@reclaimprotocol/agent 0.1.0-dev.1

package/src/mcp/api/operations.gen.ts

@@ -0,0 +1,2397 @@
+// AUTO-GENERATED by packages/app/scripts/mcp-tools-gen.ts
+// from packages/app/openapi.yaml.
+// Run `npm run openapi:typegen --workspace=packages/agent`
+// to regenerate. Do not edit by hand.
+// @ts-nocheck
+
+import { convertJsonSchemaToZod as toZod } from 'zod-from-json-schema'
+
+export const MCP_TOOLS = {
+	"AddOrgMember": {
+		description: "Invite a member to an organization\n\nOwner only. Invites a user to the organization by email. The invitee does **not** need to be a registered user — an invite is created in either case, and an email is dispatched. The new row is returned with `status: PENDING`; it flips to `ACTIVE` on first sign-in by the invited email. `PERSONAL` organizations reject this call (409). In the current milestone the email is not actually dispatched — the invite is auto-claimed when the invitee next signs in.",
+		inputSchema: toZod({
+			"type": "object",
+			"properties": {
+				"params": {
+					"type": "object",
+					"properties": {
+						"orgId": {
+							"type": "string",
+							"format": "uuid"
+						}
+					},
+					"required": [
+						"orgId"
+					],
+					"additionalProperties": false
+				},
+				"query": {
+					"type": "object",
+					"properties": {
+
+					}
+				},
+				"body": {
+					"type": "object",
+					"additionalProperties": false,
+					"description": "Body for inviting a member to an organization. The invitee does not need to be a registered user; an invite is created either way and an email is dispatched.",
+					"required": [
+						"email",
+						"role"
+					],
+					"properties": {
+						"email": {
+							"type": "string",
+							"format": "email",
+							"description": "Email to invite. Need not match an existing `User`.",
+							"minLength": 3,
+							"maxLength": 320
+						},
+						"role": {
+							"type": "string",
+							"description": "Role a user holds in an organization. `OWNER` can invite, promote, demote, and remove members, and delete the org. `MEMBER` has read/write access to resources owned by the org but cannot manage membership. `PERSONAL` orgs have exactly one `OWNER` and reject all member-mutating operations.",
+							"enum": [
+								"OWNER",
+								"MEMBER"
+							]
+						}
+					}
+				}
+			},
+			"required": [
+				"params",
+				"query",
+				"body"
+			],
+			"additionalProperties": false
+		}),
+	},
+	"AdminOrgs": {
+		description: "All workspaces (admin-only)\n\nAdmin only. Lists all organizations. Search matches workspace name or any member's email address.",
+		inputSchema: toZod({
+			"type": "object",
+			"properties": {
+				"params": {
+					"type": "object",
+					"properties": {
+
+					}
+				},
+				"query": {
+					"type": "object",
+					"properties": {
+						"q": {
+							"type": "string",
+							"maxLength": 200
+						}
+					}
+				},
+				"body": {
+					"type": "object"
+				}
+			},
+			"required": [
+				"params",
+				"query"
+			],
+			"additionalProperties": false
+		}),
+	},
+	"AdminProviders": {
+		description: "All verifications (admin-only)\n\nAdmin only. Lists all verifications across all organizations. Supports filtering by visibility, status, and free-text search on title/domain/slug.",
+		inputSchema: toZod({
+			"type": "object",
+			"properties": {
+				"params": {
+					"type": "object",
+					"properties": {
+
+					}
+				},
+				"query": {
+					"type": "object",
+					"properties": {
+						"q": {
+							"type": "string",
+							"maxLength": 200
+						},
+						"visibility": {
+							"type": "string",
+							"description": "The visibility of the entity.\n\n- `PRIVATE`: Only the owner can see the entity.\n\n- `PUBLIC`: Anyone can see the entity.",
+							"enum": [
+								"PRIVATE",
+								"PUBLIC"
+							]
+						},
+						"status": {
+							"type": "string",
+							"description": "The status of the entity.\n\n- `ACTIVE`: The entity is active.\n\n- `ARCHIVED`: The entity is archived.",
+							"enum": [
+								"ACTIVE",
+								"ARCHIVED"
+							]
+						}
+					}
+				},
+				"body": {
+					"type": "object"
+				}
+			},
+			"required": [
+				"params",
+				"query"
+			],
+			"additionalProperties": false
+		}),
+	},
+	"AdminReviews": {
+		description: "Pending review queue (admin-only)\n\nAdmin only. Lists all provider versions currently awaiting review (branch = 'in_review'). Use DecideProviderVersionReview to approve or reject each version.",
+		inputSchema: toZod({
+			"type": "object",
+			"properties": {
+				"params": {
+					"type": "object",
+					"properties": {
+
+					}
+				},
+				"query": {
+					"type": "object",
+					"properties": {
+
+					}
+				},
+				"body": {
+					"type": "object"
+				}
+			},
+			"required": [
+				"params",
+				"query"
+			],
+			"additionalProperties": false
+		}),
+	},
+	"CancelPublicListingRequest": {
+		description: "Cancel a pending public listing review request\n\nCancels a pending public listing request by moving the version from `in_review` back to `draft`. Only org members can cancel their own review requests. This allows users to withdraw a request before admin review if they change their mind.",
+		inputSchema: toZod({
+			"type": "object",
+			"properties": {
+				"params": {
+					"type": "object",
+					"properties": {
+						"providerId": {
+							"type": "string",
+							"format": "uuid"
+						},
+						"version": {
+							"type": "string",
+							"pattern": "^[0-9]+\\.[0-9]+\\.[0-9]+(?:-[a-zA-Z0-9_-]+(?:\\.[0-9]+)?)?$",
+							"maxLength": 32
+						}
+					},
+					"required": [
+						"providerId",
+						"version"
+					],
+					"additionalProperties": false
+				},
+				"query": {
+					"type": "object",
+					"properties": {
+
+					}
+				},
+				"body": {
+					"type": "object",
+					"additionalProperties": false,
+					"description": "Body for visibility change requests (request public listing or make private).",
+					"properties": {
+						"notes": {
+							"type": "string",
+							"description": "Optional note explaining the change.",
+							"maxLength": 10000
+						}
+					}
+				}
+			},
+			"required": [
+				"params",
+				"query",
+				"body"
+			],
+			"additionalProperties": false
+		}),
+	},
+	"CreateAttachSession": {
+		description: "Open a device-pairing session to authorize a device\n\nOpens a short-lived (15-minute) device-pairing session. The CLI / MCP needs a bearer token to make authenticated API calls: the human opens `attachUrl`, signs in, and taps \"Authorize this device\". On confirmation the CLI receives a 2-day auth token via `GetAttachSession` polling. Linking a credential to an org is a separate step (`POST /credentials`) and is not part of pairing.",
+		inputSchema: toZod({
+			"type": "object",
+			"properties": {
+				"params": {
+					"type": "object",
+					"properties": {
+
+					}
+				},
+				"query": {
+					"type": "object",
+					"properties": {
+
+					}
+				},
+				"body": {
+					"type": "object"
+				}
+			},
+			"required": [
+				"params",
+				"query"
+			],
+			"additionalProperties": false
+		}),
+	},
+	"CreateOrg": {
+		description: "Create an organization\n\nCreates a new `ORG`-kind organization with the caller as its first `OWNER`. The personal org is created automatically at user signup and is not created via this endpoint.",
+		inputSchema: toZod({
+			"type": "object",
+			"properties": {
+				"params": {
+					"type": "object",
+					"properties": {
+
+					}
+				},
+				"query": {
+					"type": "object",
+					"properties": {
+
+					}
+				},
+				"body": {
+					"type": "object",
+					"additionalProperties": false,
+					"required": [
+						"name"
+					],
+					"properties": {
+						"name": {
+							"type": "string",
+							"minLength": 1,
+							"maxLength": 200
+						}
+					}
+				}
+			},
+			"required": [
+				"params",
+				"query",
+				"body"
+			],
+			"additionalProperties": false
+		}),
+	},
+	"CreateProvider": {
+		description: "Create a verification\n\nCreate a new Reclaim verification. Use this only after `providers` returned nothing useful for the domain. The caller must be an active member of the target organization.\nCreates a new verification in the specified organization. `visibility` is coerced to `PRIVATE` at creation regardless of what's sent; the author may toggle to `PUBLIC` later via `PATCH /providers/{id}`. While `PRIVATE`, versions go to the go live freely; once `PUBLIC`, non-admin versions need admin review. See `Provider.visibility`.\nThe server also seeds an initial `0.1.0` version on the `draft` branch in the same transaction so the verification is immediately editable. Its `initialUrl` defaults to `https://<domain>`; all other version fields fall back to their schema-declared defaults (structured verification, empty requests, empty web settings). `Provider.latestVersion` stays `null` until the draft is promoted to the live channel.",
