Proof Holdings
warningsapi.proof.holdings
One API, all things verified — control, delegation, human approval, anti-impersonation.
https://api.proof.holdings/mcpWebsiteOAuthMCP 2025-11-25v1.7.1last checked 25 Oct 2026spoke MCP on 41.2% of 85 checks (30 days)initialize in 263 msLast checked 25 Oct 2026
- ✓Answered the MCP handshake (MCP 2025-11-25)
- ✓Auth detected: OAuth
- ✓Lists 167 tools
- !1 warning
- !Spoke MCP on 35 of 85 checks (30 days)
Will my client connect?
Decided from what the probe found at the endpoint, and from what each client's own documentation says it can complete. Every row carries the day that documentation was read.
✓Claude CodeConnects
The authorization server advertises RFC 7591 registration, so Claude Code can register itself and sign you in through the browser.
claude mcp add --transport http proof-holdings https://api.proof.holdings/mcpClaude Code docs · read on 2026-08-30
✓Claude (claude.ai & Desktop)Connects
The authorization server advertises RFC 7591 registration, so Claude (claude.ai & Desktop) can register itself and sign you in through the browser.
Settings → Connectors → Add custom connector, then paste https://api.proof.holdings/mcp.
Claude (claude.ai & Desktop) docs · read on 2026-08-30
✓ChatGPTConnects
The authorization server advertises RFC 7591 registration, so ChatGPT can register itself and sign you in through the browser.
Settings → Apps → Advanced settings → Developer mode, then create a connector pointing at https://api.proof.holdings/mcp.
ChatGPT docs · read on 2026-08-30
✓CursorConnects
The authorization server advertises RFC 7591 registration, so Cursor can register itself and sign you in through the browser.
{
"mcpServers": {
"proof-holdings": {
"url": "https://api.proof.holdings/mcp"
}
}
}Cursor docs · read on 2026-08-30
✓VS Code (Copilot)Connects
The authorization server advertises RFC 7591 registration, so VS Code (Copilot) can register itself and sign you in through the browser.
{
"servers": {
"proof-holdings": {
"type": "http",
"url": "https://api.proof.holdings/mcp"
}
}
}VS Code (Copilot) docs · read on 2026-08-30
How to authenticate
Checked against the endpoint by our probe on 25 Oct 2026. These are the capabilities the server advertises, not a prediction about any particular client.
| Scheme | OAuth |
|---|---|
| Issuer | https://api.proof.holdings |
| Dynamic client registration | ✓Advertised (RFC 7591) |
| Client ID Metadata Document | ✕Not advertised |
| PKCE | ✓S256 |
| Grant types | authorization_code, refresh_token |
| Scopes | verifications:read, verifications:write, verifications:create, verifications:*, proofs:read, proofs:*, delegations:read, delegations:write, delegations:create, delegations:*, lookalike-watch:read, lookalike-watch:write, lookalike-watch:*, templates:read, templates:write, templates:*, authorizations:read, authorizations:write, authorizations:create, authorizations:*, hitl:read, hitl:write, hitl:create, hitl:*, confirmations:read, confirmations:write, confirmations:create, confirmations:*, circles:read, circles:write, circles:create, circles:*, profiles:read, profiles:write, profiles:*, billing:read, settings:read, settings:write, settings:*, assets:read, assets:write, assets:*, webhooks:read, webhooks:write, webhooks:* |
| Protected-resource metadata | ✓Published (RFC 9728) |
| Anonymous access | Handshake succeeds; 167 tools listable |
| Credentials demanded in prose | ✕create_verification, get_verification, list_verifications, trigger_verification, submit_verification_code, resend_verification, test_verify, list_verified_users, get_verified_user, start_domain_verification, check_domain_verification, delete_domain_verification, wait_for_verification, create_multi_channel_verification, get_multi_channel_verification_status, create_verification_request, get_verification_request, get_request_proofs, list_verification_requests, get_request_by_reference, cancel_verification_request, wait_for_request, validate_proof, get_proof_status, revoke_proof, create_session, get_session, wait_for_session, list_assets, get_asset, revoke_asset, get_current_user, list_auth_sessions, revoke_auth_session, get_usage, get_platform_summary, get_settings, update_settings, export_data, search, get_self_api_key, get_api_key_usage, list_templates, get_default_templates, get_template, update_template, delete_template, preview_template, render_template, get_webhook_stats, list_webhook_deliveries, get_webhook_delivery, retry_webhook_delivery, get_subscription, list_profiles, create_profile, get_profile, update_profile, delete_profile, set_primary_profile, update_profile_proofs, get_my_profile, update_my_profile, get_profile_assets, list_emails, remove_email, set_primary_email, start_add_email, get_add_email_status, verify_email_otp, resend_email_otp, list_phones, remove_phone, set_primary_phone, start_add_phone, get_add_phone_status, list_api_keys, create_api_key, revoke_api_key, regenerate_api_key, start_2fa, get_2fa_status, verify_2fa, verify_2fa_magic_link, wait_for_2fa, list_domains, add_domain, get_domain, delete_domain, verify_domain, connect_cloudflare, connect_godaddy, connect_dns_provider, add_verification_provider, get_dns_providers, verify_domain