From de1455488a09a57271a850eed4bc348dc17e5f8a Mon Sep 17 00:00:00 2001 From: chrisjleal <184772742+chrisjleal@users.noreply.github.com> Date: Sun, 25 Oct 2026 12:00:49 -0500 Subject: [PATCH 1/3] The tools page lists what a connection carries again Jobs, the hosted browser, connected apps, session notes, saved tools, web search and page fetch are on every signed-in connection, on credits. The tools, jobs, pricing, overview and privacy pages said a connection refused them. They now list them with the per-call rates, and name the three things that stay off a connection: saving a key, spending a saved key, and relaying to a remote MCP server. Co-Authored-By: Claude Opus 5.5 --- CHANGELOG.md | 4 +-- jobs.mdx | 2 +- learn/legal/privacy-policy.mdx | 4 +-- mcp/overview.mdx | 2 +- mcp/tools.mdx | 53 ++++++++++++++++++++++++++-------- pricing.mdx | 10 +++++-- 6 files changed, 55 insertions(+), 20 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 59be9f2..fb028c3 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -17,12 +17,12 @@ Product release notes: [docs.proofable.me/changelog](https://docs.proofable.me/c ### Changed -- **The hosted MCP surface carries the trust layer.** [MCP tools](/mcp/tools) lists the proof and permission tools a connection is offered, and states what runs on the platform instead: jobs, the hosted browser, connected apps, a saved provider key, remote MCP servers, web search and page fetch, and the vault. Calling one of those from a connection answers `platform_only` and says where the work belongs, on every plan. [Secrets](/mcp/secrets) saves a key on your profile rather than through a client, and the [OAuth scope table](/mcp/oauth) says which tools each scope reaches. +- **What a connection carries.** [MCP tools](/mcp/tools) lists every tool a signed-in connection gets on every plan: the proof and permission tools, jobs, the hosted browser, connected apps, session notes, saved tools, web search and page fetch, each on your credits and within your permissions. Web search, page fetch and connected-app actions are metered per call, and [Pricing](/pricing) lists the rates. Saving or spending a provider key and relaying to a remote MCP server stay off a connection and answer `platform_only`: [Secrets](/mcp/secrets) saves a key on your profile rather than through a client, and the [OAuth scope table](/mcp/oauth) says what each scope reaches. - **One Evidence page.** [Evidence](/evidence) opens on seven results across governance and runtime cost: 48 of 48 AgentGovBench scenarios beside the agent tools teams already use, 6 of 6 data-theft attempts refused by a scoped permission in the prompt injection test, every unauthorized action stopped in 8 of 8 live tests, $0.024 vs $0.078 handing work between agents with a signed receipt (catching 3 of 3 tampered handoffs), 42.4 times fewer tokens (105,347 vs 4,462,980) reading typed vault state over keyword search, 3.1 times lower worst-case token tail against open-web search, and a reused result about 750 times faster to verify offline than redoing the job. Its charts switch to a stacked layout on phones. Each result links to its signed record and a way to check or rerun it, and security reviewers get the OWASP, EU AI Act, NIST and CAIP-380 mapping in one section. `/benchmarks` and `/use-cases/authority-at-dispatch` now open it. - **Jobs and the hosted computer on every plan; Advanced on Pro.** [Jobs](/jobs) and [Pricing](/pricing) list what a run costs: 1 credit per run on any model or key, hosted tokens by tier, and 2 credits per vCPU for each started minute of a hosted machine. The Advanced hosted tier is on Pro, Partner and Enterprise; any model runs on your own key on every plan. - **Two checks you can run on the published records.** `public/evidence/checks/tamper-check.mjs` forges each signed record ten ways and confirms every copy is rejected offline; `reuse-check.mjs` times reading and verifying a finished result with no account. - **A fresh run of the eight authority cases on the live service.** All eight passed on the revision production was serving, with 17 signed records. Requests that should not have been allowed were refused before any job ran; the case that needs approval waited for it and then ran; and a valid request ran alongside the refusals to show the check can pass. The records need no account to read or verify, and the run lives at `public/evidence/aaif/authority-at-dispatch/2026-10-24-served/`. -- **Jobs run on credits on every plan.