+		inputSchema: toZod({
+			"type": "object",
+			"properties": {
+				"params": {
+					"type": "object",
+					"properties": {
+
+					}
+				},
+				"query": {
+					"type": "object",
+					"properties": {
+
+					}
+				},
+				"body": {
+					"type": "object",
+					"additionalProperties": false,
+					"description": "`title` is optional — when omitted the dashboard renders `seoSuggestions.title` (server-derived from the scrape result or `derive_brand_name(domain)`).",
+					"required": [
+						"orgId",
+						"domain",
+						"slug"
+					],
+					"properties": {
+						"orgId": {
+							"type": "string",
+							"format": "uuid"
+						},
+						"domain": {
+							"description": "Canonical root domain (e.g. `github.com`). No scheme, no port, no path.",
+							"type": "string",
+							"format": "hostname",
+							"minLength": 1,
+							"maxLength": 200
+						},
+						"slug": {
+							"description": "URL-safe identifier. Globally unique — pick something domain-specific like `github-followers`.",
+							"type": "string",
+							"pattern": "^[a-z0-9]+(?:-[a-z0-9]+)*$",
+							"minLength": 1,
+							"maxLength": 100
+						},
+						"title": {
+							"description": "Short headline shown to end-users. Defaults to a domain-derived brand name.",
+							"type": "string",
+							"minLength": 1,
+							"maxLength": 100
+						},
+						"description": {
+							"type": "string",
+							"minLength": 1,
+							"maxLength": 2000
+						},
+						"iconUrl": {
+							"description": "uri of the icon. Optional. If omitted, the server auto-populates from the first version's `initialUrl` (see `Provider.iconUrl`).",
+							"type": "string",
+							"format": "uri",
+							"maxLength": 2000
+						},
+						"visibility": {
+							"type": "string",
+							"description": "The visibility of the entity.\n\n- `PRIVATE`: Only the owner can see the entity.\n\n- `PUBLIC`: Anyone can see the entity.",
+							"enum": [
+								"PRIVATE",
+								"PUBLIC"
+							]
+						},
+						"tags": {
+							"type": "array",
+							"maxItems": 50,
+							"uniqueItems": true,
+							"default": [
+
+							],
+							"items": {
+								"type": "string",
+								"description": "A free-form label attached to an entity for grouping and filtering in listings. Must start and end with an alphanumeric character; only ASCII letters, digits, spaces, and hyphens are allowed between.",
+								"pattern": "^[A-Za-z0-9]([A-Za-z0-9 \\-]*[A-Za-z0-9])?$",
+								"minLength": 1,
+								"maxLength": 50
+							}
+						},
+						"seo": {
+							"type": "object",
+							"additionalProperties": false,
+							"description": "Author-set SEO fields. All optional.\n\nEach field is paired with a server-derived default of the\nsame name on `Provider.seoSuggestions`. Renderers pick the\neffective value per field:\n\n    effective.<field> = seo.<field> ?? seoSuggestions.<field>\n\nSet a field here to override; leave it unset to let the\ndefault win. Both objects are returned on every\n`GET /providers/{id}` — the builder does not pre-merge.\n",
+							"properties": {
+								"brandUrl": {
+									"type": "string",
+									"format": "uri",
+									"description": "Canonical homepage of the brand (e.g. `https://google.com`). Used in brand-link cards and JSON-LD.",
+									"maxLength": 2000
+								},
+								"primaryDataPoint": {
+									"type": "string",
+									"description": "Headline data point — the single most-important variable this provider can verify (e.g. `subscriber count`). Used in the provider's SEO title.",
+									"maxLength": 200
+								},
+								"dataPoints": {
+									"type": "array",
+									"description": "Full list of data points this provider can verify.",
+									"maxItems": 50,
+									"items": {
+										"type": "string",
+										"maxLength": 200
+									}
+								},
+								"titleOverride": {
+									"type": "string",
+									"description": "Replaces the renderer's composed `<title>` / OG title. Use when the default composition reads awkwardly.",
+									"maxLength": 200
+								},
+								"descriptionOverride": {
+									"type": "string",
+									"description": "Replaces the renderer's composed `<meta name=\"description\">` / OG description.",
+									"maxLength": 320
+								}
+							}
+						}
+					}
+				}
+			},
+			"required": [
+				"params",
+				"query",
+				"body"
+			],
+			"additionalProperties": false
+		}),
+	},
+	"CreateProviderVersion": {
+		description: "Create a new verification version\n\nCreates a new version of the verification. The starting branch\ndepends on the verification's `visibility` and the caller's role:\n\n- `PRIVATE` verification (any caller): the live channel (no review).\n\n- `PUBLIC` verification, admin caller (Reclaim staff): the live channel\n  (no review).\n\n- `PUBLIC` verification, non-admin caller: `draft` (or `ai` if\n  authored by the AI assistant). Must pass review (see\n  `POST /providers/{id}/versions/{version}/review`) before\n  reaching the live channel.\n",
+		inputSchema: toZod({
+			"type": "object",
+			"properties": {
+				"params": {
+					"type": "object",
+					"properties": {
+						"providerId": {
+							"type": "string",
+							"format": "uuid"
+						}
+					},
+					"required": [
+						"providerId"
+					],
+					"additionalProperties": false
+				},
+				"query": {
+					"type": "object",
+					"properties": {
+
+					}
+				},
+				"body": {
+					"type": "object",
+					"additionalProperties": false,
+					"description": "Body for creating a new version of a provider. Every new version starts on the `draft` branch — see `CreateProviderVersion`. The request body never sets `branch` directly; going live is a separate, explicit step (publish for PRIVATE, submit-for-review → approve for PUBLIC). The version's `verificationType` is always `structured` and is not settable here; a `prompt` field is reserved for a future AI authoring flow and is also not accepted on this surface.",
+					"required": [
+						"initialUrl",
+						"requests",
+						"allowedJsRequests",
+						"webSettings"
+					],
+					"properties": {
+						"version": {
+							"type": "object",
+							"additionalProperties": false,
+							"required": [
+								"major",
+								"minor",
+								"patch"
+							],
+							"properties": {
+								"major": {
+									"type": "integer",
+									"minimum": 0
+								},
+								"minor": {
+									"type": "integer",
+									"minimum": 0
+								},
+								"patch": {
+									"type": "integer",
+									"minimum": 0
+								},
+								"branch": {
+									"type": "string",
+									"description": "Branch (lifecycle stage) of this provider version.\n\n- `ai`: changes authored by the AI assistant live on this branch.\n\n- `draft`: a human is actively editing the version.\n\n- `in_review`: the author has submitted the version to be made\n  public and it is awaiting review. On approval the branch tag\n  is cleared (the version is promoted to the live channel and becomes\n  public).\n\n- `rejected`: review concluded with a rejection. When the author\n  addresses the feedback the branch transitions back to\n  `in_review`.",
+									"enum": [
+										"ai",
+										"draft",
+										"in_review",
+										"rejected"
+									]
+								},
+								"buildNumber": {
+									"type": "integer",
+									"description": "Build number for the provider version",
+									"minimum": 0
+								}
+							}
+						},
+						"initialUrl": {
+							"type": "string",
+							"format": "uri",
+							"maxLength": 300
+						},
+						"requests": {
+							"type": "array",
+							"minItems": 0,
+							"default": [
+
+							],
+							"items": {
+								"type": "object",
+								"additionalProperties": false,
+								"description": "A matcher for one HTTP request in observed traffic, together with the response constraints that must hold for a Reclaim proof over that request to be valid. Used by interceptors, in-page injections, and LLM agents.",
+								"required": [
+									"url",
+									"method"
+								],
+								"properties": {
+									"url": {
+										"type": "string",
+										"description": "The URL or generic path of the HTTP request."
