Proof Holdings

remove_email

Destructive

Remove an email address from the account. Always requires one code: start_2fa_for_action with action_type email_remove and targets [this email id]. Revokes every proof of the address and your own consents naming it, declines pending confirmations waiting on it, moves Lookalike Watch alerts to your remaining primary email (or stops the watch when none is left), deletes the record, signs out your other devices, and names the new primary email. Refused for the address you signed in with and for your only way to sign in. Cannot be undone.

ACCESS: needs a Proof account. Authenticate this client (Claude Code: /mcp → Authenticate), or sign in with start_login — a session opens this tool — then call this tool again.

Tool call template

Replace each placeholder with a value matching the input schema. Only required parameters are included; add optional parameters as needed.

{
  "id": 1,
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "arguments": {
      "id": "<id>"
    },
    "name": "remove_email"
  }
}

Input Schema

Name	Required	Description	Default
`id`	Yes	Email record ID

Output Schema

Name	Required	Description
`type`	No
`notice`	No
`success`	No	Always `true`. The 1.x Go, PHP and Python SDK types carry it as a string, as released; it is typed boolean in the next major.
`identifier`	No	Masked.
`removed_id`	No
`new_primary`	No	The row that becomes (or became) primary when the removed one was; null otherwise.
`proofs_revoked`	No
`lookalike_watch`	No
`circles_repointed`	No	Phones only: circles that now reach the owner at `new_primary`; 0 for an email.
`sessions_signed_out`	No	Every other device was signed out, idle ones included; the calling session stays. False when that could not be done — the removal itself still happened.
`sessions_invalidated`	No	Other listed devices signed out, idle ones included; the calling session stays. A device missing from the list — signed in before the list held idle devices, or one whose listing could not be recorded — is not counted, so read `sessions_signed_out` for whether every other device was signed out.
`authorizations_revoked`	No
`hitl_configs_without_approver`	No

Schema Changelog

Changes observed during successful MCP inspections.

Changed1 schema field changedNov 2, 2026

changedOutput schema / (root)

Previous value: -nullNew value: +{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "additionalProperties": {},
+  "properties": {
+    "authorizations_revoked": {},
+    "circles_repointed": {
+      "description": "Phones only: circles that now reach the owner at `new_primary`; 0 for an email."
+    },
+    "hitl_configs_without_approver": {},
+    "identifier": {
+      "description": "Masked."
+    },
+    "lookalike_watch": {},
+    "new_primary": {
+      "description": "The row that becomes (or became) primary when the removed one was; null otherwise."
+    },
+    "notice": {},
+    "proofs_revoked": {},
+    "removed_id": {},
+    "sessions_invalidated": {
+      "description": "Other listed devices signed out, idle ones included; the calling session stays. A device missing from the list — signed in before the list held idle devices, or one whose listing could not be recorded — is not counted, so read `sessions_signed_out` for whether every other device was signed out."
+    },
+    "sessions_signed_out": {
+      "description": "Every other device was signed out, idle ones included; the calling session stays. False when that could not be done — the removal itself still happened."
+    },
+    "success": {
+      "description": "Always `true`. The 1.x Go, PHP and Python SDK types carry it as a string, as released; it is typed boolean in the next major."
+    },
+    "type": {}
+  },
+  "type": "object"
+}

Changed1 schema field changedOct 26, 2026
- removedInput schema / additionalProperties
```
Removed value: -false
```
First observedSep 19, 2026

TDQS

A4.8/5.0

Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already flag destructiveHint=true, and the description goes far beyond them: it enumerates every cascading effect (revoking proofs and consents, declining pending confirmations, moving Lookalike Watch alerts, deleting the record, signing out other devices, naming a new primary) and states the action is irreversible. It also discloses the access requirement (Proof account, start_login).

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded with the action and the mandatory prerequisite, then the consequences, then access. Dense but every clause carries information; the single long run-on enumeration of side effects costs it a point.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Output schema exists, so return values need no explanation. For a destructive, auth-gated single-parameter tool the description covers prerequisites, side effects, failure cases, and authentication — nothing material is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Only one parameter and schema coverage is 100%, so the baseline is 3. The description adds real value by explaining how that id is consumed — it becomes the target passed to start_2fa_for_action — which meaning the schema alone does not convey.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ("Remove an email address from the account") and implicitly separates itself from siblings like remove_phone and set_primary_email by naming the target object precisely. An agent knows exactly what this does without opening the schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly names the mandatory prerequisite flow (start_2fa_for_action with action_type email_remove and targets [this email id]) and specifies the refusal conditions — the address used to sign in and the only remaining sign-in method. That is both when-to-use and when-not-to-use guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

All Proof Holdings tools Inspect

Try in Browser

One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

Glama MCP Gateway

Add one secure layer between your agents and this server.