** [Jobs](/jobs) says what a run costs and where it runs, and the team-agents and reproduce guides no longer say jobs need Pro. A connection does not carry the job tools. +- **Jobs run on credits on every plan.** [Jobs](/jobs) says what a run costs and lists the job tools a connection carries, and the team-agents and reproduce guides no longer say jobs need Pro. - **Agent id format is in the schemas.** `agentId` in `agent-identity` and `agent-delegation` is 1 to 128 letters, digits, hyphens or underscores, the same id the agent page uses. ### Removed diff --git a/jobs.mdx b/jobs.mdx index 4b5e773..68d6759 100644 --- a/jobs.mdx +++ b/jobs.mdx @@ -70,7 +70,7 @@ Completed runs keep a receipt: a proof of what the job did. Open it from the run Cancel a run to stop it and keep the receipt. Remove a run only when you want to delete that receipt. Stop a recurring schedule, or queue a run again from the job. -Jobs are platform runtime: they run here, under the permissions on your profile, and each completed run keeps a receipt you can open and verify. An MCP connection does not carry the job tools, because a connection is for proof and permission, so `proofable_job_create` on that endpoint answers `platform_only`. Start and manage runs in Proofable, or through the product API. +Through MCP, any signed-in profile has the job tools on every plan: `proofable_job_create`, `proofable_job_list`, `proofable_job_get`, `proofable_job_decide`, and `proofable_job_cancel`. A run started from a client costs the same as one started here and stays within the permissions on your profile. ## Next diff --git a/learn/legal/privacy-policy.mdx b/learn/legal/privacy-policy.mdx index d04257a..13fef39 100644 --- a/learn/legal/privacy-policy.mdx +++ b/learn/legal/privacy-policy.mdx @@ -4,7 +4,7 @@ description: How Proofable collects, uses, protects, and shares personal informa icon: shield --- -Effective date: July 26, 2026. Last updated: October 21, 2026. +Effective date: July 26, 2026. Last updated: October 25, 2026. This Privacy Policy explains how NEUS Network, Inc. ("Proofable," "we," "us," or "our") handles personal information when you use the Proofable website, application, APIs, hosted Model Context Protocol (MCP) service, the Proofable tools an MCP client calls, agent and job execution, verification services, and related products (collectively, the "Service"). @@ -93,7 +93,7 @@ The tool names above map to this policy as follows, so you can check any single | `proofable_mcp_connection_create`, `proofable_mcp_connections_list`, `proofable_mcp_connection_delete` | MCP connection | | `proofable_mcp_tools_list`, `proofable_mcp_tool_execute` | Capability call and tool execution | -This table covers Proofable's tools, whether a connection can call them or not, because the data each one handles is disclosed the same way either way. The proof and permission tools (reading the profile, the verifier catalog, proofs, agents, and creating, updating or revoking a proof) are the ones the hosted MCP service exposes. The platform tools (jobs, the browser, connected apps, provider calls, saved secrets, saved tools, session receipts, page fetch and web search) run inside Proofable rather than over a connection. A client may show a different subset depending on whether you are signed in and what your client supports. +This table covers Proofable's tools, whether a connection can call them or not, because the data each one handles is disclosed the same way either way. A signed-in connection to the hosted MCP service can call every tool above except the saved-secret tools, the provider call, and the MCP connection and tool execution tools, which run only inside Proofable. A client may show a different subset depending on whether you are signed in and what your client supports. ## How We Use Information diff --git a/mcp/overview.mdx b/mcp/overview.mdx index e19cde4..5971967 100644 --- a/mcp/overview.mdx +++ b/mcp/overview.mdx @@ -30,7 +30,7 @@ Proofable returns **Passed**, **Action needed**, or **Blocked**. It reuses a cur - Check whether you already hold the proof a task requires. - Show the next verification step only when a current proof is missing. - Load an agent's current identity, permissions, skills, and selected context. -- Save credentials in encrypted Vault records without returning their values in chat. +- Run jobs, the hosted browser and connected apps on your credits, within the permissions on your profile. - Read the same authorized profile and proofs across supported MCP clients. Call `proofable_context` once after connecting. Use the [MCP tool reference](./tools) for exact inputs and