_with_credentials, check_domain_credentials, start_domain_email_verification, confirm_domain_email_code, resend_domain_email, setup_domain_email, check_domain_email_status, list_dns_credentials, create_dns_credential, delete_dns_credential, list_my_requests, list_incoming_requests, create_user_request, cancel_user_request, extend_request, share_request_email, start_user_domain_verification, get_user_domain_verification_status, check_user_domain_verification, claim_username, update_public_proofs, create_authorization, get_authorization, list_authorizations, revoke_authorization, export_authorizations, create_confirmation, get_confirmation, list_confirmations, get_confirmation_approval_link, wait_for_confirmation, create_hitl, get_hitl, list_hitls, update_hitl, delete_hitl, request_hitl_authorization, create_chat_id_discovery, poll_chat_id_discovery, wait_for_chat_id_discovery, get_hitl_keys, upload_hitl_keys, delete_hitl_keys, create_identity_challenge, get_identity_challenge, create_circle, list_circles, get_circle, update_circle, delete_circle, add_circle_member, list_circle_members, invite_circle_member, create_circle_member_drill, remove_circle_member, add_circle_member_channel, list_circle_member_channels, remove_circle_member_channel, create_delegation, list_delegations, get_delegation, revoke_delegation, verify_delegation, verify_delegations, create_account, send_account_email, start_2fa_for_action These tools are listed anonymously and their own descriptions ask for an account or key, but no challenge is issued — so a client has nothing to act on and the refusal arrives as a tool error. |
| Documentation | https://proof.holdings/docs |
What the probe found
162 of the 167 tools listed anonymously say in their own descriptions that they need an account or a key (create_verification, get_verification, list_verifications, trigger_verification, submit_verification_code, resend_verification, test_verify, list_verified_users, get_verified_user, start_domain_verification, check_domain_verification, delete_domain_verification, wait_for_verification, create_multi_channel_verification, get_multi_channel_verification_status, create_verification_request, get_verification_request, get_request_proofs, list_verification_requests, get_request_by_reference, cancel_verification_request, wait_for_request, validate_proof, get_proof_status, revoke_proof, create_session, get_session, wait_for_session, list_assets, get_asset, revoke_asset, get_current_user, list_auth_sessions, revoke_auth_session, get_usage, get_platform_summary, get_settings, update_settings, export_data, search, get_self_api_key, get_api_key_usage, list_templates, get_default_templates, get_template, update_template, delete_template, preview_template, render_template, get_webhook_stats, list_webhook_deliveries, get_webhook_delivery, retry_webhook_delivery, get_subscription, list_profiles, create_profile, get_profile, update_profile, delete_profile, set_primary_profile, update_profile_proofs, get_my_profile, update_my_profile, get_profile_assets, list_emails, remove_email, set_primary_email, start_add_email, get_add_email_status, verify_email_otp, resend_email_otp, list_phones, remove_phone, set_primary_phone, start_add_phone, get_add_phone_status, list_api_keys, create_api_key, revoke_api_key, regenerate_api_key, start_2fa, get_2fa_status, verify_2fa, verify_2fa_magic_link, wait_for_2fa, list_domains, add_domain, get_domain, delete_domain, verify_domain, connect_cloudflare, connect_godaddy, connect_dns_provider, add_verification_provider, get_dns_providers, verify_domain_with_credentials, check_domain_credentials, start_domain_email_verification, confirm_domain_email_code, resend_domain_email, setup_domain_email, check_domain_email_status, list_dns_credentials, create_dns_credential, delete_dns_credential, list_my_requests, list_incoming_requests, create_user_request, cancel_user_request, extend_request, share_request_email, start_user_domain_verification, get_user_domain_verification_status, check_user_domain_verification, claim_username, update_public_proofs, create_authorization, get_authorization, list_authorizations, revoke_authorization, export_authorizations, create_confirmation, get_confirmation, list_confirmations, get_confirmation_approval_link, wait_for_confirmation, create_hitl, get_hitl, list_hitls, update_hitl, delete_hitl, request_hitl_authorization, create_chat_id_discovery, poll_chat_id_discovery, wait_for_chat_id_discovery, get_hitl_keys, upload_hitl_keys, delete_hitl_keys, create_identity_challenge, get_identity_challenge, create_circle, list_circles, get_circle, update_circle, delete_circle, add_circle_member, list_circle_members, invite_circle_member, create_circle_member_drill, remove_circle_member, add_circle_member_channel, list_circle_member_channels, remove_circle_member_channel, create_delegation, list_delegations, get_delegation, revoke_delegation, verify_delegation, verify_delegations, create_account, send_account_email, start_2fa_for_action), but the endpoint issued no WWW-Authenticate challenge. The requirement is stated only in prose, so a call reaches the tool and comes back as a tool error instead of an authorization step.
