents, jobs, connections and secret names are free. The calls that reach another service are metered per call: +Signing in, checking a saved proof, and reading your own profile, proofs and agents are free. Creating a proof is charged as a check below; the trust layer adds nothing on top of it. -| Call | Credits | -|---|---| -| Web search (`proofable_web_search`) | 1 | -| Read a page (`proofable_url_fetch`) | 1 | -| Run a connected-app action (`proofable_composio_execute`) | 2 | -| A call relayed through a saved MCP server (`proofable_mcp_tool_execute`, Pro) | 1 | -| A call on your own provider key (`proofable_capability_call`) | 0 | - -Operating a page with `proofable_browser` runs inside a job machine and is charged as a job above. +The platform runtime is not on the MCP endpoint. Jobs, the hosted computer, connected apps, a saved provider key, remote MCP servers, web search and page fetch run in Proofable and are charged there as the job or the inference above. [MCP tools](/mcp/tools) lists what a connection does carry. ## What checks cost From dffdceeb945c65a385dae32542a82d9ece911bab Mon Sep 17 00:00:00 2001 From: chrisjleal <184772742+chrisjleal@users.noreply.github.com> Date: Sat, 24 Oct 2026 21:26:34 -0500 Subject: [PATCH 3/5] Public copy: no em dash, no contrast construction, and the secrets scope says what it is The public language gate reads every repo, and it flagged 11 findings in these pages plus one in the changelog and one in the instruction string a host reads. Rewritten to the house voice. The OAuth scope table no longer implies a connector can use the vault: the scope is still issued, and it describes stored credentials used by Proofable's own runs. --- jobs.mdx | 2 +- learn/legal/privacy-policy.mdx | 2 +- mcp/oauth.mdx | 2 +- mcp/secrets.mdx | 4 ++-- mcp/tools.mdx | 12 ++++++------ 5 files changed, 11 insertions(+), 11 deletions(-) diff --git a/jobs.mdx b/jobs.mdx index 007f14c..4b5e773 100644 --- a/jobs.mdx +++ b/jobs.mdx @@ -70,7 +70,7 @@ Completed runs keep a receipt: a proof of what the job did. Open it from the run Cancel a run to stop it and keep the receipt. Remove a run only when you want to delete that receipt. Stop a recurring schedule, or queue a run again from the job. -Jobs are platform runtime: they run here, under the permissions on your profile, and each completed run keeps a receipt you can open and verify. An MCP connection does not carry the job tools — a connection is for proof and permission, so `proofable_job_create` on that endpoint answers `platform_only`. Start and manage runs in Proofable, or through the product API. +Jobs are platform runtime: they run here, under the permissions on your profile, and each completed run keeps a receipt you can open and verify. An MCP connection does not carry the job tools, because a connection is for proof and permission, so `proofable_job_create` on that endpoint answers `platform_only`. Start and manage runs in Proofable, or through the product API. ## Next diff --git a/learn/legal/privacy-policy.mdx b/learn/legal/privacy-policy.mdx index 7ee1c8c..d04257a 100644 --- a/learn/legal/privacy-policy.mdx +++ b/learn/legal/privacy-policy.mdx @@ -93,7 +93,7 @@ The tool names above map to this policy as follows, so you can check any single | `proofable_mcp_connection_create`, `proofable_mcp_connections_list`, `proofable_mcp_connection_delete` | MCP connection | | `proofable_mcp_tools_list`, `proofable_mcp_tool_execute` | Capability call and tool execution | -This table covers Proofable's tools, whether a connection can call them or not, because the data each one handles is disclosed the same way either way. The proof and permission tools — reading the profile, the verifier catalog, proofs, agents, and creating, updating or revoking a proof — are the ones the hosted MCP service exposes. The platform tools (jobs, the browser, connected apps, provider calls, saved secrets, saved tools, session receipts, page fetch and web search) run inside Proofable rather than over a connection. A client may show a different subset depending on whether you are signed in and what your client supports. +This table covers Proofable's tools, whether a connection can call them or not, because the data each one handles is disclosed the same way either way. The proof and permission tools (reading the profile, the verifier catalog, proofs, agents, and creating, updating or revoking a proof) are the ones the hosted MCP service exposes. The platform tools (jobs, the browser, connected apps, provider calls, saved secrets, saved tools, session receipts, page fetch and web search) run inside Proofable rather than over a connection. A client may show a different subset depending on whether you are signed in and what your client supports. ## How We Use Information diff --git a/mcp/oauth.mdx b/mcp/oauth.mdx index 345be91..44586e6 100644 --- a/mcp/oauth.mdx +++ b/mcp/oauth.mdx @@ -180,7 +180,7 @@ OAuth access tokens are valid only when `aud` is `https://mcp.proofable.me/mcp`, |-------|-------------|---------| | `neus:core` | Public protocol tools (context, catalog, public proof reads) | Yes | | `neus:profile` | Signed-in profile context and ownership checks | Yes | -| `neus:secrets` | Portable encrypted secrets in Vault | Yes | +| `neus:secrets` | Stored credentials on your profile, used by Proofable's own runs. A connection carries no tool that handles one | Yes | | `offline_access` | Refresh token so the client can stay signed in | Yes | These four scopes are the complete public permission model. Server keys (`npk_*`) are a full-profile credential. diff --git a/mcp/secrets.mdx b/mcp/secrets.mdx index 37669a5..7c5f9d3 100644 --- a/mcp/secrets.mdx +++ b/mcp/secrets.mdx @@ -23,7 +23,7 @@ Save a key once and use it everywhere you work with Proofable. Nothing needs to - **Profile → Secrets.