result shapes. diff --git a/mcp/tools.mdx b/mcp/tools.mdx index fe8fe4b..f76288e 100644 --- a/mcp/tools.mdx +++ b/mcp/tools.mdx @@ -1,12 +1,10 @@ --- title: MCP tools -description: "The hosted MCP trust layer: prove something once, reuse the proof, and hold an agent to a scoped permission." +description: "The hosted MCP tool reference: reuse a proof before creating one, scope an agent's permission, and run jobs, the browser and connected apps on your credits." icon: wrench --- -Proofable's MCP endpoint carries the trust layer. Prove identity, ownership or permission; reuse an existing proof instead of verifying it again; and give an agent a permission you can revoke. Work that needs the Proofable platform to *run* something happens in Proofable, and the proof it produces comes back here to be checked, shared and reused. - -Call **`proofable_context`** once, then pick the tool for the job. +Call **`proofable_context`** once, then pick the tool for the job. A signed-in connection gets every tool on this page on every plan. Each call runs on your credits and within the permissions on your profile, and `tools/list` returns the set your connection can call. | Job | Tool | What it does | |---|---|---| @@ -25,18 +23,49 @@ Call **`proofable_context`** once, then pick the tool for the job. | Load the agent | `proofable_agent_mount` | Identity, permissions, skills, and current settings. | | List agents | `proofable_agents_list` | Agent identities and delegations on the profile. | -## What this endpoint does not carry +## Research and browsing tools + +These reach the public web. Use search and fetch for reading, and the browser only when a page needs a click, JavaScript, or a visual check. + +| Job | Tool | What it does | +|---|---|---| +| Search the web | `proofable_web_search` | Structured results; optionally retrieves each page as text. | +| Read a page | `proofable_url_fetch` | Clean page text from a public URL. Private and metadata hosts are refused. | +| Operate a page | `proofable_browser` | Open, observe, click, type, screenshot and read console in an isolated session. | +| Call a connected app | `proofable_composio_search` / `proofable_composio_execute` | Find and run an action on Gmail, Drive, GitHub, Slack and similar apps. | + +An action that would create an external side effect needs approval first. Actions that reach another business system go through `proofable_composio_execute`, which is permissioned. + +Prefer your own client's search, page fetch and browser. These are here for a client that has none, and each call is metered: `proofable_web_search` and `proofable_url_fetch` record 1 credit, and `proofable_composio_execute` records 2. The browser runs on your hosted computer, charged by the minute. [Pricing](/pricing) lists the rates. + +## Job tools + +| Job | Tool | What it does | +|---|---|---| +| Start work | `proofable_job_create` | Run agent work now or on a schedule. | +| List work | `proofable_job_list` | List jobs available to the signed-in profile. | +| Inspect work | `proofable_job_get` | Read one job and its latest run state. | +| Approve a step | `proofable_job_decide` | Approve or deny a run that is waiting for approval. | +| Stop work | `proofable_job_cancel` | Cancel a run or recurring schedule. | + +A run started here costs what [Jobs](/jobs) lists for a run started in Proofable. + +## Notes and saved tools + +| Job | Tool | What it does | +|---|---|---| +| Save a session note | `proofable_session_receipt_create` / `proofable_session_receipt_append` | Private receipt in your account; append adds to an existing one. | +| Create or update a tool | `proofable_skill_tool_create_or_update` | A JavaScript tool or skill, run only when you or an agent invokes it. | -The platform runtime stays in the product, not on the protocol surface: +## What a connection does not carry -- **Work the platform runs:** background and scheduled jobs, the hosted browser, sandboxes, hosted model inference. -- **Integrations:** connected apps (Gmail, Drive, GitHub, Slack and similar), a saved provider key, remote MCP servers. -- **Storage:** the encrypted vault, and the private records Proofable writes to hold something for you. -- **What your client already does:** web search and page fetch. +Three things stay off the MCP endpoint on every plan, because each one holds a credential or relays to a server your client can reach itself: -Those run in Proofable or in the SDK against the product API, where the run holds its own permission, a human approves side effects, and the result is a proof, which comes back to this endpoint to be checked and reused. Calling one of them here returns `platform_only` and says where the work belongs. +- **Saving, listing or removing a provider key.