A cross-origin preflight came back without Access-Control-Allow-Origin, so the endpoint is reachable from native clients only — code running in a web page is stopped by the browser before a request is ever sent.
The server exposes a public surface before authorization: create_verification, get_verification, list_verifications, trigger_verification, submit_verification_code, resend_verification, test_verify, list_verified_users, get_verified_user, start_domain_verification, check_domain_verification, delete_domain_verification, wait_for_verification, create_multi_channel_verification, get_multi_channel_verification_status, create_verification_request, get_verification_request, get_request_proofs, list_verification_requests, get_request_by_reference, cancel_verification_request, wait_for_request, validate_proof, get_proof_status, revoke_proof, list_revoked_proofs, create_session, get_session, wait_for_session, list_assets, get_asset, revoke_asset, get_current_user, list_auth_sessions, revoke_auth_session, get_usage, get_platform_summary, get_settings, update_settings, export_data, search, get_self_api_key, get_api_key_usage, list_templates, get_default_templates, get_template, update_template, delete_template, preview_template, render_template, get_webhook_stats, list_webhook_deliveries, get_webhook_delivery, retry_webhook_delivery, get_subscription, list_profiles, create_profile, get_profile, update_profile, delete_profile, set_primary_profile, update_profile_proofs, get_my_profile, update_my_profile, get_profile_assets, list_emails, remove_email, set_primary_email, start_add_email, get_add_email_status, verify_email_otp, resend_email_otp, list_phones, remove_phone, set_primary_phone, start_add_phone, get_add_phone_status, list_api_keys, create_api_key, revoke_api_key, regenerate_api_key, start_2fa, get_2fa_status, verify_2fa, verify_2fa_magic_link, wait_for_2fa, list_domains, add_domain, get_domain, delete_domain, verify_domain, connect_cloudflare, connect_godaddy, connect_dns_provider, add_verification_provider, get_dns_providers, verify_domain_with_credentials, check_domain_credentials, start_domain_email_verification, confirm_domain_email_code, resend_domain_email, setup_domain_email, check_domain_email_status, list_dns_credentials, create_dns_credential, delete_dns_credential, list_my_requests, list_incoming_requests, create_user_request, cancel_user_request, extend_request, share_request_email, start_user_domain_verification, get_user_domain_verification_status, check_user_domain_verification, claim_username, update_public_proofs, create_authorization, get_authorization, list_authorizations, revoke_authorization, export_authorizations, create_confirmation, get_confirmation, list_confirmations, get_confirmation_approval_link, wait_for_confirmation, create_hitl, get_hitl, list_hitls, update_hitl, delete_hitl, request_hitl_authorization, create_chat_id_discovery, poll_chat_id_discovery, wait_for_chat_id_discovery, get_hitl_keys, upload_hitl_keys, delete_hitl_keys, create_identity_challenge, get_identity_challenge, create_circle, list_circles, get_circle, update_circle, delete_circle, add_circle_member, list_circle_members, invite_circle_member, create_circle_member_drill, remove_circle_member, add_circle_member_channel, list_circle_member_channels, remove_circle_member_channel, create_delegation, list_delegations, get_delegation, revoke_delegation, verify_delegation, verify_delegations, start_login, wait_for_login, create_account, send_account_email, wait_for_account_creation, start_2fa_for_action, render_auth_link.
Neither the reserved <endpoint>/server-card location nor the domain's /.well-known/ai-catalog.json describes this endpoint (SEP-2127), so a client that discovers servers by domain will not find it.
Tools
Contract history
Breaking: create_session
Breaking: delete_profile_template, list_profile_templates, list_templates, preview_profile_template, update_profile_template, update_settings
Instructions rewritten: create_profile, delete_template, get_default_templates, get_settings, get_template, list_templates, preview_template, render_template, update_profile, update_settings, update_template. The description an agent follows changed; the callable contract may not have.
Watch this server
Save its public contract as a baseline and manage breaking-change email alerts.
Set up a watchRoute it through the gateway
Put this endpoint behind one find_tools / call_tool pair with the rest of your servers. Part of Pro.
Add to my gatewayOwn this server?
Sign in to claim this listing by proving control of its host.
Status badge
Status for a README, from the last probe — cached an hour, so up to seven hours behind the endpoint. Links back to this page.
[](https://mcpi.app/servers/proof-holdings)