** The value goes from your browser straight to Proofable. -Saving a key is a platform action, not a connection tool: the agent never handles the value. That is the point — a key typed into an AI app's conversation has already been disclosed to that app, so this endpoint deliberately carries no way to submit one. +Saving a key belongs to Proofable itself, where the agent never handles the value. A key typed into an AI app's conversation has already been disclosed to that app, so this endpoint carries no way to submit one. Name a key after its provider, such as `OPENAI_API_KEY` or `ANTHROPIC_API_KEY`, so Proofable knows which provider it belongs to. For a provider Proofable does not recognize, add a `provider:` tag when you save it. @@ -43,7 +43,7 @@ Name a key after its provider, such as `OPENAI_API_KEY` or `ANTHROPIC_API_KEY`, ## Where a saved key is used -The vault is a Proofable platform feature, not part of an MCP connection. A saved key is used by runs the platform performs for you — the assistant, a job, an agent, a connected app — and it is never returned to a client, an agent, or the app you are using. A connection cannot create, list or revoke a secret: those tools answer `platform_only` and point at [Proofable](https://proofable.me) and the [product API](/reference). +The vault is a platform feature of Proofable rather than part of an MCP connection. A saved key is used by runs the platform performs for you (the assistant, a job, an agent, a connected app), and it is never returned to a client, an agent, or the app you are using. A connection cannot create, list or revoke a secret: those tools answer `platform_only` and point at [Proofable](https://proofable.me) and the [product API](/reference). diff --git a/mcp/tools.mdx b/mcp/tools.mdx index 43ad327..9ddebec 100644 --- a/mcp/tools.mdx +++ b/mcp/tools.mdx @@ -4,7 +4,7 @@ description: "The hosted MCP trust layer: prove something once, reuse the proof, icon: wrench --- -Proofable's MCP endpoint carries the trust layer. Prove identity, ownership or permission once; reuse the proof instead of verifying again; hold an agent to a permission you can revoke. Work that needs the Proofable platform to *run* something happens in Proofable — the proof it produces comes back here to be checked, shared and reused. +Proofable's MCP endpoint carries the trust layer. Prove identity, ownership or permission once; reuse the proof instead of verifying again; hold an agent to a permission you can revoke. Work that needs the Proofable platform to *run* something happens in Proofable, and the proof it produces comes back here to be checked, shared and reused. Call **`proofable_context`** once, then pick the tool for the job. @@ -29,12 +29,12 @@ Call **`proofable_context`** once, then pick the tool for the job. The platform runtime stays in the product, not on the protocol surface: -- **Work the platform runs** — background and scheduled jobs, the hosted browser, sandboxes, hosted model inference. -- **Integrations** — connected apps (Gmail, Drive, GitHub, Slack and similar), a saved provider key, remote MCP servers. -- **Storage** — the encrypted vault, and the private records Proofable writes to hold something for you. -- **What your client already does** — web search and page fetch. +- **Work the platform runs:** background and scheduled jobs, the hosted browser, sandboxes, hosted model inference. +- **Integrations:** connected apps (Gmail, Drive, GitHub, Slack and similar), a saved provider key, remote MCP servers. +- **Storage:** the encrypted vault, and the private records Proofable writes to hold something for you. +- **What your client already does:** web search and page fetch. -Those run in Proofable or in the SDK against the product API, where the run holds its own permission, a human approves side effects, and the result is a proof — which comes back to this endpoint to be checked and reused. Calling one of them here returns `platform_only` and says where the work belongs. +Those run in Proofable or in the SDK against the product API, where the run holds its own permission, a human approves side effects, and the result is a proof, which comes back to this endpoint to be checked and reused. Calling one of them here returns `platform_only` and says where the work belongs. That is a boundary, not a plan limit: no plan unlocks the runtime through a connection, and the refusal never sells one. A connection should carry proof and authority. A general execution surface would rent out the platform, bill for work the client can already do, and turn a trust primitive into a proxy. From 0d7467fd87772b4cdf4e94fdc5a0591eae9ebb28 Mon Sep 17 00:00:00 2001 From: chrisjleal <184772742+chrisjleal@users.noreply.github.com> Date: Sat, 24 Oct 2026 21:30:51 -0500 Subject: [PATCH 4/5] The docs changelog says what a connection carries, and stops pointing at the job tools The unreleased entry sent readers to the MCP tools page for the job tools, which that page no longer lists: jobs run in Proofable. The boundary gets its own entry so the pages below it read in the right order. --- CHANGELOG.