+									},
+									"method": {
+										"type": "string",
+										"description": "The HTTP method used for the request.",
+										"enum": [
+											"GET",
+											"POST",
+											"PUT",
+											"PATCH",
+											"DELETE"
+										]
+									},
+									"requestBodyTemplate": {
+										"type": "string",
+										"description": "Template used to match or capture an outgoing request body. Template can use regex templates as placeholders. For example, to match an outgoing request body that contains a request ID, you can use the following template: `(?<requestId>.*)`.",
+										"maxLength": 100000
+									},
+									"credentials": {
+										"type": "string",
+										"description": "Mirrors the Fetch API `RequestCredentials` value used when issuing the request — controls whether cookies and auth headers are sent.",
+										"enum": [
+											"omit",
+											"same-origin",
+											"include"
+										]
+									},
+									"writeRedactionMode": {
+										"type": "string",
+										"description": "How the matched portion of the response should be redacted before the transcript is handed to the attestor.\n- `zk`: redact using a zero-knowledge proof over the original\n  bytes.\n\n- `key-update`: redact by performing a TLS key update so the\n  attestor never observes the matched bytes in cleartext.",
+										"enum": [
+											"zk",
+											"key-update"
+										]
+									},
+									"additionalClientOptions": {
+										"type": "object",
+										"additionalProperties": false,
+										"description": "Apply TLS configuration when creating the tunnel to the attestor.",
+										"properties": {
+											"supportedProtocolVersions": {
+												"type": "array",
+												"description": "TLS protocol versions the client is allowed to negotiate.",
+												"minItems": 1,
+												"uniqueItems": true,
+												"items": {
+													"type": "string",
+													"enum": [
+														"TLS1_2",
+														"TLS1_3"
+													]
+												}
+											}
+										}
+									},
+									"matches": {
+										"type": "array",
+										"description": "A list of match conditions for the response.",
+										"minItems": 1,
+										"items": {
+											"type": "object",
+											"additionalProperties": false,
+											"description": "Specifies a rule to match against a string in response to validate proof content.",
+											"required": [
+												"type",
+												"value"
+											],
+											"properties": {
+												"isOptional": {
+													"type": "boolean",
+													"description": "If true, the match condition is optional and won't fail if absent",
+													"default": false
+												},
+												"description": {
+													"type": "string",
+													"description": "The description of the field that is extracted using this match rule",
+													"minLength": 1,
+													"maxLength": 1000
+												},
+												"order": {
+													"type": "integer",
+													"description": "The order in which the field should be displayed to user in UI",
+													"minimum": 0
+												},
+												"type": {
+													"type": "string",
+													"description": "The matching mechanism to use value as against response. Typically regex or simple string containment",
+													"enum": [
+														"regex",
+														"contains"
+													]
+												},
+												"value": {
+													"type": "string",
+													"description": "The pattern or value to look for in the response. When `type` is 'contains', supports template variable declaration using `{{variable}}` syntax. When `type` is 'regex', can be used to extract variables using regex named groups."
+												},
+												"extract": {
+													"type": "object",
+													"description": "Which portions to select from a response. These are selected in order, xpath => jsonPath => regex * These redactions are done client side and only the selected portions are sent to the attestor. The attestor will only be able to see the selected portions alongside the first line of the HTTP response (i.e. \"HTTP/1.1 200 OK\")",
+													"properties": {
+														"xPath": {
+															"type": "string",
+															"description": "expect an HTML response, and to contain a certain xpath for eg. \"/html/body/div.a1/div.a2/span.a5\""
+														},
+														"jsonPath": {
+															"type": "string",
+															"description": "expect a JSON response, retrieve the item at this path using dot notation for e.g. 'email.addresses.0'"
+														},
+														"regex": {
+															"type": "string",
+															"description": "select a regex match from the response"
+														},
+														"hash": {
+															"type": "string",
+															"description": "If provided, the value inside will be hashed instead of being redacted. Useful for cases where the data inside is an identifiying piece of information that you don't want to reveal to the attestor, eg. an email address.\nIf the hash function produces more bytes than the original value, the hash will be truncated.\nEg. if hash is enabled, the original value is \"hello\", and hashed is \"a1b2c\", then the attestor will only see \"a1b2c\".\nNote: if a regex with named groups is provided, only the named groups will be hashed.",
+															"enum": [
+																"oprf",
+																"oprf-mpc",
+																"oprf-raw"
+															]
+														}
+													}
+												}
+											}
+										}
+									}
+								}
+							}
+						},
+						"allowedJsRequests": {
+							"type": "array",
+							"minItems": 0,
+							"default": [
+
+							],
+							"items": {
+								"type": "object",
+								"additionalProperties": false,
+								"description": "A template for selecting request",
+								"allOf": [
+									{
+										"$ref": "#/components/schemas/RequestSelection"
+									},
+									{
+										"type": "object",
+										"required": [
+											"multiple",
+											"required"
+										],
+										"properties": {
+											"multiple": {
+												"type": "boolean",
+												"description": "If true, the template is allowed for multiple requests. Useful for requests like paginated API calls.",
+												"default": true
+											},
+											"required": {
+												"type": "boolean",
+												"description": "If true, a request is required to match with this template. If not requests matches this template in proof, then validation fails.",
+												"default": true
+											}
+										}
+									}
+								]
+							}
+						},
+						"webSettings": {
+							"type": "object",
+							"additionalProperties": false,
+							"description": "Settings used by the web-based verification client.",
+							"properties": {
+								"geoLocation": {
+									"type": "string",
+									"description": "Geographic location (e.g. ISO country code or {{DYNAMIC_GEO}} to use user's geo location) the verification should appear to originate from.",
+									"maxLength": 15
+								},
+								"clientOptions": {
+									"type": "object",
+									"additionalProperties": false,
+									"description": "Options that influence how the web verification client behaves.",
+									"properties": {
+										"portal": {
+											"type": "object",
+											"additionalProperties": false,
+											"description": "Options that influence how the portal verification client behaves.",
+											"properties": {
+												"useProxy": {
+													"type": "boolean",
+													"description": "When true, network traffic from the portal client and attestation is routed through a proxy.",
+													"default": false
+												},
+												"userAgent": {
+													"type": "string",
+													"description": "User-agent string used for platform verification.",
+													"maxLength": 500
+												}
+											}
+										},
+										"inapp": {
+											"type": "object",
+											"additionalProperties": false,
+											"description": "Options that influence how the in-app verification client behaves.",
+											"properties": {
+												"interceptorOptions": {
+													"type": "object",
+													"additionalProperties": false,
+													"required": [
+														"interceptorType"
+													],
+													"properties": {
+														"interceptorType": {
+															"type": "string",
+															"description": "How traffic interception is implemented.",
+															"enum": [
+																"HAWKEYE",
+																"MSWJS",
+																"CDP"
+															]
+														},
+														"isDocumentRequestReplayEnabled": {
+															"type": "boolean",
+															"description": "Whether the main document request is replayed via the attestor",
+															"default": false
+														},
+														"interceptorSettings": {
+															"type": "string",
+															"description": "Free-form configuration passed through to the interceptor implementation selected by `interceptorType`. Keys and value shapes are defined by the chosen interceptor.",
+															"contentMediaType": "application/json"
+														}
+													}
+												},
+												"userAgents": {
+													"type": "object",
+													"additionalProperties": false,
+													"description": "User-agent strings keyed by platform.",
