chrisjleal · Oct 25, 2026 · Oct 24, 2026 · Oct 25, 2026 · Oct 25, 2026 · Oct 25, 2026
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -17,11 +17,12 @@ Product release notes: [docs.proofable.me/changelog](https://docs.proofable.me/c
 
 ### Changed
 
+- **The hosted MCP surface carries the trust layer.** [MCP tools](/mcp/tools) lists the proof and permission tools a connection is offered, and states what runs on the platform instead: jobs, the hosted browser, connected apps, a saved provider key, remote MCP servers, web search and page fetch, and the vault. Calling one of those from a connection answers `platform_only` and says where the work belongs, on every plan. [Secrets](/mcp/secrets) saves a key on your profile rather than through a client, and the [OAuth scope table](/mcp/oauth) says which tools each scope reaches.
 - **One Evidence page.** [Evidence](/evidence) opens on seven results across governance and runtime cost: 48 of 48 AgentGovBench scenarios beside the agent tools teams already use, 6 of 6 data-theft attempts refused by a scoped permission in the prompt injection test, every unauthorized action stopped in 8 of 8 live tests, $0.024 vs $0.078 handing work between agents with a signed receipt (catching 3 of 3 tampered handoffs), 42.4 times fewer tokens (105,347 vs 4,462,980) reading typed vault state over keyword search, 3.1 times lower worst-case token tail against open-web search, and a reused result about 750 times faster to verify offline than redoing the job. Its charts switch to a stacked layout on phones. Each result links to its signed record and a way to check or rerun it, and security reviewers get the OWASP, EU AI Act, NIST and CAIP-380 mapping in one section. `/benchmarks` and `/use-cases/authority-at-dispatch` now open it.
 - **Jobs and the hosted computer on every plan; Advanced on Pro.** [Jobs](/jobs) and [Pricing](/pricing) list what a run costs: 1 credit per run on any model or key, hosted tokens by tier, and 2 credits per vCPU for each started minute of a hosted machine. The Advanced hosted tier is on Pro, Partner and Enterprise; any model runs on your own key on every plan.
 - **Two checks you can run on the published records.** `public/evidence/checks/tamper-check.mjs` forges each signed record ten ways and confirms every copy is rejected offline; `reuse-check.mjs` times reading and verifying a finished result with no account.
 - **A fresh run of the eight authority cases on the live service.** All eight passed on the revision production was serving, with 17 signed records. Requests that should not have been allowed were refused before any job ran; the case that needs approval waited for it and then ran; and a valid request ran alongside the refusals to show the check can pass. The records need no account to read or verify, and the run lives at `public/evidence/aaif/authority-at-dispatch/2026-10-24-served/`.
-- **Jobs run on credits on every plan.** [MCP tools](/mcp/tools) lists the job tools, including `proofable_job_decide`, for every signed-in plan, and the team-agents and reproduce guides no longer say jobs need Pro.
+- **Jobs run on credits on every plan.** [Jobs](/jobs) says what a run costs and where it runs, and the team-agents and reproduce guides no longer say jobs need Pro. A connection does not carry the job tools.
 - **Agent id format is in the schemas.** `agentId` in `agent-identity` and `agent-delegation` is 1 to 128 letters, digits, hyphens or underscores, the same id the agent page uses.
 
 ### Removed

diff --git a/jobs.mdx b/jobs.mdx
@@ -70,7 +70,7 @@ Completed runs keep a receipt: a proof of what the job did. Open it from the run
 
 Cancel a run to stop it and keep the receipt. Remove a run only when you want to delete that receipt. Stop a recurring schedule, or queue a run again from the job.
 
-Through MCP, any signed-in profile has the same four job actions: `proofable_job_create`, `proofable_job_list`, `proofable_job_get`, and `proofable_job_cancel`. Other app tools stay on proofable.me.
+Jobs are platform runtime: they run here, under the permissions on your profile, and each completed run keeps a receipt you can open and verify. An MCP connection does not carry the job tools, because a connection is for proof and permission, so `proofable_job_create` on that endpoint answers `platform_only`. Start and manage runs in Proofable, or through the product API.
 
