@reclaimprotocol/agent 0.1.10 → 0.1.12

package/lib/provider/draft.js

@@ -1,6 +1,35 @@
-import { synthesizeMatcher } from "./matcher.js";
+import { isOprfHashable, OPRF_MAX_BYTES, synthesizeMatcher } from "./matcher.js";
 import { splitSecrets } from "./secrets.js";
-/** Request headers that must NOT survive into the provider params. Two kinds:
+/** OPRF mode for the auto-hash floor — TEE-native (attestor rejects oprf-raw,
+ *  isn't set up for gnark oprf). */
+const DEFAULT_SENSITIVE_HASH = 'oprf-mpc';
+// The deterministic ANTI-LEAK FLOOR: values whose SHAPE is unambiguously
+// sensitive PII, force-hashed no matter the field name or the model's judgment.
+// Deliberately only FIXED-FORMAT identifiers — OPRF is byte-exact, so a
+// self-mutable value (a display name re-cased) would be grindable and pointless
+// to hash; and a bare number is ambiguous (a private account id vs a PUBLIC
+// user id / follower count that's meant to be proven in the clear). Those
+// contextual calls are the model's, via an explicit per-target `hash`. This
+// floor is universal (not domain-specific) and high-precision.
+const EMAIL_VALUE = /^[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}$/;
+const SSN_VALUE = /^\d{3}-\d{2}-\d{4}$/;
+const IBAN_VALUE = /^[A-Z]{2}\d{2}[A-Z0-9]{11,30}$/;
+function isCanonicalPii(value) {
+    return EMAIL_VALUE.test(value)
+        || SSN_VALUE.test(value) || IBAN_VALUE.test(value);
+}
+/** OPRF mode to apply when the caller passed none: the anti-leak floor —
+ *  force-hash a value whose SHAPE is unambiguous PII, but ONLY when it's
+ *  OPRF-hashable AND within the 62-byte MPC-circuit cap (UTF-8). Undefined =
+ *  leave plaintext (a longer value can't be OPRF'd; contextual PII + the proven
+ *  identity are the model's/plaintext call). */
+export function defaultSensitiveHash(value) {
+    const hashable = isCanonicalPii(value)
+        && isOprfHashable(value)
+        && Buffer.byteLength(value, 'utf8') <= OPRF_MAX_BYTES;
+    return hashable ? DEFAULT_SENSITIVE_HASH : undefined;
+}
+/** Request headers that must NOT survive into the provider params. Three kinds:
  *  - Conditional headers (`if-none-match`/`if-modified-since`/…): a captured
  *    cached ETag/date makes the origin answer 304/412 when the attestor
  *    re-issues, and the attestor treats non-2xx as failure. We always want the
@@ -8,7 +37,14 @@ import { splitSecrets } from "./secrets.js";
  *  - Transfer headers the ATTESTOR sets itself (`connection: close`,
  *    `accept-encoding: identity`). Passing our own duplicates/collides with the
  *    request the attestor builds, so leave them out — the attestor already
- *    forces `identity` (uncompressed, so its byte-matching works). */
+ *    forces `identity` (uncompressed, so its byte-matching works).
+ *  - Host / framing headers the TRANSPORT owns (`host`, `content-length`,
+ *    `transfer-encoding`) and HTTP/2 pseudo-headers (`:authority`/`:method`/…,
+ *    which CDP surfaces on h2 captures). The attestor derives `Host` from the
+ *    URL and sets its own; a baked `Host` produces a DUPLICATE
+ *    (`found: h,h`) that fails the receipt check / 400s the origin. A stale
+ *    `content-length` breaks a re-serialized body. Pseudo-headers aren't valid
+ *    real headers at all. */
 const STRIP_REQUEST_HEADERS = new Set([
     'if-none-match',
     'if-modified-since',
@@ -17,14 +53,22 @@ const STRIP_REQUEST_HEADERS = new Set([
     'if-range',
     'connection',
     'accept-encoding',
+    'host',
+    'content-length',
+    'transfer-encoding',
 ]);
+/** True for an HTTP/2 pseudo-header (`:authority`, `:method`, `:path`,
+ *  `:scheme`) — never a valid request header the attestor can replay. */
+function isPseudoHeader(name) {
+    return name.startsWith(':');
+}
 /** Drop the headers the attestor manages or that would 304 at proof time
  *  (see {@link STRIP_REQUEST_HEADERS}); keep every other captured header so the
  *  attestor's replay looks like the browser's request. */
 function sanitizeRequestHeaders(headers) {
     const out = {};
     for (const [k, v] of Object.entries(headers)) {
-        if (STRIP_REQUEST_HEADERS.has(k.toLowerCase())) {
+        if (STRIP_REQUEST_HEADERS.has(k.toLowerCase()) || isPseudoHeader(k)) {
             continue;
         }
         out[k] = v;
@@ -103,7 +147,12 @@ export function draftProvider(req, targets, name, hash) {
                 + 'give them distinct names');
         }
         seenParams.add(paramName);
-        const synthesis = synthesizeMatcher(req.responseBody, req.contentType, t.value, paramName, t.hash ?? hash);
+        // Precedence: explicit per-target hash → explicit request-wide hash →
+        // the anti-leak floor (force-OPRF values whose SHAPE is unambiguous PII).
+        // The model makes the contextual calls (which named fields are sensitive)
+        // via an explicit per-target hash; this floor only guarantees the obvious.
+        const effectiveHash = t.hash ?? hash ?? defaultSensitiveHash(t.value);
+        const synthesis = synthesizeMatcher(req.responseBody, req.contentType, t.value, paramName, effectiveHash);
         if (!synthesis) {
             throw new Error(`target value "${t.value}" not found in`
                 + ` response body for request ${req.requestId}`);

