Skip to main content
Glama
ProofHoldings

@proof-holdings/mcp-server

Official

start_login

Initiates a login session by sending an authentication challenge to the user's chosen channel (Telegram, WhatsApp, SMS, or email). Returns a session ID and challenge details.

Instructions

Start a login session by sending an authentication challenge to the user's chosen channel (Telegram, WhatsApp, SMS, or email). Returns a session ID and, FOR TELEGRAM AND WHATSAPP ONLY, deep_link, qr_code (base64 PNG) and qr_text (UTF-8 text QR for terminal display); on sms it returns sms_message with sms_dids instead, and on email nothing to display.

Agent usage: (1) Call start_login with the desired channel and phone_number (for SMS) or email (for email). (2) Present the challenge, and WHICH FIELD depends on the channel. On telegram/whatsapp pass deep_link to render_auth_link, which returns the clickable link and a QR code to you; in a chat client the link is what the user acts on, since they are usually on the same machine. On sms deep_link is an EMPTY STRING and render_auth_link will reject it — show sms_message and let the user pick a number from sms_dids. suggested_region is always set, but the matching ENTRY in sms_dids may be missing (europe and israel appear only when a number is configured) or present with an empty did, so offer that region first only when sms_dids[suggested_region] exists and carries a number, and otherwise offer whatever the object does. On email there is nothing to display at all, and nothing to check either: a result means the mail was accepted for delivery, so tell the user to open their inbox. A delivery failure is an ERROR here, not a field — the tool answers challenge_delivery_failed and NO session exists, so do not call wait_for_login; retry, or offer another channel. Never hand qr_text to a link renderer — it is the link already rendered as QR art, so print it verbatim inside a fenced code block or not at all, because its rows stop scanning the moment one wraps or a blank line lands between them. (3) Once your reply shows the user the challenge, call wait_for_login with the returned session ID to poll until the user completes authentication. Terminal states: "verified" (login succeeded), "failed", "expired".

The user does not see tool results — most clients fold them away, render_auth_link's output included. Before you wait or poll, put what the user must act on into your own reply text: the link itself (not a sentence announcing it), the SMS text and number, or a note to check their inbox.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
emailNoEmail address (required for email channel)
channelYesAuthentication channel
phone_numberNoPhone number in E.164 format (required for SMS channel)

Schema Changelog

Changes observed during successful MCP inspections.

  1. First observedv1.1.0

TDQS

A4.8/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations only declare readOnlyHint=false and destructiveHint=false; the description adds substantial behavior beyond that: per-channel return shapes, that deep_link is an empty string on SMS and render_auth_link will reject it, that suggested_region may lack a matching sms_dids entry, that delivery failure surfaces as an error and creates no session, and that tool results are folded away from the user so replies must be composed manually.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded with a one-sentence purpose followed by a numbered flow, and each sentence generally carries channel-specific operational detail rather than filler. It is nonetheless long and relies on heavy ALL-CAPS and parenthetical caveats that could be tightened, so it is efficient but not maximally tight.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

There is no output schema, so the description must carry the return-value burden and it does: it documents deep_link/qr_code/qr_text for Telegram and WhatsApp, sms_message/sms_dids for SMS, and that email returns nothing displayable. It also covers terminal states (verified, failed, expired) and the delivery-failure error path, leaving nothing an agent needs to invoke it correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline is 3, but the description adds real per-parameter semantics: phone_number is required only for SMS, email only for email, and channel selection determines which fields come back and what to do with each. That is more than the schema's field-level notes, though it does not add syntax detail for phone_number beyond E.164 already in the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('Start a login session by sending an authentication challenge') and enumerates the exact channel set (Telegram, WhatsApp, SMS, email). It further disambiguates by naming the downstream siblings it pairs with (render_auth_link, wait_for_login), so an agent can place it in the auth flow without opening the schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides an explicit numbered flow: (1) call start_login with channel plus phone_number/email, (2) present the challenge, (3) call wait_for_login with the returned session ID. It also gives when-NOT guidance — do not call wait_for_login after a challenge_delivery_failed error because no session exists — and tells the agent to retry or offer another channel instead.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Deploy Server

Other Tools