MCP tools by plan, saved keys and remote servers on every plan

CHANGELOG.md

@@ -17,12 +17,12 @@ Product release notes: [docs.proofable.me/changelog](https://docs.proofable.me/c
 
 ### Changed
 
-- **The hosted MCP surface carries the trust layer.** [MCP tools](/mcp/tools) lists the proof and permission tools a connection is offered, and states what runs on the platform instead: jobs, the hosted browser, connected apps, a saved provider key, remote MCP servers, web search and page fetch, and the vault. Calling one of those from a connection answers `platform_only` and says where the work belongs, on every plan. [Secrets](/mcp/secrets) saves a key on your profile rather than through a client, and the [OAuth scope table](/mcp/oauth) says which tools each scope reaches.
+- **What a connection carries.** [MCP tools](/mcp/tools) lists every tool a signed-in connection gets on every plan: the proof and permission tools, jobs, the hosted browser, connected apps, session notes, saved tools, web search, page fetch, remote MCP servers run through Proofable, and your saved keys (list, remove, or call a provider with one, never reading the key back). Web search, page fetch, connected-app actions and remote server calls are metered per call, and [Pricing](/pricing) lists the rates. A key is saved on your profile rather than through a client ([Secrets](/mcp/secrets)), and the [OAuth scope table](/mcp/oauth) says what each scope reaches.
 - **One Evidence page.** [Evidence](/evidence) opens on seven results across governance and runtime cost: 48 of 48 AgentGovBench scenarios beside the agent tools teams already use, 6 of 6 data-theft attempts refused by a scoped permission in the prompt injection test, every unauthorized action stopped in 8 of 8 live tests, $0.024 vs $0.078 handing work between agents with a signed receipt (catching 3 of 3 tampered handoffs), 42.4 times fewer tokens (105,347 vs 4,462,980) reading typed vault state over keyword search, 3.1 times lower worst-case token tail against open-web search, and a reused result about 750 times faster to verify offline than redoing the job. Its charts switch to a stacked layout on phones. Each result links to its signed record and a way to check or rerun it, and security reviewers get the OWASP, EU AI Act, NIST and CAIP-380 mapping in one section. `/benchmarks` and `/use-cases/authority-at-dispatch` now open it.
 - **Jobs and the hosted computer on every plan; Advanced on Pro.** [Jobs](/jobs) and [Pricing](/pricing) list what a run costs: 1 credit per run on any model or key, hosted tokens by tier, and 2 credits per vCPU for each started minute of a hosted machine. The Advanced hosted tier is on Pro, Partner and Enterprise; any model runs on your own key on every plan.
 - **Two checks you can run on the published records.** `public/evidence/checks/tamper-check.mjs` forges each signed record ten ways and confirms every copy is rejected offline; `reuse-check.mjs` times reading and verifying a finished result with no account.
 - **A fresh run of the eight authority cases on the live service.** All eight passed on the revision production was serving, with 17 signed records. Requests that should not have been allowed were refused before any job ran; the case that needs approval waited for it and then ran; and a valid request ran alongside the refusals to show the check can pass. The records need no account to read or verify, and the run lives at `public/evidence/aaif/authority-at-dispatch/2026-10-24-served/`.
-- **Jobs run on credits on every plan.** [Jobs](/jobs) says what a run costs and where it runs, and the team-agents and reproduce guides no longer say jobs need Pro. A connection does not carry the job tools.
+- **Jobs run on credits on every plan.** [Jobs](/jobs) says what a run costs and lists the job tools a connection carries, and the team-agents and reproduce guides no longer say jobs need Pro.
 - **Agent id format is in the schemas.** `agentId` in `agent-identity` and `agent-delegation` is 1 to 128 letters, digits, hyphens or underscores, the same id the agent page uses.
 
 ### Removed

jobs.mdx

@@ -70,7 +70,7 @@ Completed runs keep a receipt: a proof of what the job did. Open it from the run
 
 Cancel a run to stop it and keep the receipt. Remove a run only when you want to delete that receipt. Stop a recurring schedule, or queue a run again from the job.
 