package/lib/provider/matcher.d.ts

@@ -31,3 +31,7 @@ export interface MatcherSynthesis {
  * proof time. Throws when `hash` is set on a free-form value (no safe class).
  */
 export declare function synthesizeMatcher(body: string, contentType: string, target: string, paramName: string, hash?: OprfMode): MatcherSynthesis | undefined;
+/** True when `target` has a character class safe to OPRF-hash. Free-form values
+ *  (names with spaces, arbitrary unicode/punctuation) return false — the caller
+ *  must NOT default them to a hash (it would throw in synthesizeMatcher). */
+export declare function isOprfHashable(target: string): boolean;

package/lib/provider/matcher.js

@@ -548,3 +548,9 @@ function inferValueClass(target) {
     }
     return undefined;
 }
+/** True when `target` has a character class safe to OPRF-hash. Free-form values
+ *  (names with spaces, arbitrary unicode/punctuation) return false — the caller
+ *  must NOT default them to a hash (it would throw in synthesizeMatcher). */
+export function isOprfHashable(target) {
+    return inferValueClass(target) !== undefined;
+}

package/lib/provider/to-version.d.ts

@@ -25,6 +25,19 @@ export interface AllowedJsRequest extends DraftRequest {
     multiple?: boolean;
     /** Fail validation if no request matches this template. Default true. */
     required?: boolean;
+    /** Names of `${var}` placeholders in this template's `responseMatches`/
+     *  `responseRedactions` that get substituted at verify time from the
+     *  submitted proof's own witness params (e.g. an index list a
+     *  `Reclaim.requestClaim` call attached alongside its `{{var}}`
+     *  extractions). Omit (or leave empty) when the template has no such
+     *  placeholders — verification then matches it literally as-is. */
+    templateParams?: string[];
+    /** How multiple values for `templateParams` expand into request specs.
+     *  `'separate'` (default): one independent spec per value, each expected
+     *  to match its own proof. `'merge'`: all values folded into ONE spec
+     *  with one `responseMatches`/`responseRedactions` entry per value,
+     *  matching a single proof that bundles them all into one claim. */
+    templateParamsMode?: 'separate' | 'merge';
 }
 /** Optional extras for a create-version body beyond the request list. */
 export interface CreateVersionOptions {

package/package.json

@@ -1,7 +1,7 @@
 {
 	"name": "@reclaimprotocol/agent",
 	"title": "Reclaim Agent",
-	"version": "0.1.10",
+	"version": "0.1.12",
 	"description": "Reclaim Protocol's tools for agents — Reclaim Protocol lets your app verify **data points** about its users — a follower count, an account balance, an order history. This package gives your AI coding agent the tools to **find, build, test and fix the _data verification providers_** (the recipes that verify a data point) by inspecting and replaying captured requests, checking sessions, evaluate proofs, publishing updates, and much more.",
 	"type": "module",
 	"main": "./lib/index.js",
@@ -88,6 +88,7 @@
 		"@reclaimprotocol/tls": "^0.1.3",
 		"chrome-remote-interface": "^0.33.0",
 		"domhandler": "^6.0.0",
+		"ethers": "^6.17.0",
 		"parse5": "^8.0.0",
 		"parse5-htmlparser2-tree-adapter": "^8.0.0",
 		"pino": "^9.14.0",