+													"properties": {
+														"android": {
+															"type": "string",
+															"description": "User-agent string used for platform verification.",
+															"maxLength": 500
+														},
+														"ios": {
+															"type": "string",
+															"description": "User-agent string used for platform verification.",
+															"maxLength": 500
+														}
+													}
+												}
+											}
+										}
+									}
+								},
+								"jsUserScripts": {
+									"type": "string",
+									"description": "JavaScript snippets injected into the page which runs before every page load. `window.Reclaim.` APIs are available to these scripts to request actions to the client like claim creation.",
+									"maxLength": 1000000
+								}
+							}
+						},
+						"requiredParameters": {
+							"type": "object",
+							"description": "Map of parameter names needed (optional or required) to use this provider to their human-readable descriptions/labels. Values are plain strings shown alongside the field in dashboards and prompts.",
+							"maxProperties": 50,
+							"additionalProperties": {
+								"type": "string",
+								"maxLength": 500
+							}
+						},
+						"notes": {
+							"type": "string",
+							"description": "Free-form change note recorded on `createMetadata`.",
+							"maxLength": 10000
+						}
+					}
+				}
+			},
+			"required": [
+				"params",
+				"query",
+				"body"
+			],
+			"additionalProperties": false
+		}),
+	},
+	"DecideProviderVersionReview": {
+		description: "Record a decision on a verification version review\n\nAdmin only (Reclaim staff). Approves or rejects a verification version currently on the `in_review` branch. `APPROVED` clears the branch tag and promotes the version to the live channel; `REJECTED` moves it to the `rejected` branch where the author can address feedback and resubmit. A rejected version stays rejected — the author either fixes and resubmits, or abandons it.\nUntil RBAC is designed, \"admin\" is detected via the user's email domain (`@reclaimprotocol.org`). Non-admin callers receive a 403.",
+		inputSchema: toZod({
+			"type": "object",
+			"properties": {
+				"params": {
+					"type": "object",
+					"properties": {
+						"providerId": {
+							"type": "string",
+							"format": "uuid"
+						},
+						"version": {
+							"type": "string",
+							"pattern": "^[0-9]+\\.[0-9]+\\.[0-9]+(?:-[a-zA-Z0-9_-]+(?:\\.[0-9]+)?)?$",
+							"maxLength": 32
+						}
+					},
+					"required": [
+						"providerId",
+						"version"
+					],
+					"additionalProperties": false
+				},
+				"query": {
+					"type": "object",
+					"properties": {
+
+					}
+				},
+				"body": {
+					"type": "object",
+					"additionalProperties": false,
+					"description": "Body for recording a decision on a provider version in `in_review`. On `APPROVED` the branch tag is cleared and the version is promoted to the live channel (becomes public). On `REJECTED` the branch becomes `rejected`.",
+					"required": [
+						"decision"
+					],
+					"properties": {
+						"decision": {
+							"type": "string",
+							"enum": [
+								"APPROVED",
+								"REJECTED"
+							]
+						},
+						"notes": {
+							"type": "string",
+							"description": "Free-form rationale shown to the author.",
+							"maxLength": 10000
+						}
+					}
+				}
+			},
+			"required": [
+				"params",
+				"query",
+				"body"
+			],
+			"additionalProperties": false
+		}),
+	},
+	"DeleteProvider": {
+		description: "Delete a verification\n\nOwner of the verification's organization only. Soft-archives the verification (sets `status` to `ARCHIVED`) so historical references remain resolvable. Supports optimistic concurrency via `If-Match`.",
+		inputSchema: toZod({
+			"type": "object",
+			"properties": {
+				"params": {
+					"type": "object",
+					"properties": {
+						"providerId": {
+							"type": "string",
+							"format": "uuid"
+						}
+					},
+					"required": [
+						"providerId"
+					],
+					"additionalProperties": false
+				},
+				"query": {
+					"type": "object",
+					"properties": {
+
+					}
+				},
+				"headers": {
+					"type": "object",
+					"properties": {
+						"If-Match": {
+							"type": "string",
+							"maxLength": 128,
+							"description": "Opaque `ETag` from a prior GET on the same resource. When\nsupplied, the server applies optimistic concurrency: the\nmutation fails with `412 Precondition Failed` if the\nresource has been modified since. Omit for last-write-wins.\n"
+						}
+					}
+				},
+				"body": {
+					"type": "object"
+				}
+			},
+			"required": [
+				"params",
+				"query"
+			],
+			"additionalProperties": false
+		}),
+	},
+	"DeleteProviderVersion": {
+		description: "Delete a verification version\n\nSoft-archives a version on the `draft`, `ai`, or `rejected` branch — sets `status` to `ARCHIVED` so history is preserved. Trunk (live) and `in_review` versions cannot be archived this way; archive the parent verification instead. Supports optimistic concurrency via `If-Match`.",
+		inputSchema: toZod({
+			"type": "object",
+			"properties": {
+				"params": {
+					"type": "object",
+					"properties": {
+						"providerId": {
+							"type": "string",
+							"format": "uuid"
+						},
+						"version": {
+							"type": "string",
+							"pattern": "^[0-9]+\\.[0-9]+\\.[0-9]+(?:-[a-zA-Z0-9_-]+(?:\\.[0-9]+)?)?$",
+							"maxLength": 32
+						}
+					},
+					"required": [
+						"providerId",
+						"version"
+					],
+					"additionalProperties": false
+				},
+				"query": {
+					"type": "object",
+					"properties": {
+
+					}
+				},
+				"headers": {
+					"type": "object",
+					"properties": {
+						"If-Match": {
+							"type": "string",
+							"maxLength": 128,
+							"description": "Opaque `ETag` from a prior GET on the same resource. When\nsupplied, the server applies optimistic concurrency: the\nmutation fails with `412 Precondition Failed` if the\nresource has been modified since. Omit for last-write-wins.\n"
+						}
+					}
+				},
+				"body": {
+					"type": "object"
+				}
+			},
+			"required": [
+				"params",
+				"query"
+			],
+			"additionalProperties": false
+		}),
+	},
+	"GetAttachSession": {
+		description: "Poll a pairing session\n\nAnonymous poll endpoint used by the CLI / MCP while it waits for the human to complete the dashboard step. Once `status` is `LINKED`, the response includes a `token` (2-day bearer token) the CLI / MCP can use for authenticated API calls. Expired or unknown codes return `404`.",
+		inputSchema: toZod({
+			"type": "object",
+			"properties": {
+				"params": {
+					"type": "object",
+					"properties": {
+						"code": {
+							"type": "string",
+							"description": "Five-character device-pairing code. The CLI / MCP shows this to the user, who types it into the dashboard's `/attach` page to confirm the link. Always uppercase alphanumeric; chars `O`/`0` and `I`/`1` are excluded to avoid ambiguity when copied from a terminal.",
+							"pattern": "^[A-HJ-NP-Z2-9]{5}$",
+							"minLength": 5,
+							"maxLength": 5
+						}
+					},
+					"required": [
+						"code"
+					],
+					"additionalProperties": false
+				},
+				"query": {
+					"type": "object",
+					"properties": {
+
+					}
+				},
+				"body": {
+					"type": "object"
+				}
+			},
+			"required": [
+				"params",
+				"query"
+			],
+			"additionalProperties": false
+		}),
+	},
+	"GetCredential": {
+		description: "Get a credential\n\nReturns the credential row. Visibility: anyone can fetch an anonymous (`orgId` null) credential by id; linked credentials are visible only to active members of the owning org.",
+		inputSchema: toZod({
+			"type": "object",
+			"properties": {
+				"params": {
+					"type": "object",
+					"properties": {
+						"credentialId": {
+							"type": "string",
+							"format": "uuid",
+							"description": "Stable id for a `Credential` row."
+						}
+					},
+					"required": [
+						"credentialId"
+					],
+					"additionalProperties": false
+				},
+				"query": {
+					"type": "object",
+					"properties": {
+
+					}
+				},
+				"body": {
+					"type": "object"
+				}
+			},
+			"required": [
+				"params",
+				"query"
+			],
+			"additionalProperties": false
+		}),
+	},
+	"GetCredentialByAddress": {
+		description: "Look up a credential by its lowercase ETH address\n\nCompanion to `GET /credentials/{credentialId}`. The MCP / CLI knows the credential by its address (the public handle the user actually types) rather than by its UUID id, so this shortcut returns the same `Credential` shape keyed on the address. Visibility rules mirror `GetCredential`: anonymous credentials are world-readable; linked credentials are visible only to active members of the owning org. Bumps `lastUsedAt` so the dashboard shows liveness.",
+		inputSchema: toZod({
+			"type": "object",
+			"properties": {
+				"params": {
+					"type": "object",
+					"properties": {
+						"address": {
+							"type": "string",
+							"description": "Lowercase Ethereum address (no EIP-55 mixed-case checksum). The client derives this from the public key via keccak-256 of the uncompressed pubkey minus the `0x04` prefix, taking the last 20 bytes. The server re-validates the format on insert but does not re-derive from the public key — that match is the client's responsibility.",
+							"pattern": "^0x[0-9a-f]{40}$",
+							"minLength": 42,
+							"maxLength": 42
+						}
+					},
+					"required": [
+						"address"
+					],
+					"additionalProperties": false
+				},
+				"query": {
+					"type": "object",
+					"properties": {
+
+					}
+				},
