Skip to main content
Glama
Sign In
@proof-holdings/mcp-server

@proof-holdings/mcp-server

Official
by ProofHoldings
OverviewSchemaSourceRelated ServersDiscussionsAdmin
TypeScript
Hybrid

get_request_by_reference

Read-only

Retrieve a verification request by your unique reference ID to check its status and details. Requires a Proof account and PROOF_API_KEY configured on the server.

Instructions

Get a verification request by its reference ID (your unique identifier).

ACCESS: needs a Proof account. Set PROOF_API_KEY and restart this server, then call this tool again. start_login does NOT open this tool.

Input Schema

NameRequiredDescriptionDefault
reference_idYesYour unique reference ID

Output Schema

NameRequiredDescriptionDefault
idNoMongoDB ObjectId
assetsNo
statusNoStatus of a verification request
progressNo
created_atNo
expires_atNo
partial_okNo
updated_atNo
action_typeNoType of action for verification request or authorization
callback_urlNoThe webhook URL set on the request, if any
completed_atNo
redirect_urlNo
reference_idNo
action_contextNoThe action the person is asked to authorize; null when the request carries none
computed_stateNoAdditive machine-readable effective state: re-derives expiry from expires_at (never trusts the stored status). BOTH `is_expiring_soon` and `next_action` are role-aware — `next_action.role` says which side this envelope was computed for, and the two fields are consistent within it. Present only on authenticated owner/requester and recipient responses; absent on public/third-party surfaces.
verification_urlNoURL for the verification flow
validity_requirementNoRequired proof freshness as set on the request (e.g. "7d"); null when none was set

Schema Changelog

Changes observed during successful MCP inspections.

  1. Changed2 schema fields changedv1.7.2
    • removedInput schema / additionalProperties
      Removed value: -false
    • changedOutput schema / (root)
      Previous value: -nullNew value: +{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "additionalProperties": {},
+  "properties": {
+    "action_context": {
+      "description": "The action the person is asked to authorize; null when the request carries none"
+    },
+    "action_type": {
+      "description": "Type of action for verification request or authorization"
+    },
+    "assets": {},
+    "callback_url": {
+      "description": "The webhook URL set on the request, if any"
+    },
+    "completed_at": {},
+    "computed_state": {
+      "description": "Additive machine-readable effective state: re-derives expiry from expires_at (never trusts the stored status). BOTH `is_expiring_soon` and `next_action` are role-aware — `next_action.role` says which side this envelope was computed for, and the two fields are consistent within it. Present only on authenticated owner/requester and recipient responses; absent on public/third-party surfaces."
+    },
+    "created_at": {},
+    "expires_at": {},
+    "id": {
+      "description": "MongoDB ObjectId"
+    },
+    "partial_ok": {},
+    "progress": {},
+    "redirect_url": {},
+    "reference_id": {},
+    "status": {
+      "description": "Status of a verification request"
+    },
+    "updated_at": {},
+    "validity_requirement": {
+      "description": "Required proof freshness as set on the request (e.g. \"7d\"); null when none was set"
+    },
+    "verification_url": {
+      "description": "URL for the verification flow"
+    }
+  },
+  "type": "object"
+}
  2. First observedv1.1.0

TDQS

A3.7/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

readOnlyHint=true already covers the safety profile, so the description earns credit for the extra context it supplies: the account/auth prerequisite, the required restart step, and the non-obvious fact that start_login will not unlock this tool. It does not say what happens on an unknown reference_id (empty result vs error), which is the remaining behavioral gap.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The purpose sentence is front-loaded and the access caveat is separated out, so an agent can stop reading once it has credentials. No redundant restatement of the parameter or title; the wording is slightly awkward ('does NOT open this tool') but each sentence carries information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a single-parameter read with an output schema and readOnlyHint present, the description covers purpose, the identifier source, and the auth prerequisite. The only meaningful omission is disambiguation from the cluster of verification-request siblings and not-found behavior.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% and reference_id is described, so the schema carries the load. The description adds only the clarification that the reference is 'your unique identifier' (i.e., caller-supplied rather than server-generated), which is mildly useful but does not add format, case-sensitivity, or lookup-failure semantics. Baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb ('Get') and resource ('a verification request') plus the lookup key ('reference ID'), which is concrete enough to act on. It implicitly distinguishes itself from the many list/get siblings by naming 'reference ID (your unique identifier)', but never names get_verification_request or get_verification, so the agent must infer which of the several get-request tools this is.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides a real invocation prerequisite (needs a Proof account, PROOF_API_KEY set, server restarted) and an explicit exclusion ('start_login does NOT open this tool'). However, there is no guidance on when to use this versus get_verification_request, list_verification_requests, or get_request_proofs — the sibling set is dense with plausibly overlapping choices.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Deploy Server

Other Tools