-Jobs are platform runtime: they run here, under the permissions on your profile, and each completed run keeps a receipt you can open and verify. An MCP connection does not carry the job tools, because a connection is for proof and permission, so `proofable_job_create` on that endpoint answers `platform_only`. Start and manage runs in Proofable, or through the product API.
+Through MCP, any signed-in profile has the job tools on every plan: `proofable_job_create`, `proofable_job_list`, `proofable_job_get`, `proofable_job_decide`, and `proofable_job_cancel`. A run started from a client costs the same as one started here and stays within the permissions on your profile.
 
 ## Next
 

learn/legal/privacy-policy.mdx

@@ -4,7 +4,7 @@ description: How Proofable collects, uses, protects, and shares personal informa
 icon: shield
 ---
 
-Effective date: July 26, 2026. Last updated: October 21, 2026.
+Effective date: July 26, 2026. Last updated: October 25, 2026.
 
 This Privacy Policy explains how NEUS Network, Inc. ("Proofable," "we," "us," or "our") handles personal information when you use the Proofable website, application, APIs, hosted Model Context Protocol (MCP) service, the Proofable tools an MCP client calls, agent and job execution, verification services, and related products (collectively, the "Service").
 
@@ -93,7 +93,7 @@ The tool names above map to this policy as follows, so you can check any single
 | `proofable_mcp_connection_create`, `proofable_mcp_connections_list`, `proofable_mcp_connection_delete` | MCP connection |
 | `proofable_mcp_tools_list`, `proofable_mcp_tool_execute` | Capability call and tool execution |
 
-This table covers Proofable's tools, whether a connection can call them or not, because the data each one handles is disclosed the same way either way. The proof and permission tools (reading the profile, the verifier catalog, proofs, agents, and creating, updating or revoking a proof) are the ones the hosted MCP service exposes. The platform tools (jobs, the browser, connected apps, provider calls, saved secrets, saved tools, session receipts, page fetch and web search) run inside Proofable rather than over a connection. A client may show a different subset depending on whether you are signed in and what your client supports.
+This table covers Proofable's tools, whether a connection can call them or not, because the data each one handles is disclosed the same way either way. A signed-in connection to the hosted MCP service can call every tool above except saving a secret, which happens only inside Proofable. A client may show a different subset depending on whether you are signed in and what your client supports.
 
 ## How We Use Information
 

mcp/oauth.mdx

@@ -180,7 +180,7 @@ OAuth access tokens are valid only when `aud` is `https://mcp.proofable.me/mcp`,
 |-------|-------------|---------|
 | `neus:core` | Public protocol tools (context, catalog, public proof reads) | Yes |
 | `neus:profile` | Signed-in profile context and ownership checks | Yes |
-| `neus:secrets` | Stored credentials on your profile, used by Proofable's own runs. A connection carries no tool that handles one | Yes |
+| `neus:secrets` | Saved keys on your profile: list or remove one, or call a provider with one. A key is saved in Proofable, never through a tool | Yes |
 | `offline_access` | Refresh token so the client can stay signed in | Yes |
 
 These four scopes are the complete public permission model. Server keys (`npk_*`) are a full-profile credential.

mcp/overview.mdx

@@ -30,7 +30,7 @@ Proofable returns **Passed**, **Action needed**, or **Blocked**. It reuses a cur
 - Check whether you already hold the proof a task requires.
 - Show the next verification step only when a current proof is missing.
 - Load an agent's current identity, permissions, skills, and selected context.
-- Save credentials in encrypted Vault records without returning their values in chat.
+- Run jobs, the hosted browser and connected apps on your credits, within the permissions on your profile.
 - Read the same authorized profile and proofs across supported MCP clients.
 