+				"body": {
+					"type": "object"
+				}
+			},
+			"required": [
+				"params",
+				"query"
+			],
+			"additionalProperties": false
+		}),
+	},
+	"GetMe": {
+		description: "Get the authenticated user",
+		inputSchema: toZod({
+			"type": "object",
+			"properties": {
+				"params": {
+					"type": "object",
+					"properties": {
+
+					}
+				},
+				"query": {
+					"type": "object",
+					"properties": {
+
+					}
+				},
+				"body": {
+					"type": "object"
+				}
+			},
+			"required": [
+				"params",
+				"query"
+			],
+			"additionalProperties": false
+		}),
+	},
+	"GetOrg": {
+		description: "Get an organization",
+		inputSchema: toZod({
+			"type": "object",
+			"properties": {
+				"params": {
+					"type": "object",
+					"properties": {
+						"orgId": {
+							"type": "string",
+							"format": "uuid"
+						}
+					},
+					"required": [
+						"orgId"
+					],
+					"additionalProperties": false
+				},
+				"query": {
+					"type": "object",
+					"properties": {
+
+					}
+				},
+				"body": {
+					"type": "object"
+				}
+			},
+			"required": [
+				"params",
+				"query"
+			],
+			"additionalProperties": false
+		}),
+	},
+	"GetOrgBilling": {
+		description: "Get the billing record for an organization\n\nOwner only. Returns `404` when no billing has been set; presence of the row is what promotes the org's credentials out of sandbox mode (see `Credential.mode`).",
+		inputSchema: toZod({
+			"type": "object",
+			"properties": {
+				"params": {
+					"type": "object",
+					"properties": {
+						"orgId": {
+							"type": "string",
+							"format": "uuid"
+						}
+					},
+					"required": [
+						"orgId"
+					],
+					"additionalProperties": false
+				},
+				"query": {
+					"type": "object",
+					"properties": {
+
+					}
+				},
+				"body": {
+					"type": "object"
+				}
+			},
+			"required": [
+				"params",
+				"query"
+			],
+			"additionalProperties": false
+		}),
+	},
+	"GetProvider": {
+		description: "Get a verification\n\nFetch a single Reclaim verification by id. Returns every field needed\nto integrate it into a flow: domain, the live version (initialUrl + requests),\nand the data points it can prove. Use `providers` first if you only\nhave a query string.\n\nReturns the verification record.\n\n**Canonical URL.** For SEO and stable sharing, the canonical\nHTML URL for a verification is `/providers/{providerId}/{slug}`\n(see `GetProviderBySlug`). HTML callers (`Accept: text/html`)\nthat hit this route — which omits the slug — receive a `301`\nredirect to the slugged URL. JSON callers\n(`Accept: application/json`) receive the body directly without\nredirect; the slug is on the response.\n",
+		inputSchema: toZod({
+			"type": "object",
+			"properties": {
+				"params": {
+					"type": "object",
+					"properties": {
+						"providerId": {
+							"type": "string",
+							"format": "uuid"
+						}
+					},
+					"required": [
+						"providerId"
+					],
+					"additionalProperties": false
+				},
+				"query": {
+					"type": "object",
+					"properties": {
+
+					}
+				},
+				"body": {
+					"type": "object"
+				}
+			},
+			"required": [
+				"params",
+				"query"
+			],
+			"additionalProperties": false
+		}),
+	},
+	"GetProviderVersion": {
+		description: "Get a specific verification version",
+		inputSchema: toZod({
+			"type": "object",
+			"properties": {
+				"params": {
+					"type": "object",
+					"properties": {
+						"providerId": {
+							"type": "string",
+							"format": "uuid"
+						},
+						"version": {
+							"type": "string",
+							"pattern": "^[0-9]+\\.[0-9]+\\.[0-9]+(?:-[a-zA-Z0-9_-]+(?:\\.[0-9]+)?)?$",
+							"maxLength": 32
+						}
+					},
+					"required": [
+						"providerId",
+						"version"
+					],
+					"additionalProperties": false
+				},
+				"query": {
+					"type": "object",
+					"properties": {
+
+					}
+				},
+				"body": {
+					"type": "object"
+				}
+			},
+			"required": [
+				"params",
+				"query"
+			],
+			"additionalProperties": false
+		}),
+	},
+	"GetUser": {
+		description: "Get a user's profile\n\nReturns a user record. Visible to: the user themselves, or any member of an organization the subject also belongs to.",
+		inputSchema: toZod({
+			"type": "object",
+			"properties": {
+				"params": {
+					"type": "object",
+					"properties": {
+						"userId": {
+							"type": "string",
+							"format": "uuid"
+						}
+					},
+					"required": [
+						"userId"
+					],
+					"additionalProperties": false
+				},
+				"query": {
+					"type": "object",
+					"properties": {
+
+					}
+				},
+				"body": {
+					"type": "object"
+				}
+			},
+			"required": [
+				"params",
+				"query"
+			],
+			"additionalProperties": false
+		}),
+	},
+	"LinkCredential": {
+		description: "Link a credential to an organization\n\nLinks an ETH credential to an organization — registering it directly, or attaching an already-known one (matched by `address`). The private key MUST NOT leave the client — only the derived address and uncompressed public key are sent. `orgId` is required and the caller must be allowed to edit it. Idempotent for the same `(address, orgId)`. (Anonymous credentials live client-side; they are only stored here once linked.)",
+		inputSchema: toZod({
+			"type": "object",
+			"properties": {
+				"params": {
+					"type": "object",
+					"properties": {
+
+					}
+				},
+				"query": {
+					"type": "object",
+					"properties": {
+
+					}
+				},
+				"body": {
+					"type": "object",
+					"additionalProperties": false,
+					"description": "Body for `POST /credentials`. Only the lowercase ETH `address` is sent — the private key MUST NOT leave the client, and the public key is not sent (the client derives the address from the key: keccak-256 of the uncompressed pubkey minus its `0x04` prefix, last 20 bytes, lowercase hex).",
+					"required": [
+						"address",
+						"orgId"
+					],
+					"properties": {
+						"address": {
+							"type": "string",
+							"description": "Lowercase Ethereum address (no EIP-55 mixed-case checksum). The client derives this from the public key via keccak-256 of the uncompressed pubkey minus the `0x04` prefix, taking the last 20 bytes. The server re-validates the format on insert but does not re-derive from the public key — that match is the client's responsibility.",
+							"pattern": "^0x[0-9a-f]{40}$",
+							"minLength": 42,
+							"maxLength": 42
+						},
+						"orgId": {
+							"type": "string",
+							"format": "uuid"
+						},
+						"label": {
+							"type": "string",
+							"description": "Optional human-readable label.",
+							"minLength": 1,
+							"maxLength": 100
+						}
+					}
+				}
+			},
+			"required": [
+				"params",
+				"query",
+				"body"
+			],
+			"additionalProperties": false
+		}),
+	},
+	"ListOrgCredentials": {
+		description: "List credentials linked to an organization\n\nReturns every credential whose `orgId` equals the path parameter. Caller must be an active member of the org.",
+		inputSchema: toZod({
+			"type": "object",
+			"properties": {
+				"params": {
+					"type": "object",
+					"properties": {
+						"orgId": {
+							"type": "string",
+							"format": "uuid"
+						}
+					},
+					"required": [
+						"orgId"
+					],
+					"additionalProperties": false
+				},
+				"query": {
+					"type": "object",
+					"properties": {
+
+					}
+				},
+				"body": {
+					"type": "object"
+				}
+			},
+			"required": [
+				"params",
+				"query"
+			],
+			"additionalProperties": false
+		}),
+	},
+	"ListOrgs": {
+		description: "List organizations the caller belongs to",
+		inputSchema: toZod({
+			"type": "object",
+			"properties": {
+				"params": {
+					"type": "object",
+					"properties": {
+
+					}
+				},
+				"query": {
+					"type": "object",
+					"properties": {
+						"cursor": {
+							"type": "string",
+							"maxLength": 500
+						}
+					}
+				},
+				"body": {
+					"type": "object"
+				}
+			},
+			"required": [
+				"params",
+				"query"
+			],
+			"additionalProperties": false
+		}),
+	},
+	"ListProviderVersions": {
+		description: "List a verification's versions\n\nLists versions visible to the caller. Non-public branches (`ai`, `draft`, `in_review`, `rejected`) are only visible to members of the verification's owning organization.",
+		inputSchema: toZod({
+			"type": "object",
+			"properties": {
+				"params": {
+					"type": "object",
+					"properties": {
+						"providerId": {
+							"type": "string",
+							"format": "uuid"
+						}
+					},
+					"required": [
+						"providerId"
+					],
+					"additionalProperties": false
+				},
+				"query": {
+					"type": "object",
+					"properties": {
+						"cursor": {
+							"type": "string",
+							"maxLength": 500
+						}
+					}
+				},
+				"body": {
+					"type": "object"
+				}
+			},
+			"required": [
+				"params",
+				"query"
+			],
+			"additionalProperties": false
+		}),
+	},
+	"MakePrivate": {
+		description: "Change a PUBLIC provider back to PRIVATE\n\nChanges a PUBLIC provider's visibility to PRIVATE. Unlike the reverse (PRIVATE → PUBLIC), this does not require review since it restricts rather than expands access. Existing live versions remain but are no longer publicly listed.",
+		inputSchema: toZod({
+			"type": "object",
+			"properties": {
+				"params": {
+					"type": "object",
+					"properties": {
+						"providerId": {
+							"type": "string",
+							"format": "uuid"
+						}
+					},
+					"required": [
+						"providerId"
+					],
+					"additionalProperties": false
+				},
+				"query": {
+					"type": "object",
+					"properties": {
+
+					}
+				},
+				"body": {
