Skip to content

Say where sign-in starts and where the anonymous surface lives #44

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
chrisjleal merged 1 commit into from
Nov 7, 2026
Merged

Say where sign-in starts and where the anonymous surface lives #44

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 3 additions & 1 deletion mcp/auth.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,7 +22,7 @@ The terminal installer writes the same URL:
npx -y @proofable/sdk setup
```

A signed-out connection can complete the handshake, list every tool, and run `proofable_context`, `proofable_verifiers_catalog`, `proofable_proofs_check` and `proofable_verify_or_guide`. Calling any other tool returns `401` with a `WWW-Authenticate` challenge, which starts the host's OAuth flow (DCR, PKCE and token exchange). Claude shows a **Connect** button in the chat and runs the same call once you sign in. In Claude Code, run `/mcp`. In Codex, run `codex mcp login proofable`.
Adding Proofable to a client asks you to sign in straight away. A request with no credential returns `401` with a `WWW-Authenticate` challenge on every method, `initialize` included, and that challenge is what opens the host's OAuth flow (DCR, PKCE and token exchange). Claude shows a **Connect** button in the chat and runs the call once you sign in. In Claude Code, run `/mcp`. In Codex, run `codex mcp login proofable`.

```http
HTTP/1.1 401 Unauthorized
Expand All @@ -31,6 +31,8 @@ WWW-Authenticate: Bearer resource_metadata="https://mcp.proofable.me/mcp/.well-k

An expired or invalid Bearer gets the same challenge on every request, including `initialize`, so OAuth-capable hosts refresh silently. The endpoint is stateless streamable HTTP: GET and DELETE on `/mcp` return `405` without a challenge.

Without an account, `proofable_context`, `proofable_verifiers_catalog`, `proofable_proofs_check` and `proofable_verify_or_guide` run on `https://mcp.proofable.me/mcp/public`. That is the anonymous surface directory listings and account-free checks use. Anything that needs a profile is challenged there too, so a client that lands on it signs in and moves to `/mcp`.

[MCP OAuth](./oauth) covers discovery, token exchange and scopes.

## Access key (servers and automation)
Expand Down
2 changes: 1 addition & 1 deletion mcp/oauth.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -49,7 +49,7 @@ GET https://mcp.proofable.me/.well-known/oauth-protected-resource/mcp
}
```

A signed-out handshake, the full tool list and the four signed-out tools answer normally. Calling any other tool without a usable token returns the challenge that starts DCR and PKCE, and the host signs in and retries that call. An access key uses the same URL as a Bearer token.
A request with no credential, on any method including `initialize`, returns the challenge that starts DCR and PKCE, so the first sign-in happens when you add the connector. An access key uses the same URL as a Bearer token. The anonymous surface at `https://mcp.proofable.me/mcp/public` serves the handshake, the advertised tool list and the four keyless tools for directory listings and account-free checks.

```http
HTTP/1.1 401 Unauthorized
Expand Down
Loading