Skip to main content
Glama
ProofHoldings

@proof-holdings/mcp-server

Official
by ProofHoldings
OverviewSchemaSourceRelated ServersDiscussionsAdmin
TypeScript
Hybrid

update_settings

Destructive

Update your Proof account's webhook URL, event subscriptions, and default proof lifetime. The first webhook creates a signing secret.

Instructions

Update account settings: the outbound webhook endpoint with its event subscriptions, and the default proof lifetime. Branding belongs to each sub-account (project): change it with update_profile. Setting the first webhook endpoint creates the signing secret and returns it in this response; the value is returned only when this call created or rotated it, so record it then.

ACCESS: needs a Proof account. Set PROOF_API_KEY and restart this server, then call this tool again. start_login does NOT open this tool.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
webhookNoOutbound webhook configuration. Deliveries carry an HMAC-SHA256 X-Proof-Signature over "<X-Proof-Timestamp>.<body>".
proof_expiry_daysNoDefault proof-token lifetime in days for newly issued proofs

Schema Changelog

Changes observed during successful MCP inspections.

  1. Changed1 schema field changedv1.7.0
    • removedInput schema / properties / branding
      Removed value: -{
-  "additionalProperties": false,
-  "description": "Branding settings to update",
-  "properties": {
-    "business_name": {
-      "description": "Business name displayed in verifications",
-      "maxLength": 100,
-      "type": "string"
-    },
-    "email_theme": {
-      "description": "Email template theme",
-      "enum": [
-        "dark",
-        "light"
-      ],
-      "type": "string"
-    },
-    "logo_url": {
-      "anyOf": [
-        {
-          "anyOf": [
-            {
-              "not": {}
-            },
-            {
-              "format": "uri",
-              "type": "string"
-            }
-          ]
-        },
-        {
-          "type": "null"
-        }
-      ],
-      "description": "HTTPS URL to business logo"
-    },
-    "primary_color": {
-      "description": "Primary brand color (hex, e.g. #FF5733)",
-      "pattern": "^#[0-9A-Fa-f]{6}$",
-      "type": "string"
-    },
-    "support_email": {
-      "description": "Support email shown in verification messages",
-      "format": "email",
-      "type": "string"
-    }
-  },
-  "type": "object"
-}
  2. Changed2 schema fields changedv1.6.0
    • addedInput schema / properties / proof_expiry_days
      Added value: +{
+  "description": "Default proof-token lifetime in days for newly issued proofs",
+  "maximum": 365,
+  "minimum": 1,
+  "type": "integer"
+}
    • addedInput schema / properties / webhook
      Added value: +{
+  "additionalProperties": false,
+  "description": "Outbound webhook configuration. Deliveries carry an HMAC-SHA256 X-Proof-Signature over \"<X-Proof-Timestamp>.<body>\".",
+  "properties": {
+    "events": {
+      "description": "Subscription patterns: an exact event type, a family wildcard such as \"proof.*\", or \"*\". An empty list means every event.",
+      "items": {
+        "type": "string"
+      },
+      "maxItems": 32,
+      "type": "array"
+    },
+    "rotate_secret": {
+      "description": "Replace the signing secret and return the new value. The previous value stops verifying immediately.",
+      "type": "boolean"
+    },
+    "url": {
+      "anyOf": [
+        {
+          "format": "uri",
+          "maxLength": 2000,
+          "type": "string"
+        },
+        {
+          "type": "null"
+        }
+      ],
+      "description": "HTTPS endpoint outbound webhooks are delivered to, at most 2000 characters; null removes it. Private, loopback and link-local addresses are refused."
+    }
+  },
+  "type": "object"
+}
  3. First observedv1.1.0

TDQS

A4.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already flag destructiveHint=true, and the description adds real behavioral content on top: setting the first webhook endpoint mints a signing secret, that secret is returned only when this call created or rotated it, and it must be recorded at that moment. It also discloses the auth precondition. It doesn't spell out the destructive consequence of a null url beyond what the schema says, but the added disclosure is substantive.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The first sentence front-loads the two things that can be changed and the sibling exclusion; the second paragraph covers the auth requirement and the secret-return nuance. Every sentence earns its place, though the access paragraph is slightly long for what it conveys.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema, the description usefully explains the one return value that matters (the signing secret and when it appears). Nested webhook fields, auth requirements, and the profile-vs-account boundary are all covered. Minor gaps remain around webhook removal semantics and error conditions, but nothing blocking a correct call.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline is 3. The description adds meaning the schema does not: the ordering/one-shot nature of the signing-secret return (only on creation or rotation), which is the key operational subtlety of the webhook parameter. It also frames proof_expiry_days as applying to 'newly issued proofs,' reinforcing the schema's wording.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('Update account settings') and enumerates exactly what is mutable: the outbound webhook endpoint with event subscriptions and the default proof lifetime. It goes further by explicitly carving out branding as belonging to sub-accounts and routing that work to update_profile, so the agent can separate this tool from a large sibling set without reading schemas.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Names the sibling alternative (update_profile) together with the condition that selects it (branding is per sub-account/project), and adds an explicit when-not: 'start_login does NOT open this tool.' It also states the access precondition (a Proof account with PROOF_API_KEY set and server restarted) so the agent knows the call will fail without it.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Deploy Server

Other Tools