+					"type": "object",
+					"additionalProperties": false,
+					"description": "Body for visibility change requests (request public listing or make private).",
+					"properties": {
+						"notes": {
+							"type": "string",
+							"description": "Optional note explaining the change.",
+							"maxLength": 10000
+						}
+					}
+				}
+			},
+			"required": [
+				"params",
+				"query",
+				"body"
+			],
+			"additionalProperties": false
+		}),
+	},
+	"Providers": {
+		description: "Search verifications\n\nSearch published Reclaim verifications by domain or data point. A verification is the recipe an end-user follows to prove something about themselves (e.g. \"I have N followers on Twitter\"). Returns a list of matches. Call this BEFORE `create_provider` — most popular domains already have a public verification you can reuse.\nCatalog page listing all verifications. Returns a paginated list of verifications the caller can see. Public verifications are visible to everyone; private verifications are only visible to org members.",
+		inputSchema: toZod({
+			"type": "object",
+			"properties": {
+				"params": {
+					"type": "object",
+					"properties": {
+
+					}
+				},
+				"query": {
+					"type": "object",
+					"properties": {
+						"q": {
+							"type": "string",
+							"minLength": 1,
+							"maxLength": 200
+						},
+						"tag": {
+							"type": "array",
+							"maxItems": 20,
+							"items": {
+								"type": "string",
+								"description": "A free-form label attached to an entity for grouping and filtering in listings. Must start and end with an alphanumeric character; only ASCII letters, digits, spaces, and hyphens are allowed between.",
+								"pattern": "^[A-Za-z0-9]([A-Za-z0-9 \\-]*[A-Za-z0-9])?$",
+								"minLength": 1,
+								"maxLength": 50
+							}
+						},
+						"cursor": {
+							"type": "string",
+							"maxLength": 500
+						}
+					}
+				},
+				"body": {
+					"type": "object"
+				}
+			},
+			"required": [
+				"params",
+				"query"
+			],
+			"additionalProperties": false
+		}),
+	},
+	"PublishProviderVersion": {
+		description: "Publish a draft version directly (PRIVATE providers only)\n\nPublishes a verification version on the `draft` branch directly to the live channel (trunk). Only allowed for PRIVATE providers — PUBLIC providers must use the review flow (`POST .../review` → admin decision). On success the version's branch transitions from `draft` to `null` (trunk/live).",
+		inputSchema: toZod({
+			"type": "object",
+			"properties": {
+				"params": {
+					"type": "object",
+					"properties": {
+						"providerId": {
+							"type": "string",
+							"format": "uuid"
+						},
+						"version": {
+							"type": "string",
+							"pattern": "^[0-9]+\\.[0-9]+\\.[0-9]+(?:-[a-zA-Z0-9_-]+(?:\\.[0-9]+)?)?$",
+							"maxLength": 32
+						}
+					},
+					"required": [
+						"providerId",
+						"version"
+					],
+					"additionalProperties": false
+				},
+				"query": {
+					"type": "object",
+					"properties": {
+
+					}
+				},
+				"body": {
+					"type": "object",
+					"additionalProperties": false,
+					"description": "Body for publishing a draft version directly to the live channel. Only allowed for PRIVATE providers.",
+					"properties": {
+						"notes": {
+							"type": "string",
+							"description": "Optional publish note.",
+							"maxLength": 10000
+						}
+					}
+				}
+			},
+			"required": [
+				"params",
+				"query",
+				"body"
+			],
+			"additionalProperties": false
+		}),
+	},
+	"RequestPublicListing": {
+		description: "Request public listing for a PRIVATE provider\n\nSubmits a PRIVATE provider's latest trunk version for admin review. When approved, the provider's visibility becomes PUBLIC and all future versions require review before going live. Fails if the provider is already PUBLIC or has no live versions.",
+		inputSchema: toZod({
+			"type": "object",
+			"properties": {
+				"params": {
+					"type": "object",
+					"properties": {
+						"providerId": {
+							"type": "string",
+							"format": "uuid"
+						}
+					},
+					"required": [
+						"providerId"
+					],
+					"additionalProperties": false
+				},
+				"query": {
+					"type": "object",
+					"properties": {
+
+					}
+				},
+				"body": {
+					"type": "object",
+					"additionalProperties": false,
+					"description": "Body for visibility change requests (request public listing or make private).",
+					"properties": {
+						"notes": {
+							"type": "string",
+							"description": "Optional note explaining the change.",
+							"maxLength": 10000
+						}
+					}
+				}
+			},
+			"required": [
+				"params",
+				"query",
+				"body"
+			],
+			"additionalProperties": false
+		}),
+	},
+	"RevokeCredential": {
+		description: "Revoke a credential\n\nSoft-revokes the credential (sets `revokedAt`). Allowed for the creating user (anonymous credentials), an active OWNER of the owning org (linked credentials), or a Reclaim admin. Revoked credentials cannot be used for verification and cannot be re-linked.",
+		inputSchema: toZod({
+			"type": "object",
+			"properties": {
+				"params": {
+					"type": "object",
+					"properties": {
+						"credentialId": {
+							"type": "string",
+							"format": "uuid",
+							"description": "Stable id for a `Credential` row."
+						}
+					},
+					"required": [
+						"credentialId"
+					],
+					"additionalProperties": false
+				},
+				"query": {
+					"type": "object",
+					"properties": {
+
+					}
+				},
+				"body": {
+					"type": "object"
+				}
+			},
+			"required": [
+				"params",
+				"query"
+			],
+			"additionalProperties": false
+		}),
+	},
+	"SubmitProviderVersionForReview": {
+		description: "Submit a verification version for review\n\nSubmits a verification version (currently on the `draft` or `rejected` branch) for admin review. On success the version's branch transitions to `in_review`. Callable by any authenticated member of the verification's owning org. Meaningful only on `PUBLIC` verifications — on `PRIVATE` verifications new versions go to the live channel directly and never need review.",
+		inputSchema: toZod({
+			"type": "object",
+			"properties": {
+				"params": {
+					"type": "object",
+					"properties": {
+						"providerId": {
+							"type": "string",
+							"format": "uuid"
+						},
+						"version": {
+							"type": "string",
+							"pattern": "^[0-9]+\\.[0-9]+\\.[0-9]+(?:-[a-zA-Z0-9_-]+(?:\\.[0-9]+)?)?$",
+							"maxLength": 32
+						}
+					},
+					"required": [
+						"providerId",
+						"version"
+					],
+					"additionalProperties": false
+				},
+				"query": {
+					"type": "object",
+					"properties": {
+
+					}
+				},
+				"body": {
+					"type": "object",
+					"additionalProperties": false,
+					"description": "Body for submitting a provider version for review. Transitions the version's branch from `draft` (or `rejected`) to `in_review`.",
+					"properties": {
+						"notes": {
+							"type": "string",
+							"description": "Optional note from the author to reviewers (changelog, areas to focus on, etc.).",
+							"maxLength": 10000
+						}
+					}
+				}
+			},
+			"required": [
+				"params",
+				"query",
+				"body"
+			],
+			"additionalProperties": false
+		}),
+	},
+	"TransferProvider": {
+		description: "Transfer a verification to a different workspace\n\nAdmin-only. Moves the verification's `orgId` to the supplied workspace; preserves slug, versions, members. SQL function `builder.transfer_provider` enforces the admin gate and target existence atomically.",
+		inputSchema: toZod({
+			"type": "object",
+			"properties": {
+				"params": {
+					"type": "object",
+					"properties": {
+						"providerId": {
+							"type": "string",
+							"format": "uuid"
+						}
+					},
+					"required": [
+						"providerId"
+					],
+					"additionalProperties": false
+				},
+				"query": {
+					"type": "object",
+					"properties": {
+
+					}
+				},
+				"body": {
+					"type": "object",
+					"additionalProperties": false,
+					"required": [
+						"orgId"
+					],
+					"properties": {
+						"orgId": {
+							"type": "string",
+							"format": "uuid"
+						}
+					}
+				}
+			},
+			"required": [
+				"params",
+				"query",
+				"body"
+			],
+			"additionalProperties": false
+		}),
+	},
+	"UpdateMe": {
+		description: "Update the authenticated user's profile",
+		inputSchema: toZod({
+			"type": "object",
+			"properties": {
+				"params": {
+					"type": "object",
+					"properties": {
+
+					}
+				},
+				"query": {
+					"type": "object",
+					"properties": {
+
+					}
+				},
+				"body": {
+					"type": "object",
+					"additionalProperties": false,
+					"description": "Caller-editable fields on the authenticated user.",
+					"properties": {
+						"name": {
+							"type": "string",
+							"minLength": 1,
+							"maxLength": 200
+						}
+					}
+				}
+			},
+			"required": [
+				"params",
+				"query",
+				"body"
+			],
+			"additionalProperties": false
+		}),
+	},
+	"UpdateOrg": {
+		description: "Update an organization\n\nOwner only.",
+		inputSchema: toZod({
+			"type": "object",
+			"properties": {
+				"params": {
+					"type": "object",
+					"properties": {
+						"orgId": {
+							"type": "string",
+							"format": "uuid"
+						}
+					},
+					"required": [
+						"orgId"
+					],
+					"additionalProperties": false
+				},
+				"query": {
+					"type": "object",
+					"properties": {
+
+					}
+				},
+				"body": {
+					"type": "object",
+					"additionalProperties": false,
+					"properties": {
+						"name": {
+							"type": "string",
+							"minLength": 1,
