@proof-holdings/mcp-server

Official

Overview Schema Source Related Servers Discussions Admin

wait_for_request

Read-only

Polls a verification request until it reaches a terminal state—completed, expired, or cancelled—using exponential backoff, so you can wait for a definitive result instead of checking manually.

Instructions

Poll a verification request until it reaches a terminal state (completed, expired, or cancelled). Uses exponential backoff (2s initial, 1.5x, 30s max) with jitter.

ACCESS: needs a Proof account. Set PROOF_API_KEY and restart this server, then call this tool again. start_login does NOT open this tool.

Tool call template

Replace each placeholder with a value matching the input schema. Only required parameters are included; add optional parameters as needed.

{
  "id": 1,
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "arguments": {
      "id": "<id>"
    },
    "name": "wait_for_request"
  }
}

Input Schema

Name	Required	Description	Default
`id`	Yes	Verification request ID to poll
`timeout_seconds`	No	Maximum wait time in seconds (default: 50, max: 300). Keep it under your MCP client's request timeout (the SDK default is 60 s) — a longer wait is cut off by the client while the server is still polling. On timeout the tool answers status "pending"; call it again with the same identifier.

Output Schema

Name	Required	Description
`id`	No	MongoDB ObjectId
`assets`	No
`status`	No	"pending" when the wait ran out before a terminal state; otherwise the resource's own status
`message`	No	On timeout: what to do next (call the tool again with the same identifier)
`progress`	No
`created_at`	No
`expires_at`	No
`partial_ok`	No
`updated_at`	No
`action_type`	No	Type of action for verification request or authorization
`last_status`	No	On timeout: the last non-terminal status observed, or null when none was
`callback_url`	No	The webhook URL set on the request, if any
`completed_at`	No
`redirect_url`	No
`reference_id`	No
`action_context`	No	The action the person is asked to authorize; null when the request carries none
`computed_state`	No	Additive machine-readable effective state: re-derives expiry from expires_at (never trusts the stored status). BOTH `is_expiring_soon` and `next_action` are role-aware — `next_action.role` says which side this envelope was computed for, and the two fields are consistent within it. Present only on authenticated owner/requester and recipient responses; absent on public/third-party surfaces.
`waited_seconds`	No	On timeout: seconds actually waited
`timeout_seconds`	No	On timeout: the wait budget this call was given
`verification_url`	No	URL for the verification flow
`validity_requirement`	No	Required proof freshness as set on the request (e.g. "7d"); null when none was set

Schema Changelog

Changes observed during successful MCP inspections.

Changed2 schema fields changedv1.7.2Nov 6, 2026

removedInput schema / additionalProperties
```
Removed value: -false
```

changedOutput schema / (root)

Previous value: -nullNew value: +{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "additionalProperties": {},
+  "properties": {
+    "action_context": {
+      "description": "The action the person is asked to authorize; null when the request carries none"
+    },
+    "action_type": {
+      "description": "Type of action for verification request or authorization"
+    },
+    "assets": {},
+    "callback_url": {
+      "description": "The webhook URL set on the request, if any"
+    },
+    "completed_at": {},
+    "computed_state": {
+      "description": "Additive machine-readable effective state: re-derives expiry from expires_at (never trusts the stored status). BOTH `is_expiring_soon` and `next_action` are role-aware — `next_action.role` says which side this envelope was computed for, and the two fields are consistent within it. Present only on authenticated owner/requester and recipient responses; absent on public/third-party surfaces."
+    },
+    "created_at": {},
+    "expires_at": {},
+    "id": {
+      "description": "MongoDB ObjectId"
+    },
+    "last_status": {
+      "description": "On timeout: the last non-terminal status observed, or null when none was"
+    },
+    "message": {
+      "description": "On timeout: what to do next (call the tool again with the same identifier)"
+    },
+    "partial_ok": {},
+    "progress": {},
+    "redirect_url": {},
+    "reference_id": {},
+    "status": {
+      "description": "\"pending\" when the wait ran out before a terminal state; otherwise the resource's own status"
+    },
+    "timeout_seconds": {
+      "description": "On timeout: the wait budget this call was given"
+    },
+    "updated_at": {},
+    "validity_requirement": {
+      "description": "Required proof freshness as set on the request (e.g. \"7d\"); null when none was set"
+    },
+    "verification_url": {
+      "description": "URL for the verification flow"
+    },
+    "waited_seconds": {
+      "description": "On timeout: seconds actually waited"
+    }
+  },
+  "type": "object"
+}

First observedv1.1.0Sep 9, 2026

TDQS

A3.8/5.0

Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations only declare readOnlyHint=true, so the description carries the rest and does it well: the exponential backoff schedule (2s initial, 1.5x, 30s max), jitter, the terminal-state set, and the concrete timeout return value of "pending". The PROOF_API_KEY requirement and restart instruction are behavior an agent cannot infer from schema or annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two short blocks with the core behavior first and the prerequisite second; every sentence carries information about polling, timing, or access. The quoted ACCESS block is slightly heavy for what it conveys but is not wasted given the tool is otherwise unusable without the key.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so return values need no prose, and the description still covers the one non-obvious return case (status "pending" on timeout). Auth and timing are covered; the only real gap is disambiguating this waiter from the several other wait_for_* and get_verification_request tools.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline is 3, but the description adds meaning: the backoff ceiling explains why short timeouts are cheap, and "call it again with the same identifier" clarifies that id is stable across retries rather than a one-shot handle. The interaction between timeout_seconds and the client-side request timeout is the key semantic and it is surfaced.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource: poll a verification request until it reaches a terminal state, and enumerates those states (completed, expired, cancelled). It does not name the sibling it replaces, so an agent still has to guess between this, wait_for_verification, wait_for_session, and a manual get_verification_request loop.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It gives real operational guidance — keep timeout_seconds under the client timeout, and on "pending" call again with the same identifier — plus an access prerequisite that start_login does not unlock this tool. What is missing is the when-to-use-vs-alternatives statement: nothing says why to prefer this over get_verification_request or wait_for_verification.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Deploy Server