Skip to main content
Glama
ProofHoldings

@proof-holdings/mcp-server

Official

revoke_asset

Destructive

Revoke all proofs tied to a phone, email, or domain asset without removing it from the account; owner-only, 2FA, irreversible.

Instructions

Revoke the proofs of one of your assets (a phone, email or domain) — the asset stays on the account. Owner only: sign in with start_login (a connection with only an API key is refused user_session_required — a key revokes a proof with revoke_proof instead), then one code: start_2fa_for_action with action_type revocation_bulk and targets [this asset id], wait_for_2fa, and call again. A phone or email: every proof of that number or address is revoked; signing in with it again issues a fresh proof. A domain you own: every proof of the domain and every delegation issued from it are revoked for good, and the domain needs re-verification — re-verifying does NOT bring the delegations back. Need a temporary stop for a domain proof? Use suspend_proof instead. Status-checking verifiers see the revocation within about a minute; signature-only verifiers accept a token until it expires. Cannot be undone.

ACCESS: needs a Proof account. Set PROOF_API_KEY and restart this server, or sign in with start_login — a session opens this tool — then call this tool again.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
idYesAsset ID

Schema Changelog

Changes observed during successful MCP inspections.

  1. First observedv1.1.0

TDQS

A4.2/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=false and destructiveHint=true, so the destructive nature is covered structurally. The description goes well beyond that by disclosing irreversibility, that domain delegations are revoked for good and not restored by re-verification, propagation timing (~1 minute for status-checking verifiers, token lifetime for signature-only), and the fresh-proof behavior on re-signin — genuinely rich context.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded with the core action and scope, then layered with prerequisites, edge-case behavior, and alternatives. It is dense and every sentence carries information, though the multiple parenthetical asides and long final clauses make it heavier than strictly necessary.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a destructive, irreversible operation with no output schema, the description covers auth requirements, the full 2FA flow, per-asset-type consequences, propagation timing, and reversibility. An agent has everything needed to call it correctly and warn the user.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% for the single 'id' parameter, so the schema already documents it. The description references the asset id only obliquely ('targets [this asset id]') without adding format or sourcing guidance beyond the schema, so baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('Revoke the proofs of one of your assets'), names the asset types covered, and immediately distinguishes scope from siblings by noting 'the asset stays on the account.' An agent can separate it from revoke_proof and suspend_proof without opening schemas.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicit when-to-use with named alternatives and conditions: use revoke_proof for key-only connections, suspend_proof for a temporary stop on a domain proof. It also spells out the owner-only prerequisite and the exact 2FA call sequence (start_2fa_for_action with action_type revocation_bulk, wait_for_2fa, call again).

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Deploy Server

Other Tools