@proof-holdings/mcp-server

Official

Overview Schema Source Related Servers Discussions Admin

upload_hitl_keys

Destructive

Uploads a client-encrypted RSA-4096 keypair for a HITL config so the server can validate the public key and compute its key ID without accessing the user's password.

Instructions

Upload an encryption keypair for a HITL config. The server validates the RSA-4096 public key and computes the key ID. Note: the encrypted_private_key is already encrypted client-side with the user's password — the server never sees the password.

ACCESS: needs a Proof account. Set PROOF_API_KEY and restart this server, then call this tool again. start_login does NOT open this tool.

Input Schema

Name	Required	Description
`dek_iv`	No	v2 envelope: the IV of that wrapping
`dek_tag`	No	v2 envelope: the GCM tag of that wrapping
`hitl_id`	Yes	HITL config ID
`kdf_salt`	Yes	Base64url-encoded PBKDF2 salt
`public_key`	Yes	PEM-encoded RSA-4096 SPKI public key
`wrapped_dek`	No	v2 envelope: the data key wrapped under the master key
`backup_dek_iv`	No	v2 envelope: the IV of the recovery wrapping
`backup_dek_tag`	No	v2 envelope: the GCM tag of the recovery wrapping
`backup_wrapped_dek`	No	v2 envelope: the data key wrapped under the recovery code
`encrypted_private_key`	Yes	JSON-serialized encrypted private key envelope (PBKDF2-SHA256+AES-256-GCM)

Output Schema

Name	Required	Description	Default
`kid`	Yes	The stored key's id
`message`	Yes

Schema Changelog

Changes observed during successful MCP inspections.

Changed8 schema fields changedv1.7.2Nov 6, 2026

removedInput schema / additionalProperties
```
Removed value: -false
```

addedInput schema / properties / backup_dek_iv

Added value: +{
+  "description": "v2 envelope: the IV of the recovery wrapping",
+  "maxLength": 64,
+  "minLength": 1,
+  "type": "string"
+}

addedInput schema / properties / backup_dek_tag

Added value: +{
+  "description": "v2 envelope: the GCM tag of the recovery wrapping",
+  "maxLength": 64,
+  "minLength": 1,
+  "type": "string"
+}

addedInput schema / properties / backup_wrapped_dek

Added value: +{
+  "description": "v2 envelope: the data key wrapped under the recovery code",
+  "maxLength": 500,
+  "minLength": 1,
+  "type": "string"
+}

addedInput schema / properties / dek_iv

Added value: +{
+  "description": "v2 envelope: the IV of that wrapping",
+  "maxLength": 64,
+  "minLength": 1,
+  "type": "string"
+}

addedInput schema / properties / dek_tag

Added value: +{
+  "description": "v2 envelope: the GCM tag of that wrapping",
+  "maxLength": 64,
+  "minLength": 1,
+  "type": "string"
+}

addedInput schema / properties / wrapped_dek

Added value: +{
+  "description": "v2 envelope: the data key wrapped under the master key",
+  "maxLength": 500,
+  "minLength": 1,
+  "type": "string"
+}

changedOutput schema / (root)

Previous value: -nullNew value: +{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "additionalProperties": {},
+  "description": "The keypair stored",
+  "properties": {
+    "kid": {
+      "description": "The stored key's id",
+      "type": "string"
+    },
+    "message": {
+      "type": "string"
+    }
+  },
+  "required": [
+    "kid",
+    "message"
+  ],
+  "type": "object"
+}

First observedv1.1.0Sep 9, 2026

TDQS

A3.6/5.0

Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=false and destructiveHint=true, and the description adds genuinely useful behavior the annotations cannot convey: server-side validation, server-computed key ID, and that the password never leaves the client. However, it never addresses the destructive half of the profile - what happens to a previously uploaded keypair, whether re-upload replaces or errors, and whether the old key becomes undecryptable.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three short sentences, front-loaded with the action and followed by the validation note and the access caveat, with no filler. The encryption caveat and the access block are separated cleanly enough that an agent can stop reading after the first sentence if it already has credentials.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so return values need no prose, and the auth blocker is covered well. Against a 10-parameter cryptographic tool with a destructive annotation, though, the description leaves the overwrite/replacement semantics and the meaning of the six optional v2 envelope parameters entirely to the schema.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the schema already labels every field. The description still adds real meaning for two of them - public_key must be RSA-4096 and encrypted_private_key is client-side PBKDF2/AES-256-GCM output, with the password never transmitted - which is beyond the schema. It says nothing about the optional v2 envelope fields (wrapped_dek, dek_iv, dek_tag, backup_*), so the gain over the schema is partial.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ("Upload an encryption keypair for a HITL config") and adds that the server validates the RSA-4096 public key and derives the key ID, which tells the agent this is not a blind write. It does not name the adjacent siblings get_hitl_keys / delete_hitl_keys, so the distinction is inferable from the name rather than stated.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The ACCESS block gives concrete preconditions (Proof account, PROOF_API_KEY set, server restart) and explicitly rules out a tempting wrong path with "start_login does NOT open this tool." What is missing is any guidance on when to re-upload versus read existing keys with get_hitl_keys, or whether a HITL config must already exist.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Deploy Server