Proof Holdings

create_verification_request

Create a multi-asset verification request. Allows verifying multiple assets (phone, email, domain, social, wallet, account, telegram_bot) in a single flow.

ACCESS: needs a Proof account. Authenticate this client (Claude Code: /mcp → Authenticate), then call this tool again. start_login does NOT open this tool.

Tool call template

Replace each placeholder with a value matching the input schema. Only required parameters are included; add optional parameters as needed.

{
  "id": 1,
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "arguments": {
      "assets": "<assets>"
    },
    "name": "create_verification_request"
  }
}

Input Schema

Name	Required	Description
`assets`	Yes	Array of assets to verify (1-10)
`expires_in`	No	Request expiry in seconds (default: 604800, i.e. 7 days; max: 2592000, i.e. 30 days)
`partial_ok`	No	Allow partial completion (default: false)
`action_type`	No	Purpose of the verification (default: verification)
`callback_url`	No	Webhook URL for status updates (HTTPS only)
`redirect_url`	No	URL to redirect user after verification completes (HTTPS only)
`reference_id`	No	Your unique reference ID for this request
`action_context`	No	Context displayed to user during verification
`proof_expiry_days`	No	Per-request proof expiry override in days (7, 30, 90, or 365)
`public_profile_id`	No	Public profile ID for branding
`validity_requirement`	No	How fresh an existing proof must be to count, as <n>h, <n>d, <n>w or <n>m (e.g. "7d")

Output Schema

Name	Required	Description
`id`	No	MongoDB ObjectId
`assets`	No
`status`	No	Status of a verification request
`outcome`	No	`relying_party` when the request was created to wait for your outcome; null otherwise. Absent from an API that predates the field.
`progress`	No
`created_at`	No
`expires_at`	No
`partial_ok`	No
`updated_at`	No
`action_type`	No	Type of action for verification request or authorization
`callback_url`	No	The webhook URL set on the request, if any
`completed_at`	No
`redirect_url`	No
`reference_id`	No
`action_context`	No	The action the person is asked to authorize; null when the request carries none
`computed_state`	No	Additive machine-readable effective state: re-derives expiry from expires_at (never trusts the stored status). BOTH `is_expiring_soon` and `next_action` are role-aware — `next_action.role` says which side this envelope was computed for, and the two fields are consistent within it. Present only on authenticated owner/requester and recipient responses; absent on public/third-party surfaces.
`verification_url`	No	URL for the verification flow
`validity_requirement`	No	Required proof freshness as set on the request (e.g. "7d"); null when none was set
`outcome_timeout_seconds`	No	The window set on the request, in seconds; null when it does not wait for an outcome. Absent from an API that predates the field.

Schema Changelog

Changes observed during successful MCP inspections.

Changed2 schema fields changedNov 9, 2026

addedOutput schema / properties / outcome

Added value: +{
+  "description": "`relying_party` when the request was created to wait for your outcome; null otherwise. Absent from an API that predates the field."
+}

addedOutput schema / properties / outcome_timeout_seconds

Added value: +{
+  "description": "The window set on the request, in seconds; null when it does not wait for an outcome. Absent from an API that predates the field."
+}

Changed2 schema fields changedNov 2, 2026

addedInput schema / properties / validity_requirement

Added value: +{
+  "description": "How fresh an existing proof must be to count, as <n>h, <n>d, <n>w or <n>m (e.g. \"7d\")",
+  "pattern": "^\\d+[hdwm]$",
+  "type": "string"
+}

changedOutput schema / (root)

