Skip to main content
Glama
Sign In
@proof-holdings/mcp-server

@proof-holdings/mcp-server

Official
by ProofHoldings
OverviewSchemaSourceRelated ServersDiscussionsAdmin
TypeScript
Hybrid

get_settings

Read-only

Retrieve account-level settings: the outbound webhook endpoint, its event subscriptions, and the default proof lifetime. Branding is per sub-account, so read it with get_profile instead.

Instructions

Get account settings: the outbound webhook endpoint with its event subscriptions, and the default proof lifetime. Branding (name, logo, colour, email theme, support email) belongs to each sub-account: read it with get_profile. The webhook signing secret is NOT returned to an API key — the response reports webhook.secret_set instead, and the value itself is visible only in the dashboard or in the update_settings response that created or rotated it.

ACCESS: needs a Proof account. Set PROOF_API_KEY and restart this server, then call this tool again. start_login does NOT open this tool.

Input Schema

NameRequiredDescriptionDefault

No arguments

Output Schema

NameRequiredDescriptionDefault
hitlNoApproval-setup settings.
webhookNoOutbound webhook configuration — DEPRECATED (#421). An account switched over to webhook endpoints sees its account-wide (`legacy`) endpoint here: `url` is null while that endpoint is disabled, a `url` write updates or creates it, `url: null` disables it (its secret is kept), and `rotate_secret` rotates its secret. An account not yet switched over sees its settings fields, as before. Omitted for an API key bound to one sub-account.
proof_expiry_daysNoDefault lifetime in days of newly issued verification proofs, or null when the account has never set one. Confirmation-decision proofs do not use it.

Schema Changelog

Changes observed during successful MCP inspections.

  1. Changed1 schema field changedv1.7.2
    • changedOutput schema / (root)
      Previous value: -nullNew value: +{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "additionalProperties": {},
+  "properties": {
+    "hitl": {
+      "description": "Approval-setup settings."
+    },
+    "proof_expiry_days": {
+      "description": "Default lifetime in days of newly issued verification proofs, or null when the account has never set one. Confirmation-decision proofs do not use it."
+    },
+    "webhook": {
+      "description": "Outbound webhook configuration — DEPRECATED (#421). An account switched over to webhook endpoints sees its account-wide (`legacy`) endpoint here: `url` is null while that endpoint is disabled, a `url` write updates or creates it, `url: null` disables it (its secret is kept), and `rotate_secret` rotates its secret. An account not yet switched over sees its settings fields, as before. Omitted for an API key bound to one sub-account."
+    }
+  },
+  "type": "object"
+}
  2. First observedv1.1.0

TDQS

A4.8/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations only declare readOnlyHint=true; the description goes well beyond by disclosing that the webhook signing secret is never returned to an API key, that webhook.secret_set is reported instead, and where the raw value can actually be seen. The ACCESS paragraph adds authentication requirements and the restart step, which no annotation covers.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded with the resource contents, then the sibling routing, then the secret caveat, then access. Every sentence carries information, though the ACCESS block is somewhat verbose relative to a single prerequisite and could be tightened.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so return values need not be described, and the description only calls out the one return-field exception an agent could misread (secret vs. secret_set). Combined with the access prerequisite, nothing needed to call this correctly is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool takes zero parameters, so there is no parameter semantics to add and the baseline applies; the description instead spends its words on return-value caveats. That is a reasonable trade, though it is not adding anything the schema needs.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Names a specific verb and resource (account settings) and enumerates the exact contents: outbound webhook endpoint with event subscriptions, and default proof lifetime. It also draws the boundary against sub-account branding, so an agent can distinguish it from get_profile without opening any schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly routes the agent elsewhere for branding ("read it with get_profile") and states the precondition for calling this tool at all. It even pre-empts a likely wrong turn by declaring that start_login does NOT open this tool, which is the kind of exclusion that prevents wasted calls.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Deploy Server

Other Tools