Proof Holdings

get_hitl_keys

Read-only

Get the encryption keypair for a HITL config. With hitl:read it returns the public key, encrypted private key, KDF salt, and key ID (kid). A key holding confirmations:create without hitl:read receives only public_key and kid — what a confirmation message is sealed to, never the private-key material.

ACCESS: needs a Proof account. Authenticate this client (Claude Code: /mcp → Authenticate), then call this tool again. start_login does NOT open this tool.

Tool call template

Replace each placeholder with a value matching the input schema. Only required parameters are included; add optional parameters as needed.

{
  "id": 1,
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "arguments": {
      "hitl_id": "<hitl_id>"
    },
    "name": "get_hitl_keys"
  }
}

Input Schema

Name	Required	Description	Default
`hitl_id`	Yes	HITL config ID

Output Schema

Name	Required	Description
`kid`	Yes	The key id: lowercase hex SHA-256 of the public key's SPKI DER
`dek_iv`	No
`dek_tag`	No
`kdf_salt`	No	The salt the wrapping key is derived with. Absent for a key holding `confirmations:create` without `hitl:read`.
`public_key`	Yes	The RSA public key (SPKI PEM) messages are sealed to. Null means the stored key material could not be read: a degraded state to report, not "no key yet" (a config with no keypair answers 404 `no_keypair`).
`wrapped_dek`	No	The per-config data key wrapped under the master key; null for a keypair stored before it existed. Absent for a requester key, as are the five fields below.
`backup_dek_iv`	No
`backup_dek_tag`	No
`backup_wrapped_dek`	No	The same data key wrapped under the recovery key; null until recovery is set up
`encrypted_private_key`	No	The private key as stored, wrapped client-side. Absent for a key holding `confirmations:create` without `hitl:read`.

Schema Changelog

Changes observed during successful MCP inspections.

Changed1 schema field changedNov 2, 2026

changedOutput schema / (root)

Previous value: -nullNew value: +{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "additionalProperties": {},
+  "description": "A HITL config's keypair. A caller with `hitl:read` (or a dashboard session) gets every field; a key holding `confirmations:create` without `hitl:read` gets `public_key` and `kid` only.",
+  "properties": {
+    "backup_dek_iv": {
+      "type": [
+        "string",
+        "null"
+      ]
+    },
+    "backup_dek_tag": {
+      "type": [
+        "string",
+        "null"
+      ]
+    },
+    "backup_wrapped_dek": {
+      "description": "The same data key wrapped under the recovery key; null until recovery is set up",
+      "type": [
+        "string",
+        "null"
+      ]
+    },
+    "dek_iv": {
+      "type": [
+        "string",
+        "null"
+      ]
+    },
+    "dek_tag": {
+      "type": [
+        "string",
+        "null"
+      ]
+    },
+    "encrypted_private_key": {
+      "description": "The private key as stored, wrapped client-side. Absent for a key holding `confirmations:create` without `hitl:read`.",
+      "type": "string"
+    },
+    "kdf_salt": {
+      "description": "The salt the wrapping key is derived with. Absent for a key holding `confirmations:create` without `hitl:read`.",
+      "type": "string"
+    },
+    "kid": {
+      "description": "The key id: lowercase hex SHA-256 of the public key's SPKI DER",
+      "type": "string"
+    },
+    "public_key": {
+      "description": "The RSA public key (SPKI PEM) messages are sealed to. Null means the stored key material could not be read: a degraded state to report, not \"no key yet\" (a config with no keypair answers 404 `no_keypair`).",
+      "type": [
+        "string",
+        "null"
+      ]
+    },
+    "wrapped_dek": {
+      "description": "The per-config data key wrapped under the master key; null for a keypair stored before it existed. Absent for a requester key, as are the five fields below.",
+      "type": [
+        "string",
+        "null"
+      ]
+    }
+  },
+  "required": [
+    "public_key",
+    "kid"
+  ],
+  "type": "object"
+}

Changed1 schema field changedOct 26, 2026
- removedInput schema / additionalProperties
```
Removed value: -false
```
First observedSep 19, 2026

TDQS

A4.2/5.0

Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true, and the description is consistent with that while adding real value: the return payload varies by scope, and the confirmations:create-only caller is guaranteed to never see private-key material. It stops short of covering error behavior or audit/caching traits, which keeps it below a 5.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The core behavior is front-loaded in the first sentence and the permission split follows logically. The separate ACCESS paragraph is useful but slightly verbose about client-specific UI steps; every sentence still carries information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a read-only getter with annotations and an output schema, the description covers everything an agent needs: what is returned, how permissions change the payload, and the authentication prerequisite that would otherwise cause a failed call.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With one parameter at 100% schema coverage, the schema already documents hitl_id fully. The description adds no format, source, or lookup hints (e.g., where to obtain the hitl_id), so baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('Get the encryption keypair for a HITL config') and immediately scopes the returned material, which cleanly separates it from get_hitl, upload_hitl_keys, and delete_hitl_keys. An agent can pick this tool without opening any schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explains when the tool is callable (needs a Proof account, must authenticate first) and explicitly rules out start_login as a path to access. It does not name sibling alternatives such as get_hitl or upload_hitl_keys, but the permission-based usage split (hitl:read vs confirmations:create) is clear guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

All Proof Holdings tools Inspect

Try in Browser

One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

Glama MCP Gateway

Add one secure layer between your agents and this server.