 Call `proofable_context` once after connecting. Use the [MCP tool reference](./tools) for exact inputs and result shapes.

mcp/secrets.mdx

@@ -43,7 +43,7 @@ Name a key after its provider, such as `OPENAI_API_KEY` or `ANTHROPIC_API_KEY`,
 
 ## Where a saved key is used
 
-The vault is a platform feature of Proofable rather than part of an MCP connection. A saved key is used by runs the platform performs for you (the assistant, a job, an agent, a connected app), and it is never returned to a client, an agent, or the app you are using. A connection cannot create, list or revoke a secret: those tools answer `platform_only` and point at [Proofable](https://proofable.me) and the [product API](/reference).
+The vault is a platform feature of Proofable rather than part of an MCP connection. A saved key is used by runs the platform performs for you (the assistant, a job, an agent, a connected app), and it is never returned to a client, an agent, or the app you are using. Save a key in [Proofable](https://proofable.me/profile?tab=secrets) or through the [product API](/reference), never through a tool. A signed-in connection can list your saved keys (names only), remove one, and call a provider with one through `proofable_capability_call`, which returns the provider's answer and never the key.
 
 <CardGroup cols={2}>
   <Card title="Auth" icon="lock" href="./auth">

mcp/tools.mdx

@@ -1,12 +1,10 @@
 ---
 title: MCP tools
-description: "The hosted MCP trust layer: prove something once, reuse the proof, and hold an agent to a scoped permission."
+description: "The hosted MCP tool reference: reuse a proof before creating one, scope an agent's permission, and run jobs, the browser and connected apps on your credits."
 icon: wrench
 ---
 
-Proofable's MCP endpoint carries the trust layer. Prove identity, ownership or permission; reuse an existing proof instead of verifying it again; and give an agent a permission you can revoke. Work that needs the Proofable platform to *run* something happens in Proofable, and the proof it produces comes back here to be checked, shared and reused.
-
-Call **`proofable_context`** once, then pick the tool for the job.
+Call **`proofable_context`** once, then pick the tool for the job. A signed-in connection gets every tool on this page on every plan. Each call runs on your credits and within the permissions on your profile, and `tools/list` returns the set your connection can call.
 
 | Job | Tool | What it does |
 |---|---|---|
@@ -25,18 +23,58 @@ Call **`proofable_context`** once, then pick the tool for the job.
 | Load the agent | `proofable_agent_mount` | Identity, permissions, skills, and current settings. |
 | List agents | `proofable_agents_list` | Agent identities and delegations on the profile. |
 
-## What this endpoint does not carry
+## Research and browsing tools
+
+These reach the public web. Use search and fetch for reading, and the browser only when a page needs a click, JavaScript, or a visual check.
+
+| Job | Tool | What it does |
+|---|---|---|
+| Search the web | `proofable_web_search` | Structured results; optionally retrieves each page as text. |
+| Read a page | `proofable_url_fetch` | Clean page text from a public URL. Private and metadata hosts are refused. |
+| Operate a page | `proofable_browser` | Open, observe, click, type, screenshot and read console in an isolated session. |
+| Call a connected app | `proofable_composio_search` / `proofable_composio_execute` | Find and run an action on Gmail, Drive, GitHub, Slack and similar apps. |
+
+An action that would create an external side effect needs approval first. Actions that reach another business system go through `proofable_composio_execute`, which is permissioned.
+
+Prefer your own client's search, page fetch and browser. These are here for a client that has none, and each call is metered: `proofable_web_search` and `proofable_url_fetch` record 1 credit, and `proofable_composio_execute` records 2. The browser runs on your hosted computer, charged by the minute. [Pricing](/pricing) lists the rates.
+
+## Job tools
+
+| Job | Tool | What it does |
+|---|---|---|
+| Start work | `proofable_job_create` | Run agent work now or on a schedule. |
+| List work | `proofable_job_list` | List jobs available to the signed-in profile. |
+| Inspect work | `proofable_job_get` | Read one job and its latest run state. |
+| Approve a step | `proofable_job_decide` | Approve or deny a run that is waiting for approval. |
+| Stop work | `proofable_job_cancel` | Cancel a run or recurring schedule. |
+
+A run started here costs what [Jobs](/jobs) lists for a run started in Proofable.
+
+## Notes and saved tools
 