** A key typed into an AI app's conversation has already been disclosed to that app. Save keys on [Secrets](./secrets); a job or the assistant in Proofable uses them without the value reaching a client. +- **Calling a provider with a saved key.** Proofable's own runs do this for you. +- **Relaying to a remote MCP server.** Add that server to your client directly. -That is a boundary, not a plan limit: no plan unlocks the runtime through a connection, and the refusal never sells one. A connection should carry proof and authority. A general execution surface would rent out the platform, bill for work the client can already do, and turn a trust primitive into a proxy. +Calling one of these tools here answers `platform_only` and names where the work belongs. | Topic | Detail | |-------|--------| diff --git a/pricing.mdx b/pricing.mdx index 48afc4d..2879d0d 100644 --- a/pricing.mdx +++ b/pricing.mdx @@ -36,9 +36,15 @@ Hosted sign-in and profile, Hosted Verify and reusable proofs, agent identity an ## What a tool call costs -Signing in, checking a saved proof, and reading your own profile, proofs and agents are free. Creating a proof is charged as a check below; the trust layer adds nothing on top of it. +Signing in, checking a saved proof, and reading your own profile, proofs, agents and jobs are free. Creating a proof is charged as a check below. The calls that reach another service are metered per call: -The platform runtime is not on the MCP endpoint. Jobs, the hosted computer, connected apps, a saved provider key, remote MCP servers, web search and page fetch run in Proofable and are charged there as the job or the inference above. [MCP tools](/mcp/tools) lists what a connection does carry. +| Call | Credits | +|---|---| +| Web search (`proofable_web_search`) | 1 | +| Read a page (`proofable_url_fetch`) | 1 | +| Run a connected-app action (`proofable_composio_execute`) | 2 | + +A job started over MCP is charged as a job above, and operating a page with `proofable_browser` is charged as the hosted computer above. [MCP tools](/mcp/tools) lists every tool a connection carries. ## What checks cost From 1af064c84d9e41490780e4f8e7ab92be6be8f471 Mon Sep 17 00:00:00 2001 From: chrisjleal <184772742+chrisjleal@users.noreply.github.com> Date: Sun, 25 Oct 2026 12:33:18 -0500 Subject: [PATCH 2/3] A connection that is not offered a tool is told so in the words it gets A call to a vault or relay tool on a connection is rejected as an unknown tool, because the connection is never offered it. The copy said it answered platform_only. Co-Authored-By: Claude Opus 5.5 --- CHANGELOG.md | 2 +- mcp/secrets.mdx | 2 +- mcp/tools.mdx | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index fb028c3..bee8866 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -17,7 +17,7 @@ Product release notes: [docs.proofable.me/changelog](https://docs.proofable.me/c ### Changed -- **What a connection carries.** [MCP tools](/mcp/tools) lists every tool a signed-in connection gets on every plan: the proof and permission tools, jobs, the hosted browser, connected apps, session notes, saved tools, web search and page fetch, each on your credits and within your permissions. Web search, page fetch and connected-app actions are metered per call, and [Pricing](/pricing) lists the rates. Saving or spending a provider key and relaying to a remote MCP server stay off a connection and answer `platform_only`: [Secrets](/mcp/secrets) saves a key on your profile rather than through a client, and the [OAuth scope table](/mcp/oauth) says what each scope reaches. +- **What a connection carries.** [MCP tools](/mcp/tools) lists every tool a signed-in connection gets on every plan: the proof and permission tools, jobs, the hosted browser, connected apps, session notes, saved tools, web search and page fetch, each on your credits and within your permissions. Web search, page fetch and connected-app actions are metered per call, and [Pricing](/pricing) lists the rates. Saving or spending a provider key and relaying to a remote MCP server stay off a connection: [Secrets](/mcp/secrets) saves a key on your profile rather than through a client, and the [OAuth scope table](/mcp/oauth) says what each scope reaches. - **One Evidence page.