 ## Next
 

diff --git a/learn/legal/privacy-policy.mdx b/learn/legal/privacy-policy.mdx
@@ -93,7 +93,7 @@ The tool names above map to this policy as follows, so you can check any single
 | `proofable_mcp_connection_create`, `proofable_mcp_connections_list`, `proofable_mcp_connection_delete` | MCP connection |
 | `proofable_mcp_tools_list`, `proofable_mcp_tool_execute` | Capability call and tool execution |
 
-These are the tools the hosted Proofable MCP service exposes. A client may show a different subset depending on whether you are signed in and what your client supports.
+This table covers Proofable's tools, whether a connection can call them or not, because the data each one handles is disclosed the same way either way. The proof and permission tools (reading the profile, the verifier catalog, proofs, agents, and creating, updating or revoking a proof) are the ones the hosted MCP service exposes. The platform tools (jobs, the browser, connected apps, provider calls, saved secrets, saved tools, session receipts, page fetch and web search) run inside Proofable rather than over a connection. A client may show a different subset depending on whether you are signed in and what your client supports.
 
 ## How We Use Information
 

diff --git a/mcp/oauth.mdx b/mcp/oauth.mdx
@@ -180,7 +180,7 @@ OAuth access tokens are valid only when `aud` is `https://mcp.proofable.me/mcp`,
 |-------|-------------|---------|
 | `neus:core` | Public protocol tools (context, catalog, public proof reads) | Yes |
 | `neus:profile` | Signed-in profile context and ownership checks | Yes |
-| `neus:secrets` | Portable encrypted secrets in Vault | Yes |
+| `neus:secrets` | Stored credentials on your profile, used by Proofable's own runs. A connection carries no tool that handles one | Yes |
 | `offline_access` | Refresh token so the client can stay signed in | Yes |
 
 These four scopes are the complete public permission model. Server keys (`npk_*`) are a full-profile credential.

diff --git a/mcp/secrets.mdx b/mcp/secrets.mdx
@@ -16,16 +16,16 @@ Save a key once and use it everywhere you work with Proofable. Nothing needs to
 | ----- | ------------------- |
 | **Proofable assistant** | Pick the provider in the assistant. Proofable calls it with your saved key instead of the included model access. |
 | **Jobs** | A job that runs on your provider uses the same saved key for its model calls. |
-| **ChatGPT, Claude, Cursor, and other MCP apps** | **`proofable_capability_call`** calls the provider with your saved key. The app receives the provider's answer, never the key. |
-| **Remote MCP connections** | Headers for a saved MCP connection are stored the same way and sent only to that server. |
+| **Proofable platform** | A job, an agent, a connected app or the assistant uses the key on your behalf. You receive the answer, never the key. |
 | **Agents you create** | Bind a secret to an agent. The agent can use it through Proofable, but cannot read it. |
 
 ## Add a key
 
-- **Profile → Secrets (recommended).** The value goes from your browser straight to Proofable.
-- **From an AI app with `proofable_secret_create`.** This works, but the value you type passes through that app's conversation first. Use the Secrets page for production credentials.
+- **Profile → Secrets.** The value goes from your browser straight to Proofable.
 
-Name a key after its provider, such as `OPENAI_API_KEY` or `ANTHROPIC_API_KEY`, so Proofable knows which provider it belongs to. For a provider Proofable does not recognize, pass `tags: ["provider:<id>"]` to `proofable_secret_create`.
+Saving a key belongs to Proofable itself, where the agent never handles the value. A key typed into an AI app's conversation has already been disclosed to that app, so this endpoint carries no way to submit one.
+
+Name a key after its provider, such as `OPENAI_API_KEY` or `ANTHROPIC_API_KEY`, so Proofable knows which provider it belongs to. For a provider Proofable does not recognize, add a `provider:<id>` tag when you save it.
 
 ## Common questions
 
@@ -41,51 +41,9 @@ Name a key after its provider, such as `OPENAI_API_KEY` or `ANTHROPIC_API_KEY`,
 
 **Does Proofable use its own keys?** The included assistant tiers use Proofable's model access. When you add your own key for a provider, your requests to that provider use your key.
 
-## MCP tools
-
-Sign in first with OAuth or a server key ([Auth](./auth)). When signed in, omit `walletAddress`; secrets bind to the profile from **`proofable_context`**.
-
-| Tool | Purpose |
-| ---- | ------- |
-| **`proofable_secret_create`** | Save or replace a named secret |
-| **`proofable_secret_list`** | List secret names, types, and update times. No values |
-| **`proofable_secret_revoke`** | Permanently delete a secret by proof ID |
-
-### Create
-
-```json
-{
-  "alias": "OPENAI_API_KEY",
-  "secretType": "single",
-  "content": "<your-secret-value>"
-}
-```
-
-| Field | Notes |
-| ----- | ----- |
-| `alias` | Letters, numbers, and underscores; starts with a letter |
-| `secretType` | `single` (default), `bundle` (key-value JSON), or `json` (one sealed JSON document) |
-| `content` | The value to save. It is never returned |
-| `tags` | Optional. `provider:<id>` links the secret to a provider Proofable does not infer from the alias |
-| `walletAddress` | Optional when signed in; must match the signed-in profile if set |
-
-Saving the same alias again revokes the older record. The result lists revoked proof IDs in `superseded`. If revocation fails after the new save, the tool reports `secret_replacement_incomplete` with both proof IDs so you can retry or revoke the older one.
-
-### List
-
-```json
-{ "limit": 50, "offset": 0 }
-```
-
-Without sign-in, the tool returns an empty list with `authRequired: true` and no metadata.
-
-### Revoke
-
-```json
-{ "qHash": "..." }
-```
+## Where a saved key is used
 
