Skip to main content
Glama
Sign In
@proof-holdings/mcp-server

@proof-holdings/mcp-server

Official
by ProofHoldings
OverviewSchemaSourceRelated ServersDiscussionsAdmin
TypeScript
Hybrid

wait_for_2fa

Read-only

Poll a 2FA session until the user completes the challenge. Returns a verified or expired status so the agent knows whether to proceed with the protected operation or restart.

Instructions

Poll a 2FA session until the user completes the challenge. Uses exponential backoff (2s initial, 1.5x, 30s max) with jitter.

Agent usage: Call this after start_2fa with the returned session_id. Terminal states: "verified" (challenge completed — proceed with the protected operation), "expired" (offer to restart with start_2fa). Before polling, present start_2fa's challenge: pass its deep_link to render_auth_link on telegram/whatsapp, or show its sms_message on sms.

The user does not see tool results — most clients fold them away, render_auth_link's output included. Before you wait or poll, put what the user must act on into your own reply text: the link itself (not a sentence announcing it), the SMS text and number, or a note to check their inbox.

ACCESS: needs a Proof account. Set PROOF_API_KEY and restart this server, then call this tool again. start_login does NOT open this tool.

Input Schema

NameRequiredDescriptionDefault
session_idYes2FA session ID from start_2fa
timeout_secondsNoMaximum wait time in seconds (default: 50, max: 600). Keep it under your MCP client's request timeout (the SDK default is 60 s) — a longer wait is cut off by the client while the server is still polling. On timeout the tool answers status "pending"; call it again with the same identifier.

Output Schema

NameRequiredDescriptionDefault
statusNo"pending" when the wait ran out before a terminal state; otherwise the resource's own status
messageNoOn timeout: what to do next (call the tool again with the same identifier)
session_idNo
action_typeNoThe action the session was started for: one of `TwoFAActionType` for sessions started through this API; admin-console sessions carry internal values.
last_statusNoOn timeout: the last non-terminal status observed, or null when none was
verified_atNo
waited_secondsNoOn timeout: seconds actually waited
timeout_secondsNoOn timeout: the wait budget this call was given
grant_expires_atNoWhen the grant this step-up stored stops being accepted
grant_single_useNoWhether the grant is spent by the first act it allows

Schema Changelog

Changes observed during successful MCP inspections.

  1. Changed2 schema fields changedv1.7.2
    • removedInput schema / additionalProperties
      Removed value: -false
    • changedOutput schema / (root)
      Previous value: -nullNew value: +{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "additionalProperties": {},
+  "properties": {
+    "action_type": {
+      "description": "The action the session was started for: one of `TwoFAActionType` for sessions started through this API; admin-console sessions carry internal values."
+    },
+    "grant_expires_at": {
+      "description": "When the grant this step-up stored stops being accepted"
+    },
+    "grant_single_use": {
+      "description": "Whether the grant is spent by the first act it allows"
+    },
+    "last_status": {
+      "description": "On timeout: the last non-terminal status observed, or null when none was"
+    },
+    "message": {
+      "description": "On timeout: what to do next (call the tool again with the same identifier)"
+    },
+    "session_id": {},
+    "status": {
+      "description": "\"pending\" when the wait ran out before a terminal state; otherwise the resource's own status"
+    },
+    "timeout_seconds": {
+      "description": "On timeout: the wait budget this call was given"
+    },
+    "verified_at": {},
+    "waited_seconds": {
+      "description": "On timeout: seconds actually waited"
+    }
+  },
+  "type": "object"
+}
  2. First observedv1.1.0

TDQS

A4.8/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations only declare readOnlyHint=true, consistent with polling. The description adds substantial context beyond that: exponential backoff parameters, the pending-on-timeout behavior and retry instruction, the access prerequisite (PROOF_API_KEY), and the important caveat that users do not see tool results so the link/SMS text must be echoed in the reply.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Well front-loaded: core behavior first, then agent usage, then a UX caveat and access note. Slightly long, and the final ACCESS sentence about start_login not opening the tool is a bit tangential, but every paragraph carries actionable information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a two-parameter polling tool with an output schema, this covers everything needed: preconditions, terminal states, timeout semantics, rendering requirements, and auth setup. Nothing an agent needs to invoke it correctly is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline is 3. The description adds provenance for session_id (from start_2fa) and explains the consequence of timeout_seconds expiring (status 'pending', call again), which goes beyond the schema's warning about client request timeouts.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Opens with a specific verb and resource: 'Poll a 2FA session until the user completes the challenge.' This is clearly distinct from sibling pollers like get_2fa_status and wait_for_login because the object (a 2FA session started by start_2fa) is named explicitly.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

States the precondition ('Call this after start_2fa with the returned session_id'), enumerates terminal states and the follow-up action for each ('expired' → restart with start_2fa), and tells the agent to render the challenge via render_auth_link before polling. When-to-use and what-to-do-next are both explicit.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Deploy Server

Other Tools