+							"maxLength": 200
+						},
+						"status": {
+							"type": "string",
+							"description": "The status of the entity.\n\n- `ACTIVE`: The entity is active.\n\n- `ARCHIVED`: The entity is archived.",
+							"enum": [
+								"ACTIVE",
+								"ARCHIVED"
+							]
+						},
+						"iconUrl": {
+							"type": "string",
+							"format": "uri",
+							"description": "Replace the org avatar URL directly. Most clients upload via `PUT /orgs/{orgId}/icon` and let the server write this field.",
+							"maxLength": 2000
+						}
+					}
+				}
+			},
+			"required": [
+				"params",
+				"query",
+				"body"
+			],
+			"additionalProperties": false
+		}),
+	},
+	"UpdateOrgBilling": {
+		description: "Add or update billing details for an organization\n\nOwner only. Upserts the billing row. The first successful call flips every credential linked to this org from `SANDBOX` to `PRODUCTION` (see `Credential.mode`). Subsequent calls update the contact fields without affecting credential mode.",
+		inputSchema: toZod({
+			"type": "object",
+			"properties": {
+				"params": {
+					"type": "object",
+					"properties": {
+						"orgId": {
+							"type": "string",
+							"format": "uuid"
+						}
+					},
+					"required": [
+						"orgId"
+					],
+					"additionalProperties": false
+				},
+				"query": {
+					"type": "object",
+					"properties": {
+
+					}
+				},
+				"body": {
+					"type": "object",
+					"additionalProperties": false,
+					"description": "Body for `PUT /orgs/{orgId}/billing`.",
+					"required": [
+						"contactEmail",
+						"contactName"
+					],
+					"properties": {
+						"contactEmail": {
+							"type": "string",
+							"format": "email",
+							"minLength": 3,
+							"maxLength": 320
+						},
+						"contactName": {
+							"type": "string",
+							"minLength": 1,
+							"maxLength": 200
+						}
+					}
+				}
+			},
+			"required": [
+				"params",
+				"query",
+				"body"
+			],
+			"additionalProperties": false
+		}),
+	},
+	"UpdateProvider": {
+		description: "Update a verification\n\nUpdate a Reclaim verification's metadata. Partial PATCH — pass only fields you want to change. The caller must be an active member of the owning organization. To change the verification's recipe (initialUrl, requests, …) cut a new version via the dashboard. Use `seo` to control how the verification appears in search results and social shares; omit a subfield to keep the server default.\nCaller must be a member of the verification's owning organization. `id`, `orgId`, and `slug` are immutable. Supports optimistic concurrency via `If-Match`.",
+		inputSchema: toZod({
+			"type": "object",
+			"properties": {
+				"params": {
+					"type": "object",
+					"properties": {
+						"providerId": {
+							"type": "string",
+							"format": "uuid"
+						}
+					},
+					"required": [
+						"providerId"
+					],
+					"additionalProperties": false
+				},
+				"query": {
+					"type": "object",
+					"properties": {
+
+					}
+				},
+				"headers": {
+					"type": "object",
+					"properties": {
+						"If-Match": {
+							"type": "string",
+							"maxLength": 128,
+							"description": "Opaque `ETag` from a prior GET on the same resource. When\nsupplied, the server applies optimistic concurrency: the\nmutation fails with `412 Precondition Failed` if the\nresource has been modified since. Omit for last-write-wins.\n"
+						}
+					}
+				},
+				"body": {
+					"type": "object",
+					"additionalProperties": false,
+					"description": "Partial update of an existing provider. Immutable fields (`id`, `orgId`, `slug`) are not accepted here.",
+					"properties": {
+						"domain": {
+							"type": "string",
+							"format": "hostname",
+							"minLength": 1,
+							"maxLength": 200
+						},
+						"title": {
+							"type": "string",
+							"minLength": 1,
+							"maxLength": 100
+						},
+						"description": {
+							"type": "string",
+							"minLength": 1,
+							"maxLength": 2000
+						},
+						"iconUrl": {
+							"description": "uri of the icon",
+							"type": "string",
+							"format": "uri",
+							"maxLength": 2000
+						},
+						"visibility": {
+							"type": "string",
+							"description": "The visibility of the entity.\n\n- `PRIVATE`: Only the owner can see the entity.\n\n- `PUBLIC`: Anyone can see the entity.",
+							"enum": [
+								"PRIVATE",
+								"PUBLIC"
+							]
+						},
+						"status": {
+							"type": "string",
+							"description": "The status of the entity.\n\n- `ACTIVE`: The entity is active.\n\n- `ARCHIVED`: The entity is archived.",
+							"enum": [
+								"ACTIVE",
+								"ARCHIVED"
+							]
+						},
+						"tags": {
+							"type": "array",
+							"maxItems": 50,
+							"uniqueItems": true,
+							"items": {
+								"type": "string",
+								"description": "A free-form label attached to an entity for grouping and filtering in listings. Must start and end with an alphanumeric character; only ASCII letters, digits, spaces, and hyphens are allowed between.",
+								"pattern": "^[A-Za-z0-9]([A-Za-z0-9 \\-]*[A-Za-z0-9])?$",
+								"minLength": 1,
+								"maxLength": 50
+							}
+						},
+						"seo": {
+							"type": "object",
+							"additionalProperties": false,
+							"description": "Author-set SEO fields. All optional.\n\nEach field is paired with a server-derived default of the\nsame name on `Provider.seoSuggestions`. Renderers pick the\neffective value per field:\n\n    effective.<field> = seo.<field> ?? seoSuggestions.<field>\n\nSet a field here to override; leave it unset to let the\ndefault win. Both objects are returned on every\n`GET /providers/{id}` — the builder does not pre-merge.\n",
+							"properties": {
+								"brandUrl": {
+									"type": "string",
+									"format": "uri",
+									"description": "Canonical homepage of the brand (e.g. `https://google.com`). Used in brand-link cards and JSON-LD.",
+									"maxLength": 2000
+								},
+								"primaryDataPoint": {
+									"type": "string",
+									"description": "Headline data point — the single most-important variable this provider can verify (e.g. `subscriber count`). Used in the provider's SEO title.",
+									"maxLength": 200
+								},
+								"dataPoints": {
+									"type": "array",
+									"description": "Full list of data points this provider can verify.",
+									"maxItems": 50,
+									"items": {
+										"type": "string",
+										"maxLength": 200
+									}
+								},
+								"titleOverride": {
+									"type": "string",
+									"description": "Replaces the renderer's composed `<title>` / OG title. Use when the default composition reads awkwardly.",
+									"maxLength": 200
+								},
+								"descriptionOverride": {
+									"type": "string",
+									"description": "Replaces the renderer's composed `<meta name=\"description\">` / OG description.",
+									"maxLength": 320
+								}
+							}
+						}
+					}
+				}
+			},
+			"required": [
+				"params",
+				"query",
+				"body"
+			],
+			"additionalProperties": false
+		}),
+	},
+	"UpdateProviderVersion": {
+		description: "Update a verification version\n\nMutable only while the version is on the `draft` or `rejected` branch. Versions on `in_review` or the live channel reject all writes here. Caller must be a member of the verification's owning organization. Supports optimistic concurrency via `If-Match`.",
+		inputSchema: toZod({
+			"type": "object",
+			"properties": {
+				"params": {
+					"type": "object",
+					"properties": {
+						"providerId": {
+							"type": "string",
+							"format": "uuid"
+						},
+						"version": {
+							"type": "string",
+							"pattern": "^[0-9]+\\.[0-9]+\\.[0-9]+(?:-[a-zA-Z0-9_-]+(?:\\.[0-9]+)?)?$",
+							"maxLength": 32
+						}
+					},
+					"required": [
+						"providerId",
+						"version"
+					],
+					"additionalProperties": false
+				},
+				"query": {
+					"type": "object",
+					"properties": {
+
+					}
+				},
+				"headers": {
+					"type": "object",
+					"properties": {
+						"If-Match": {
+							"type": "string",
+							"maxLength": 128,
+							"description": "Opaque `ETag` from a prior GET on the same resource. When\nsupplied, the server applies optimistic concurrency: the\nmutation fails with `412 Precondition Failed` if the\nresource has been modified since. Omit for last-write-wins.\n"
+						}
+					}
+				},
+				"body": {
+					"type": "object",
+					"additionalProperties": false,
+					"description": "Partial update of a provider version. Mutable only while the version is on the `draft` or `rejected` branch; versions on `in_review` or the live channel reject all writes here. The semver does not change on update — `build_number` increments instead, giving callers a monotonic revision counter without touching the (major, minor, patch) PK. `verificationType` / `prompt` are not accepted; see `ProviderVersion` for why.",
+					"properties": {
+						"initialUrl": {
+							"type": "string",
+							"format": "uri",
+							"maxLength": 300
+						},
+						"requests": {
+							"type": "array",
+							"minItems": 0,
+							"items": {
+								"type": "object",
+								"additionalProperties": false,
+								"description": "A matcher for one HTTP request in observed traffic, together with the response constraints that must hold for a Reclaim proof over that request to be valid. Used by interceptors, in-page injections, and LLM agents.",
+								"required": [
+									"url",
+									"method"
+								],
+								"properties": {
+									"url": {
+										"type": "string",
+										"description": "The URL or generic path of the HTTP request."