-Requires ownership of the secret. Omit `walletAddress` when signed in.
+The vault is a platform feature of Proofable rather than part of an MCP connection. A saved key is used by runs the platform performs for you (the assistant, a job, an agent, a connected app), and it is never returned to a client, an agent, or the app you are using. A connection cannot create, list or revoke a secret: those tools answer `platform_only` and point at [Proofable](https://proofable.me) and the [product API](/reference).
 
 <CardGroup cols={2}>
   <Card title="Auth" icon="lock" href="./auth">

diff --git a/mcp/tools.mdx b/mcp/tools.mdx
@@ -1,9 +1,11 @@
 ---
 title: MCP tools
-description: "The complete hosted MCP tool reference: reuse current proofs before creating new ones, then verify, mount agents, and manage secrets."
+description: "The hosted MCP trust layer: prove something once, reuse the proof, and hold an agent to a scoped permission."
 icon: wrench
 ---
 
+Proofable's MCP endpoint carries the trust layer. Prove identity, ownership or permission; reuse an existing proof instead of verifying it again; and give an agent a permission you can revoke. Work that needs the Proofable platform to *run* something happens in Proofable, and the proof it produces comes back here to be checked, shared and reused.
+
 Call **`proofable_context`** once, then pick the tool for the job.
 
 | Job | Tool | What it does |
@@ -17,44 +19,24 @@ Call **`proofable_context`** once, then pick the tool for the job.
 | Submit an outside signature | `proofable_verify_submit` | Creates the proof from a signed prepared check. |
 | Read a proof | `proofable_proofs_get` | Current proof records and status. |
 | Update or review a proof | `proofable_proofs_update` | Change title/tags, vote, or comment on the same proof. |
+| Revoke a proof | `proofable_proof_revoke` | Removes a proof from public access. |
 | Create or import an agent | `proofable_agent_create` | Links the agent to your profile. Optional separate spend account and controls. Pass an existing account address for dedicated spend. |
 | Confirm the agent is ready | `proofable_agent_link` | Identity and the permissions that account needs. |
 | Load the agent | `proofable_agent_mount` | Identity, permissions, skills, and current settings. |
-| Store or replace a secret | `proofable_secret_create` | Encrypted Vault secret; the same alias replaces its prior value. |
-| List secrets | `proofable_secret_list` | Stored names and details. Never the secret itself. |
-| Revoke a secret | `proofable_secret_revoke` | Removes a stored secret by proof ID. |
 | List agents | `proofable_agents_list` | Agent identities and delegations on the profile. |
-| Revoke a proof | `proofable_proof_revoke` | Removes a proof from public access. |
-| Save a session note | `proofable_session_receipt_create` / `proofable_session_receipt_append` | Private receipt in your account; append adds to an existing one. |
-| Create or update a tool | `proofable_skill_tool_create_or_update` | A JavaScript tool or skill, run only when you or an agent invokes it. |
-
-## Research and browsing tools
-
-These reach the public web. Use search and fetch for reading, and the browser only when a page needs a click, JavaScript, or a visual check.
 
-| Job | Tool | What it does |
-|---|---|---|
-| Search the web | `proofable_web_search` | Structured results; optionally retrieves each page as text. |
-| Read a page | `proofable_url_fetch` | Clean page text from a public URL. Private and metadata hosts are refused. |
-| Operate a page | `proofable_browser` | Open, observe, click, type, screenshot and read console in an isolated job session. |
-| Call a connected app | `proofable_composio_search` / `proofable_composio_execute` | Find and run an action on Gmail, Drive, GitHub, Slack and similar apps. |
-| Call a saved provider key | `proofable_capability_call` | Sends a request to a BYOK provider with the API key you saved for it. |
-| Add an MCP server | `proofable_mcp_connection_create` / `proofable_mcp_connections_list` / `proofable_mcp_connection_delete` | Save, list or remove a remote MCP server for this account. |
-| Use an MCP server | `proofable_mcp_tools_list` / `proofable_mcp_tool_execute` | List that server's tools and run one. |
+## What this endpoint does not carry
 
-An action that would create an external side effect needs approval first. Actions that reach another business system go through `proofable_composio_execute`, which is permissioned.
+The platform runtime stays in the product, not on the protocol surface:
 
-## Job tools
+- **Work the platform runs:** background and scheduled jobs, the hosted browser, sandboxes, hosted model inference.
+- **Integrations:** connected apps (Gmail, Drive, GitHub, Slack and similar), a saved provider key, remote MCP servers.
+- **Storage:** the encrypted vault, and the private records Proofable writes to hold something for you.
+- **What your client already does:** web search and page fetch.
 
