@proof-holdings/mcp-server

Official

Overview Schema Source Related Servers Discussions Admin

remove_email

Destructive

Remove an email address from a Proof account after 2FA approval, revoking its proofs and consents and signing out other devices. Deletes the address; blocked for your sign-in or only sign-in method.

Instructions

Remove an email address from the account. Always requires one code: start_2fa_for_action with action_type email_remove and targets [this email id]. Revokes every proof of the address and your own consents naming it, declines pending confirmations waiting on it, moves Lookalike Watch alerts to your remaining primary email (or stops the watch when none is left), deletes the record, signs out your other devices, and names the new primary email. Refused for the address you signed in with and for your only way to sign in. Cannot be undone.

ACCESS: needs a Proof account. Set PROOF_API_KEY and restart this server, or sign in with start_login — a session opens this tool — then call this tool again.

Tool call template

Replace each placeholder with a value matching the input schema. Only required parameters are included; add optional parameters as needed.

{
  "id": 1,
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "arguments": {
      "id": "<id>"
    },
    "name": "remove_email"
  }
}

Input Schema

Name	Required	Description	Default
`id`	Yes	Email record ID

Output Schema

Name	Required	Description
`type`	No
`notice`	No
`success`	No	Always `true`. The 1.x Go, PHP and Python SDK types carry it as a string, as released; it is typed boolean in the next major.
`identifier`	No	Masked.
`removed_id`	No
`new_primary`	No	The row that becomes (or became) primary when the removed one was; null otherwise.
`proofs_revoked`	No
`lookalike_watch`	No
`circles_repointed`	No	Phones only: circles that now reach the owner at `new_primary`; 0 for an email.
`sessions_signed_out`	No	Every other device was signed out, idle ones included; the calling session stays. False when that could not be done — the removal itself still happened.
`sessions_invalidated`	No	Other listed devices signed out, idle ones included; the calling session stays. A device missing from the list — signed in before the list held idle devices, or one whose listing could not be recorded — is not counted, so read `sessions_signed_out` for whether every other device was signed out.
`authorizations_revoked`	No
`hitl_configs_without_approver`	No

Schema Changelog

Changes observed during successful MCP inspections.

Changed2 schema fields changedv1.7.2Nov 6, 2026

removedInput schema / additionalProperties
```
Removed value: -false
```

changedOutput schema / (root)

Previous value: -nullNew value: +{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "additionalProperties": {},
+  "properties": {
+    "authorizations_revoked": {},
+    "circles_repointed": {
+      "description": "Phones only: circles that now reach the owner at `new_primary`; 0 for an email."
+    },
+    "hitl_configs_without_approver": {},
+    "identifier": {
+      "description": "Masked."
+    },
+    "lookalike_watch": {},
+    "new_primary": {
+      "description": "The row that becomes (or became) primary when the removed one was; null otherwise."
+    },
+    "notice": {},
+    "proofs_revoked": {},
+    "removed_id": {},
+    "sessions_invalidated": {
+      "description": "Other listed devices signed out, idle ones included; the calling session stays. A device missing from the list — signed in before the list held idle devices, or one whose listing could not be recorded — is not counted, so read `sessions_signed_out` for whether every other device was signed out."
+    },
+    "sessions_signed_out": {
+      "description": "Every other device was signed out, idle ones included; the calling session stays. False when that could not be done — the removal itself still happened."
+    },
+    "success": {
+      "description": "Always `true`. The 1.x Go, PHP and Python SDK types carry it as a string, as released; it is typed boolean in the next major."
+    },
+    "type": {}
+  },
+  "type": "object"
+}

First observedv1.1.0Sep 9, 2026

TDQS

A4.9/5.0

Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations only say destructive/non-read-only; the description goes far beyond by enumerating the cascade: revoking every proof and consent naming the address, declining pending confirmations, moving Lookalike Watch alerts to the remaining primary (or stopping the watch), deleting the record, and signing out other devices. It also states the operation cannot be undone and tells the agent which email becomes primary afterwards.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The action and its mandatory 2FA prerequisite are front-loaded in the first two sentences, followed by cascade effects and refusal conditions; the access note is separated at the end. Every clause carries distinct operational information with no filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a destructive single-parameter tool with an output schema, the description covers prerequisites, side effects, refusal cases, irreversibility, and authentication setup (PROOF_API_KEY or start_login). Nothing needed to invoke it correctly is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% and already documents 'Email record ID', so the baseline is 3. The description adds value by tying the id to the required start_2fa_for_action targets and by constraining which ids are invalid (sign-in address, sole sign-in method), which the schema does not convey.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('Remove an email address from the account') and implicitly separates itself from siblings such as set_primary_email, start_add_email, or revoke_proof by naming the exact record it deletes. An agent can identify the operation without opening the schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives an explicit prerequisite ('Always requires one code: start_2fa_for_action with action_type email_remove and targets [this email id]') with the exact sibling tool and arguments to call first. It also names when the tool refuses ('the address you signed in with', 'your only way to sign in'), which is exactly the exclusion guidance an agent needs.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Deploy Server