Previous value: -nullNew value: +{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "additionalProperties": {},
+  "properties": {
+    "action_context": {
+      "description": "The action the person is asked to authorize; null when the request carries none"
+    },
+    "action_type": {
+      "description": "Type of action for verification request or authorization"
+    },
+    "assets": {},
+    "callback_url": {
+      "description": "The webhook URL set on the request, if any"
+    },
+    "completed_at": {},
+    "computed_state": {
+      "description": "Additive machine-readable effective state: re-derives expiry from expires_at (never trusts the stored status). BOTH `is_expiring_soon` and `next_action` are role-aware — `next_action.role` says which side this envelope was computed for, and the two fields are consistent within it. Present only on authenticated owner/requester and recipient responses; absent on public/third-party surfaces."
+    },
+    "created_at": {},
+    "expires_at": {},
+    "id": {
+      "description": "MongoDB ObjectId"
+    },
+    "partial_ok": {},
+    "progress": {},
+    "redirect_url": {},
+    "reference_id": {},
+    "status": {
+      "description": "Status of a verification request"
+    },
+    "updated_at": {},
+    "validity_requirement": {
+      "description": "Required proof freshness as set on the request (e.g. \"7d\"); null when none was set"
+    },
+    "verification_url": {
+      "description": "URL for the verification flow"
+    }
+  },
+  "type": "object"
+}

Changed9 schema fields changedOct 26, 2026
- removedInput schema / additionalProperties
```
Removed value: -false
```
- removedInput schema / properties / action_context / additionalProperties
```
Removed value: -false
```
- removedInput schema / properties / assets / items / additionalProperties
```
Removed value: -false
```
- removedInput schema / properties / assets / items / properties / allowed_channels / items / $ref
```
Removed value: -"#/properties/assets/items/properties/channel"
```
- addedInput schema / properties / assets / items / properties / allowed_channels / items / enum
```
Added value: +[
+  "whatsapp",
+  "telegram",
+  "sms",
+  "email",
+  "dns",
+  "http",
+  "auto",
+  "github",
+  "google",
+  "facebook",
+  "x",
+  "linkedin",
+  "instagram",
+  "youtube",
+  "tiktok",
+  "ethereum",
+  "solana",
+  "bitcoin",
+  "coinbase",
+  "kraken",
+  "telegram_bot_token"
+]
```
- addedInput schema / properties / assets / items / properties / allowed_channels / items / type
```
Added value: +"string"
```
- addedInput schema / properties / expires_in / maximum
```
Added value: +9007199254740991
```
- addedInput schema / properties / proof_expiry_days / maximum
```
Added value: +9007199254740991
```
- addedInput schema / properties / proof_expiry_days / minimum
```
Added value: +-9007199254740991
```

Changed1 schema field changedOct 8, 2026

changedInput schema / properties / expires_in / description

Previous value: -"Request expiry in seconds (default: 86400, max: 604800)"New value: +"Request expiry in seconds (default: 604800, i.e. 7 days; max: 2592000, i.e. 30 days)"

First observedSep 19, 2026

TDQS

B3.4/5.0

Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=false and destructiveHint=false, so the write-but-not-destructive profile is covered. The description adds useful auth/prerequisite context, but omits key behavioral traits of a request-creating tool: whether it dispatches messages to the asset owner, whether repeats are deduplicated, and how partial_ok affects completion are all left unstated.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two short, front-loaded blocks: purpose first, then the access gate the caller must satisfy before retrying. The ALL-CAPS ACCESS heading and parenthetical UI instructions are slightly noisy but still earn their place as actionable preconditions.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so return values need no explanation, and one required parameter is straightforward. For an 11-parameter nested mutation tool, though, the description stays at the purpose-plus-auth level and never helps an agent decide among the several create_* siblings, leaving the main selection ambiguity unresolved.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100% across 11 parameters, so the schema carries the parameter burden and baseline 3 applies. The description's asset-type list merely echoes the enum already in the schema and adds no format or interaction semantics for nested fields like allowed_channels or validity_requirement.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ("Create a multi-asset verification request") and enumerates the asset types covered, which implicitly separates it from the single-asset siblings like create_verification. It never names a sibling explicitly, so the differentiation is inferable rather than stated.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides a concrete access condition — the caller needs a Proof account and must authenticate this client — and explicitly rules out a sibling path ("start_login does NOT open this tool"). However, it gives no guidance on when to pick this over create_verification, create_multi_channel_verification, or create_user_request, which are the real alternatives an agent must choose between.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

All Proof Holdings tools Inspect

Try in Browser

One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

Glama MCP Gateway

Add one secure layer between your agents and this server.