-Signed-in connections get the job tools on every plan. Each run uses your credits and stays within the permissions on your profile. `tools/list` returns the full set your connection can call.
+Those run in Proofable or in the SDK against the product API, where the run holds its own permission, a human approves side effects, and the result is a proof, which comes back to this endpoint to be checked and reused. Calling one of them here returns `platform_only` and says where the work belongs.
 
-| Job | Tool | What it does |
-|---|---|---|
-| Start work | `proofable_job_create` | Run agent work now or on a schedule. |
-| List work | `proofable_job_list` | List jobs available to the signed-in profile. |
-| Inspect work | `proofable_job_get` | Read one job and its latest run state. |
-| Approve a step | `proofable_job_decide` | Approve or deny a run that is waiting for approval. |
-| Stop work | `proofable_job_cancel` | Cancel a run or recurring schedule. |
+That is a boundary, not a plan limit: no plan unlocks the runtime through a connection, and the refusal never sells one. A connection should carry proof and authority. A general execution surface would rent out the platform, bill for work the client can already do, and turn a trust primitive into a proxy.
 
 | Topic | Detail |
 |-------|--------|
@@ -80,7 +62,6 @@ Wallet address in native format, or `did:pkh:…`. Delegated reads: **`agentWall
 | Default | Connect → **`proofable_context`** → **`proofable_agent_link`** for agents → **`proofable_verify_or_guide`** before sensitive actions |
 | Project agent | **`proofable_agent_mount`** or `proofable mount <agentId> --apply <host>` in the repo |
 | Details | **`proofable_proofs_get`** for proof records, tags, delegated context, and proof fields |
-| Secrets | **`proofable_secret_list`** / **`proofable_secret_create`** / **`proofable_secret_revoke`** when auth is configured ([Secrets](./secrets)) |
 | Fallback | **`proofable_verify_or_guide`** only when something is missing |
 | Catalog | **`proofable_verifiers_catalog`** only when you need raw schemas beyond the compact `verifierSummary` in `proofable_context` |
 
@@ -119,7 +100,4 @@ Same flow as [Overview](./overview).
   <Card title="Connect agent context" icon="layer-group" href="../agents/runtime-mount">
     Load identity, permissions, and skills into a project.
   </Card>
-  <Card title="Secrets" icon="key" href="./secrets">
-    Store and revoke encrypted Vault secrets.
-  </Card>
 </CardGroup>
diff --git a/pricing.mdx b/pricing.mdx
@@ -34,6 +34,12 @@ Hosted sign-in and profile, Hosted Verify and reusable proofs, agent identity an
 | Your own model key | 0 for tokens |
 | Hosted computer or job machine | 2 per vCPU for each started minute; the standard browser machine is 2 vCPUs, so 4 a minute |
 
+## What a tool call costs
+
+Signing in, checking a saved proof, and reading your own profile, proofs and agents are free. Creating a proof is charged as a check below; the trust layer adds nothing on top of it.
+
+The platform runtime is not on the MCP endpoint. Jobs, the hosted computer, connected apps, a saved provider key, remote MCP servers, web search and page fetch run in Proofable and are charged there as the job or the inference above. [MCP tools](/mcp/tools) lists what a connection does carry.
+
 ## What checks cost
 
 One credit lists at $0.0025.
-Original file line number
+Diff line change
@@ Expand Up @@
     Cancel a run to stop it and keep the receipt. Remove a run only when you want to delete that receipt. Stop a recurring schedule, or queue a run again from the job.
-    Through MCP, any signed-in profile has the same four job actions: `proofable_job_create`, `proofable_job_list`, `proofable_job_get`, and `proofable_job_cancel`. Other app tools stay on proofable.me.
+    Jobs are platform runtime: they run here, under the permissions on your profile, and each completed run keeps a receipt you can open and verify. An MCP connection does not carry the job tools, because a connection is for proof and permission, so `proofable_job_create` on that endpoint answers `platform_only`. Start and manage runs in Proofable, or through the product API.
     ## Next
@@ Expand Down @@