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index c188375..59be9f2 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -17,11 +17,12 @@ Product release notes: [docs.proofable.me/changelog](https://docs.proofable.me/c ### Changed +- **The hosted MCP surface carries the trust layer.** [MCP tools](/mcp/tools) lists the proof and permission tools a connection is offered, and states what runs on the platform instead: jobs, the hosted browser, connected apps, a saved provider key, remote MCP servers, web search and page fetch, and the vault. Calling one of those from a connection answers `platform_only` and says where the work belongs, on every plan. [Secrets](/mcp/secrets) saves a key on your profile rather than through a client, and the [OAuth scope table](/mcp/oauth) says which tools each scope reaches. - **One Evidence page.** [Evidence](/evidence) opens on seven results across governance and runtime cost: 48 of 48 AgentGovBench scenarios beside the agent tools teams already use, 6 of 6 data-theft attempts refused by a scoped permission in the prompt injection test, every unauthorized action stopped in 8 of 8 live tests, $0.024 vs $0.078 handing work between agents with a signed receipt (catching 3 of 3 tampered handoffs), 42.4 times fewer tokens (105,347 vs 4,462,980) reading typed vault state over keyword search, 3.1 times lower worst-case token tail against open-web search, and a reused result about 750 times faster to verify offline than redoing the job. Its charts switch to a stacked layout on phones. Each result links to its signed record and a way to check or rerun it, and security reviewers get the OWASP, EU AI Act, NIST and CAIP-380 mapping in one section. `/benchmarks` and `/use-cases/authority-at-dispatch` now open it. - **Jobs and the hosted computer on every plan; Advanced on Pro.** [Jobs](/jobs) and [Pricing](/pricing) list what a run costs: 1 credit per run on any model or key, hosted tokens by tier, and 2 credits per vCPU for each started minute of a hosted machine. The Advanced hosted tier is on Pro, Partner and Enterprise; any model runs on your own key on every plan. - **Two checks you can run on the published records.** `public/evidence/checks/tamper-check.mjs` forges each signed record ten ways and confirms every copy is rejected offline; `reuse-check.mjs` times reading and verifying a finished result with no account. - **A fresh run of the eight authority cases on the live service.** All eight passed on the revision production was serving, with 17 signed records. Requests that should not have been allowed were refused before any job ran; the case that needs approval waited for it and then ran; and a valid request ran alongside the refusals to show the check can pass. The records need no account to read or verify, and the run lives at `public/evidence/aaif/authority-at-dispatch/2026-10-24-served/`. -- **Jobs run on credits on every plan.** [MCP tools](/mcp/tools) lists the job tools, including `proofable_job_decide`, for every signed-in plan, and the team-agents and reproduce guides no longer say jobs need Pro. +- **Jobs run on credits on every plan.** [Jobs](/jobs) says what a run costs and where it runs, and the team-agents and reproduce guides no longer say jobs need Pro. A connection does not carry the job tools. - **Agent id format is in the schemas.** `agentId` in `agent-identity` and `agent-delegation` is 1 to 128 letters, digits, hyphens or underscores, the same id the agent page uses. ### Removed From f12b1f63f1851d6eb3430f8f7db60bc48851397a Mon Sep 17 00:00:00 2001 From: chrisjleal <184772742+chrisjleal@users.noreply.github.com> Date: Sat, 24 Oct 2026 21:39:03 -0500 Subject: [PATCH 5/5] The tools page stops printing its own subtitle twice The copy gate rejects a body that replays the frontmatter description as a shared four-word sequence, because the page then makes the same claim twice under the H1. My rewrite of that opening line did exactly that. Reworded so the body adds to the subtitle instead of repeating it. --- mcp/tools.mdx | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/mcp/tools.mdx b/mcp/tools.mdx index 9ddebec..fe8fe4b 100644 --- a/mcp/tools.mdx +++ b/mcp/tools.mdx @@ -4,7 +4,7 @@ description: "The hosted MCP trust layer: prove something once, reuse the proof, icon: wrench --- -Proofable's MCP endpoint carries the trust layer. Prove identity, ownership or permission once; reuse the proof instead of verifying again; hold an agent to a permission you can revoke. Work that needs the Proofable platform to *run* something happens in Proofable, and the proof it produces comes back here to be checked, shared and reused. +Proofable's MCP endpoint carries the trust layer. Prove identity, ownership or permission; reuse an existing proof instead of verifying it again; and give an agent a permission you can revoke. Work that needs the Proofable platform to *run* something happens in Proofable, and the proof it produces comes back here to be checked, shared and reused. Call **`proofable_context`** once, then pick the tool for the job.