-The platform runtime stays in the product, not on the protocol surface:
+| Job | Tool | What it does |
+|---|---|---|
+| Save a session note | `proofable_session_receipt_create` / `proofable_session_receipt_append` | Private receipt in your account; append adds to an existing one. |
+| Create or update a tool | `proofable_skill_tool_create_or_update` | A JavaScript tool or skill, run only when you or an agent invokes it. |
 
-- **Work the platform runs:** background and scheduled jobs, the hosted browser, sandboxes, hosted model inference.
-- **Integrations:** connected apps (Gmail, Drive, GitHub, Slack and similar), a saved provider key, remote MCP servers.
-- **Storage:** the encrypted vault, and the private records Proofable writes to hold something for you.
-- **What your client already does:** web search and page fetch.
+## Saved keys
 
-Those run in Proofable or in the SDK against the product API, where the run holds its own permission, a human approves side effects, and the result is a proof, which comes back to this endpoint to be checked and reused. Calling one of them here returns `platform_only` and says where the work belongs.
+| Job | Tool | What it does |
+|---|---|---|
+| List saved keys | `proofable_secret_list` | Names and update times. Never a value. |
+| Remove a saved key | `proofable_secret_revoke` | Deletes a saved key by proof ID. |
+| Call a provider with a saved key | `proofable_capability_call` | Proofable sends the request with your key and returns the provider's answer. The key never reaches the client. |
 
-That is a boundary, not a plan limit: no plan unlocks the runtime through a connection, and the refusal never sells one. A connection should carry proof and authority. A general execution surface would rent out the platform, bill for work the client can already do, and turn a trust primitive into a proxy.
+Save a key on [Secrets](./secrets), not through a tool. A key typed into an AI app's conversation has already been disclosed to that app.
+
+## Remote MCP servers
+
+Save another MCP server on your profile and run its tools through Proofable, so each call carries your permissions and leaves a receipt.
+
+| Job | Tool | What it does |
+|---|---|---|
+| Save, list or remove a server | `proofable_mcp_connection_create` / `proofable_mcp_connections_list` / `proofable_mcp_connection_delete` | The server's URL and headers, stored encrypted on your profile. |
+| Use a server | `proofable_mcp_tools_list` / `proofable_mcp_tool_execute` | List its tools and run one. Each run records 1 credit. Private and metadata hosts are refused. |
 
 | Topic | Detail |
 |-------|--------|

pricing.mdx

@@ -36,9 +36,17 @@ Hosted sign-in and profile, Hosted Verify and reusable proofs, agent identity an
 
 ## What a tool call costs
 
-Signing in, checking a saved proof, and reading your own profile, proofs and agents are free. Creating a proof is charged as a check below; the trust layer adds nothing on top of it.
+Signing in, checking a saved proof, and reading your own profile, proofs, agents and jobs are free. Creating a proof is charged as a check below. The calls that reach another service are metered per call:
 
-The platform runtime is not on the MCP endpoint. Jobs, the hosted computer, connected apps, a saved provider key, remote MCP servers, web search and page fetch run in Proofable and are charged there as the job or the inference above. [MCP tools](/mcp/tools) lists what a connection does carry.
+| Call | Credits |
+|---|---|
+| Web search (`proofable_web_search`) | 1 |
+| Read a page (`proofable_url_fetch`) | 1 |
+| Run a connected-app action (`proofable_composio_execute`) | 2 |
+| Run a tool on a saved remote MCP server (`proofable_mcp_tool_execute`) | 1 |
+| Call a provider with your saved key (`proofable_capability_call`) | 0 |
+
+A job started over MCP is charged as a job above, and operating a page with `proofable_browser` is charged as the hosted computer above. [MCP tools](/mcp/tools) lists every tool a connection carries.
 
 ## What checks cost