** [Evidence](/evidence) opens on seven results across governance and runtime cost: 48 of 48 AgentGovBench scenarios beside the agent tools teams already use, 6 of 6 data-theft attempts refused by a scoped permission in the prompt injection test, every unauthorized action stopped in 8 of 8 live tests, $0.024 vs $0.078 handing work between agents with a signed receipt (catching 3 of 3 tampered handoffs), 42.4 times fewer tokens (105,347 vs 4,462,980) reading typed vault state over keyword search, 3.1 times lower worst-case token tail against open-web search, and a reused result about 750 times faster to verify offline than redoing the job. Its charts switch to a stacked layout on phones. Each result links to its signed record and a way to check or rerun it, and security reviewers get the OWASP, EU AI Act, NIST and CAIP-380 mapping in one section. `/benchmarks` and `/use-cases/authority-at-dispatch` now open it. - **Jobs and the hosted computer on every plan; Advanced on Pro.** [Jobs](/jobs) and [Pricing](/pricing) list what a run costs: 1 credit per run on any model or key, hosted tokens by tier, and 2 credits per vCPU for each started minute of a hosted machine. The Advanced hosted tier is on Pro, Partner and Enterprise; any model runs on your own key on every plan. - **Two checks you can run on the published records.** `public/evidence/checks/tamper-check.mjs` forges each signed record ten ways and confirms every copy is rejected offline; `reuse-check.mjs` times reading and verifying a finished result with no account. diff --git a/mcp/secrets.mdx b/mcp/secrets.mdx index 7c5f9d3..338f25f 100644 --- a/mcp/secrets.mdx +++ b/mcp/secrets.mdx @@ -43,7 +43,7 @@ Name a key after its provider, such as `OPENAI_API_KEY` or `ANTHROPIC_API_KEY`, ## Where a saved key is used -The vault is a platform feature of Proofable rather than part of an MCP connection. A saved key is used by runs the platform performs for you (the assistant, a job, an agent, a connected app), and it is never returned to a client, an agent, or the app you are using. A connection cannot create, list or revoke a secret: those tools answer `platform_only` and point at [Proofable](https://proofable.me) and the [product API](/reference). +The vault is a platform feature of Proofable rather than part of an MCP connection. A saved key is used by runs the platform performs for you (the assistant, a job, an agent, a connected app), and it is never returned to a client, an agent, or the app you are using. A connection does not offer the tools that create, list or revoke a secret. Manage keys in [Proofable](https://proofable.me/profile?tab=secrets) or through the [product API](/reference). diff --git a/mcp/tools.mdx b/mcp/tools.mdx index f76288e..5a64d40 100644 --- a/mcp/tools.mdx +++ b/mcp/tools.mdx @@ -65,7 +65,7 @@ Three things stay off the MCP endpoint on every plan, because each one holds a c - **Calling a provider with a saved key.** Proofable's own runs do this for you. - **Relaying to a remote MCP server.** Add that server to your client directly. -Calling one of these tools here answers `platform_only` and names where the work belongs. +A connection does not list these tools, and a call to one is rejected as an unknown tool. | Topic | Detail | |-------|--------| From faecb2087fa2210be72f4adc9aa1842f3be6ea5b Mon Sep 17 00:00:00 2001 From: chrisjleal <184772742+chrisjleal@users.noreply.github.com> Date: Sun, 25 Oct 2026 14:05:33 -0500 Subject: [PATCH 3/3] The tools page lists saved keys and remote MCP servers on every plan Listing or removing a saved key, calling a provider with one, and running a saved remote MCP server are on every signed-in connection, metered like the other calls. Only saving a key stays off a connection; it happens on the profile. Co-Authored-By: Claude Opus 5.5 --- CHANGELOG.md | 2 +- learn/legal/privacy-policy.mdx | 2 +- mcp/oauth.mdx | 2 +- mcp/secrets.mdx | 2 +- mcp/tools.mdx | 21 +++++++++++++++------ pricing.mdx | 2 ++ 6 files changed, 21 insertions(+), 10 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index bee8866..0c61a74 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -17,7 +17,7 @@ Product release notes: [docs.proofable.me/changelog](https://docs.proofable.me/c ### Changed -- **What a connection carries.** [MCP tools](/mcp/tools) lists every tool a signed-in connection gets on every plan: the proof and permission tools, jobs, the hosted browser, connected apps, session notes, saved tools, web search and page fetch, each on your credits and within your permissions. Web search, page fetch and connected-app actions are metered per call, and [Pricing](/pricing) lists the rates. Saving or spending a provider key and relaying to a remote MCP server stay off a connection: [Secrets](/mcp/secrets) saves a key on your profile rather than through a client, and the [OAuth scope table](/mcp/oauth) says what each scope reaches. +- **What a connection carries.