+									},
+									"method": {
+										"type": "string",
+										"description": "The HTTP method used for the request.",
+										"enum": [
+											"GET",
+											"POST",
+											"PUT",
+											"PATCH",
+											"DELETE"
+										]
+									},
+									"requestBodyTemplate": {
+										"type": "string",
+										"description": "Template used to match or capture an outgoing request body. Template can use regex templates as placeholders. For example, to match an outgoing request body that contains a request ID, you can use the following template: `(?<requestId>.*)`.",
+										"maxLength": 100000
+									},
+									"credentials": {
+										"type": "string",
+										"description": "Mirrors the Fetch API `RequestCredentials` value used when issuing the request — controls whether cookies and auth headers are sent.",
+										"enum": [
+											"omit",
+											"same-origin",
+											"include"
+										]
+									},
+									"writeRedactionMode": {
+										"type": "string",
+										"description": "How the matched portion of the response should be redacted before the transcript is handed to the attestor.\n- `zk`: redact using a zero-knowledge proof over the original\n  bytes.\n\n- `key-update`: redact by performing a TLS key update so the\n  attestor never observes the matched bytes in cleartext.",
+										"enum": [
+											"zk",
+											"key-update"
+										]
+									},
+									"additionalClientOptions": {
+										"type": "object",
+										"additionalProperties": false,
+										"description": "Apply TLS configuration when creating the tunnel to the attestor.",
+										"properties": {
+											"supportedProtocolVersions": {
+												"type": "array",
+												"description": "TLS protocol versions the client is allowed to negotiate.",
+												"minItems": 1,
+												"uniqueItems": true,
+												"items": {
+													"type": "string",
+													"enum": [
+														"TLS1_2",
+														"TLS1_3"
+													]
+												}
+											}
+										}
+									},
+									"matches": {
+										"type": "array",
+										"description": "A list of match conditions for the response.",
+										"minItems": 1,
+										"items": {
+											"type": "object",
+											"additionalProperties": false,
+											"description": "Specifies a rule to match against a string in response to validate proof content.",
+											"required": [
+												"type",
+												"value"
+											],
+											"properties": {
+												"isOptional": {
+													"type": "boolean",
+													"description": "If true, the match condition is optional and won't fail if absent",
+													"default": false
+												},
+												"description": {
+													"type": "string",
+													"description": "The description of the field that is extracted using this match rule",
+													"minLength": 1,
+													"maxLength": 1000
+												},
+												"order": {
+													"type": "integer",
+													"description": "The order in which the field should be displayed to user in UI",
+													"minimum": 0
+												},
+												"type": {
+													"type": "string",
+													"description": "The matching mechanism to use value as against response. Typically regex or simple string containment",
+													"enum": [
+														"regex",
+														"contains"
+													]
+												},
+												"value": {
+													"type": "string",
+													"description": "The pattern or value to look for in the response. When `type` is 'contains', supports template variable declaration using `{{variable}}` syntax. When `type` is 'regex', can be used to extract variables using regex named groups."
+												},
+												"extract": {
+													"type": "object",
+													"description": "Which portions to select from a response. These are selected in order, xpath => jsonPath => regex * These redactions are done client side and only the selected portions are sent to the attestor. The attestor will only be able to see the selected portions alongside the first line of the HTTP response (i.e. \"HTTP/1.1 200 OK\")",
+													"properties": {
+														"xPath": {
+															"type": "string",
+															"description": "expect an HTML response, and to contain a certain xpath for eg. \"/html/body/div.a1/div.a2/span.a5\""
+														},
+														"jsonPath": {
+															"type": "string",
+															"description": "expect a JSON response, retrieve the item at this path using dot notation for e.g. 'email.addresses.0'"
+														},
+														"regex": {
+															"type": "string",
+															"description": "select a regex match from the response"
+														},
+														"hash": {
+															"type": "string",
+															"description": "If provided, the value inside will be hashed instead of being redacted. Useful for cases where the data inside is an identifiying piece of information that you don't want to reveal to the attestor, eg. an email address.\nIf the hash function produces more bytes than the original value, the hash will be truncated.\nEg. if hash is enabled, the original value is \"hello\", and hashed is \"a1b2c\", then the attestor will only see \"a1b2c\".\nNote: if a regex with named groups is provided, only the named groups will be hashed.",
+															"enum": [
+																"oprf",
+																"oprf-mpc",
+																"oprf-raw"
+															]
+														}
+													}
+												}
+											}
+										}
+									}
+								}
+							}
+						},
+						"allowedJsRequests": {
+							"type": "array",
+							"minItems": 0,
+							"items": {
+								"type": "object",
+								"additionalProperties": false,
+								"description": "A template for selecting request",
+								"allOf": [
+									{
+										"$ref": "#/components/schemas/RequestSelection"
+									},
+									{
+										"type": "object",
+										"required": [
+											"multiple",
+											"required"
+										],
+										"properties": {
+											"multiple": {
+												"type": "boolean",
+												"description": "If true, the template is allowed for multiple requests. Useful for requests like paginated API calls.",
+												"default": true
+											},
+											"required": {
+												"type": "boolean",
+												"description": "If true, a request is required to match with this template. If not requests matches this template in proof, then validation fails.",
+												"default": true
+											}
+										}
+									}
+								]
+							}
+						},
+						"webSettings": {
+							"type": "object",
+							"additionalProperties": false,
+							"description": "Settings used by the web-based verification client.",
+							"properties": {
+								"geoLocation": {
+									"type": "string",
+									"description": "Geographic location (e.g. ISO country code or {{DYNAMIC_GEO}} to use user's geo location) the verification should appear to originate from.",
+									"maxLength": 15
+								},
+								"clientOptions": {
+									"type": "object",
+									"additionalProperties": false,
+									"description": "Options that influence how the web verification client behaves.",
+									"properties": {
+										"portal": {
+											"type": "object",
+											"additionalProperties": false,
+											"description": "Options that influence how the portal verification client behaves.",
+											"properties": {
+												"useProxy": {
+													"type": "boolean",
+													"description": "When true, network traffic from the portal client and attestation is routed through a proxy.",
+													"default": false
+												},
+												"userAgent": {
+													"type": "string",
+													"description": "User-agent string used for platform verification.",
+													"maxLength": 500
+												}
+											}
+										},
+										"inapp": {
+											"type": "object",
+											"additionalProperties": false,
+											"description": "Options that influence how the in-app verification client behaves.",
+											"properties": {
+												"interceptorOptions": {
+													"type": "object",
+													"additionalProperties": false,
+													"required": [
+														"interceptorType"
+													],
+													"properties": {
+														"interceptorType": {
+															"type": "string",
+															"description": "How traffic interception is implemented.",
+															"enum": [
+																"HAWKEYE",
+																"MSWJS",
+																"CDP"
+															]
+														},
+														"isDocumentRequestReplayEnabled": {
+															"type": "boolean",
+															"description": "Whether the main document request is replayed via the attestor",
+															"default": false
+														},
+														"interceptorSettings": {
+															"type": "string",
+															"description": "Free-form configuration passed through to the interceptor implementation selected by `interceptorType`. Keys and value shapes are defined by the chosen interceptor.",
+															"contentMediaType": "application/json"
+														}
+													}
+												},
+												"userAgents": {
+													"type": "object",
+													"additionalProperties": false,
+													"description": "User-agent strings keyed by platform.",
+													"properties": {
+														"android": {
+															"type": "string",
+															"description": "User-agent string used for platform verification.",
+															"maxLength": 500
+														},
+														"ios": {
+															"type": "string",
+															"description": "User-agent string used for platform verification.",
+															"maxLength": 500
+														}
+													}
+												}
+											}
+										}
+									}
+								},
+								"jsUserScripts": {
+									"type": "string",
+									"description": "JavaScript snippets injected into the page which runs before every page load. `window.Reclaim.` APIs are available to these scripts to request actions to the client like claim creation.",
+									"maxLength": 1000000
+								}
+							}
+						},
+						"requiredParameters": {
+							"type": "object",
+							"description": "Map of parameter names needed (optional or required) to use this provider to their human-readable descriptions/labels. Values are plain strings shown alongside the field in dashboards and prompts.",
+							"maxProperties": 50,
+							"additionalProperties": {
+								"type": "string",
+								"maxLength": 500
+							}
+						},
+						"notes": {
+							"type": "string",
+							"description": "Free-form change note recorded on `updateMetadata`.",
+							"maxLength": 10000
+						}
+					}
+				}
+			},
+			"required": [
+				"params",
+				"query",
+				"body"
+			],
+			"additionalProperties": false
+		}),
+	},
+}
+
+export type McpToolName = keyof typeof MCP_TOOLS
+export type McpToolShape = (typeof MCP_TOOLS)[McpToolName]