** [MCP tools](/mcp/tools) lists every tool a signed-in connection gets on every plan: the proof and permission tools, jobs, the hosted browser, connected apps, session notes, saved tools, web search, page fetch, remote MCP servers run through Proofable, and your saved keys (list, remove, or call a provider with one, never reading the key back). Web search, page fetch, connected-app actions and remote server calls are metered per call, and [Pricing](/pricing) lists the rates. A key is saved on your profile rather than through a client ([Secrets](/mcp/secrets)), and the [OAuth scope table](/mcp/oauth) says what each scope reaches. - **One Evidence page.** [Evidence](/evidence) opens on seven results across governance and runtime cost: 48 of 48 AgentGovBench scenarios beside the agent tools teams already use, 6 of 6 data-theft attempts refused by a scoped permission in the prompt injection test, every unauthorized action stopped in 8 of 8 live tests, $0.024 vs $0.078 handing work between agents with a signed receipt (catching 3 of 3 tampered handoffs), 42.4 times fewer tokens (105,347 vs 4,462,980) reading typed vault state over keyword search, 3.1 times lower worst-case token tail against open-web search, and a reused result about 750 times faster to verify offline than redoing the job. Its charts switch to a stacked layout on phones. Each result links to its signed record and a way to check or rerun it, and security reviewers get the OWASP, EU AI Act, NIST and CAIP-380 mapping in one section. `/benchmarks` and `/use-cases/authority-at-dispatch` now open it. - **Jobs and the hosted computer on every plan; Advanced on Pro.** [Jobs](/jobs) and [Pricing](/pricing) list what a run costs: 1 credit per run on any model or key, hosted tokens by tier, and 2 credits per vCPU for each started minute of a hosted machine. The Advanced hosted tier is on Pro, Partner and Enterprise; any model runs on your own key on every plan. - **Two checks you can run on the published records.** `public/evidence/checks/tamper-check.mjs` forges each signed record ten ways and confirms every copy is rejected offline; `reuse-check.mjs` times reading and verifying a finished result with no account. diff --git a/learn/legal/privacy-policy.mdx b/learn/legal/privacy-policy.mdx index 13fef39..db0f0f6 100644 --- a/learn/legal/privacy-policy.mdx +++ b/learn/legal/privacy-policy.mdx @@ -93,7 +93,7 @@ The tool names above map to this policy as follows, so you can check any single | `proofable_mcp_connection_create`, `proofable_mcp_connections_list`, `proofable_mcp_connection_delete` | MCP connection | | `proofable_mcp_tools_list`, `proofable_mcp_tool_execute` | Capability call and tool execution | -This table covers Proofable's tools, whether a connection can call them or not, because the data each one handles is disclosed the same way either way. A signed-in connection to the hosted MCP service can call every tool above except the saved-secret tools, the provider call, and the MCP connection and tool execution tools, which run only inside Proofable. A client may show a different subset depending on whether you are signed in and what your client supports. +This table covers Proofable's tools, whether a connection can call them or not, because the data each one handles is disclosed the same way either way. A signed-in connection to the hosted MCP service can call every tool above except saving a secret, which happens only inside Proofable. A client may show a different subset depending on whether you are signed in and what your client supports. ## How We Use Information diff --git a/mcp/oauth.mdx b/mcp/oauth.mdx index 44586e6..ffe4771 100644 --- a/mcp/oauth.mdx +++ b/mcp/oauth.mdx @@ -180,7 +180,7 @@ OAuth access tokens are valid only when `aud` is `https://mcp.proofable.me/mcp`, |-------|-------------|---------| | `neus:core` | Public protocol tools (context, catalog, public proof reads) | Yes | | `neus:profile` | Signed-in profile context and ownership checks | Yes | -| `neus:secrets` | Stored credentials on your profile, used by Proofable's own runs. A connection carries no tool that handles one | Yes | +| `neus:secrets` | Saved keys on your profile: list or remove one, or call a provider with one. A key is saved in Proofable, never through a tool | Yes | | `offline_access` | Refresh token so the client can stay signed in | Yes | These four scopes are the complete public permission model. Server keys (`npk_*`) are a full-profile credential. diff --git a/mcp/secrets.mdx b/mcp/secrets.mdx index 338f25f..02ac485 100644 --- a/mcp/secrets.mdx +++ b/mcp/secrets.mdx @@ -43,7 +43,7 @@ Name a key after its provider, such as `OPENAI_API_KEY` or `ANTHROPIC_API_KEY`, ## Where a saved key is used -The vault is a platform feature of Proofable rather than part of an MCP connection. A saved key is used by runs the platform performs for you (the assistant, a job, an agent, a connected app), and it is never returned to a client, an agent, or the app you are using. A connection does not offer the tools that create, list or revoke a secret. Manage keys in [Proofable](https://proofable.me/profile?tab=secrets) or through the [product API](/reference). +The vault is a platform feature of Proofable rather than part of an MCP connection. A saved key is used by runs the platform performs for you (the assistant, a job, an agent, a connected app), and it is never returned to a client, an agent, or the app you are using. Save a key in [Proofable](https://proofable.me/profile?tab=secrets) or through the [product API](/reference), never through a tool. A signed-in connection can list your saved keys (names only), remove one, and call a provider with one through `proofable_capability_call`, which returns the provider's answer and never the key. diff --git a/mcp/tools.mdx b/mcp/tools.mdx index 5a64d40..d1a7fb6 100644 --- a/mcp/tools.mdx +++ b/mcp/tools.mdx @@ -57,15 +57,24 @@ A run started here costs what [Jobs](/jobs) lists for a run started in Proofable | Save a session note | `proofable_session_receipt_create` / `proofable_session_receipt_append` | Private receipt in your account; append adds to an existing one. | | Create or update a tool | `proofable_skill_tool_create_or_update` | A JavaScript tool or skill, run only when you or an agent invokes it. | -## What a connection does not carry +## Saved keys -Three things stay off the MCP endpoint on every plan, because each one holds a credential or relays to a server your client can reach itself: +| Job | Tool | What it does | +|---|---|---| +| List saved keys | `proofable_secret_list` | Names and update times. Never a value. | +| Remove a saved key | `proofable_secret_revoke` | Deletes a saved key by proof ID. | +| Call a provider with a saved key | `proofable_capability_call` | Proofable sends the request with your key and returns the provider's answer. The key never reaches the client. | + +Save a key on [Secrets](./secrets), not through a tool. A key typed into an AI app's conversation has already been disclosed to that app. -- **Saving, listing or removing a provider key.** A key typed into an AI app's conversation has already been disclosed to that app. Save keys on [Secrets](./secrets); a job or the assistant in Proofable uses them without the value reaching a client. -- **Calling a provider with a saved key.** Proofable's own runs do this for you. -- **Relaying to a remote MCP server.** Add that server to your client directly. +## Remote MCP servers -A connection does not list these tools, and a call to one is rejected as an unknown tool. +Save another MCP server on your profile and run its tools through Proofable, so each call carries your permissions and leaves a receipt. + +| Job | Tool | What it does | +|---|---|---| +| Save, list or remove a server | `proofable_mcp_connection_create` / `proofable_mcp_connections_list` / `proofable_mcp_connection_delete` | The server's URL and headers, stored encrypted on your profile. | +| Use a server | `proofable_mcp_tools_list` / `proofable_mcp_tool_execute` | List its tools and run one. Each run records 1 credit. Private and metadata hosts are refused. | | Topic | Detail | |-------|--------| diff --git a/pricing.mdx b/pricing.mdx index 2879d0d..50a2c77 100644 --- a/pricing.mdx +++ b/pricing.mdx @@ -43,6 +43,8 @@ Signing in, checking a saved proof, and reading your own profile, proofs, agents | Web search (`proofable_web_search`) | 1 | | Read a page (`proofable_url_fetch`) | 1 | | Run a connected-app action (`proofable_composio_execute`) | 2 | +| Run a tool on a saved remote MCP server (`proofable_mcp_tool_execute`) | 1 | +| Call a provider with your saved key (`proofable_capability_call`) | 0 | A job started over MCP is charged as a job above, and operating a page with `proofable_browser` is charged as the hosted computer above. [MCP tools](/mcp/tools) lists every tool a connection carries.