package/src/authoring/tools.ts

@@ -205,6 +205,82 @@ export function authoringTools(
 				}))
 			},
 		),
+		defineTool<Record<string, unknown>>(
+			{
+				name: 'wait_for_login',
+				description:
+					'Wait for the user to finish logging in. Polls the browser\'s '
+					+ 'REAL cookies over CDP (httpOnly INCLUDED) until a NEW session '
+					+ 'cookie appears, ignoring analytics/bot cookies. The ONLY '
+					+ 'correct login wait — NEVER use wait_for_page for it: page JS '
+					+ 'can\'t see the httpOnly session cookie (hangs the whole '
+					+ 'timeout), yet DOES see pre-login tracking cookies (a '
+					+ 'length/substring check fires instantly, before the user '
+					+ 'types). Snapshots the baseline itself — call right after '
+					+ 'navigating to the login page. Does NOT navigate (never yanks '
+					+ 'the user off login/2FA). Returns { loggedIn, newCookies }.',
+				inputSchema: objectSchema({ timeoutMs: { type: 'number' } }),
+			},
+			async(args) => {
+				const backend = resolveBackend(args)
+				const deadline = Date.now() + (Number(args.timeoutMs) || 180_000)
+				const cookies = async() => {
+					const res = (await backend.sendCdp('Network.getCookies')) as {
+						cookies?: { name: string, httpOnly?: boolean }[]
+					}
+					return res.cookies ?? []
+				}
+
+				// Analytics / bot-protection / pre-auth infra cookies appear (and
+				// rotate) without any login — never the signal, even when new.
+				const JUNK = new RegExp('^(' + [
+					'_ga', '_gid', '_gat', '_ym', '__ddg', '__gads', '__gpi', '__eoi',
+					'__utm', '_fbp', 'fbp', 'fr', 'FCCDCF', 'pinLogger',
+					'userFirstVisit', 'cf_', '_dd_', 'bcookie', 'bscookie', 'lidc',
+				].join('|') + ')', 'i')
+				// A real session/auth cookie name. Deliberately NOT bare `token` — a
+				// challenge/CSRF token (e.g. LinkedIn `chp_token`) contains it and is
+				// set BEFORE auth completes. Any new httpOnly cookie is also a
+				// candidate (server-set session cookies are usually httpOnly).
+				const SESSION = /sess|sid|jwt|_session|auth|logged.?in|remember|li_at/i
+				// Auth/challenge URL paths — while the page is still on one, login is
+				// NOT done (a mid-flow cookie must not count). Cross-site-stable, far
+				// more so than cookie names.
+				const AUTH_URL = new RegExp([
+					'login', 'signin', 'sign-in', 'challenge', 'checkpoint', '\\buas\\b',
+					'authorize', '\\bsso\\b', 'mfa', '2fa', 'two-factor', 'otp', 'verify',
+					'password',
+				].join('|'), 'i')
+				const offAuthUrl = async() => {
+					const { value } = await evalInPage(backend, 'location.href')
+					const href = typeof value === 'string' ? value : ''
+					try {
+						const u = new URL(href)
+						return !AUTH_URL.test(u.pathname + u.search)
+					} catch{
+						return false
+					}
+				}
+
+				const initial = await cookies()
+				const baseline = new Set(initial.map((c) => c.name))
+				while(Date.now() < deadline) {
+					const current = await cookies()
+					const fresh = current
+						.filter((c) => !baseline.has(c.name) && !JUNK.test(c.name))
+					const hit = fresh.filter((c) => c.httpOnly || SESSION.test(c.name))
+					// BOTH required: a new session cookie AND the page has left the auth
+					// flow. Either alone false-positives (mid-flow token; stray nav).
+					if(hit.length && await offAuthUrl()) {
+						return { loggedIn: true, newCookies: hit.map((c) => c.name) }
+					}
+
+					await sleep(1000)
+				}
+
+				return { loggedIn: false, newCookies: [] }
+			},
+		),
 		defineTool<Record<string, unknown>>(
 			{
 				name: 'list_requests',

package/src/mcp/tools/agent/find.ts

@@ -21,7 +21,12 @@ export function findTool(resolveBackend: ResolveBackend): RegisteredTool {
 				'Search captured responses for any encoding of `value` (raw, '
 				+ 'URL/JSON/HTML-escaped, …). Returns a ranked candidate list with '
 				+ 'the matched variant, score, and a short snippet — used to locate '
-				+ 'the request that returns a target. Server-side; bodies stay here.',
+				+ 'the request that returns a target. Also finds SPLIT matches: when '
+				+ '`value` is multi-word (e.g. a full name), a response that carries '
+				+ 'every word SEPARATELY (a JSON profile API with first/last name in '
+				+ 'distinct fields) is returned with `splitMatch:true` — prove those '
+				+ 'per-field (a redaction per part) rather than as one string. '
+				+ 'Server-side; bodies stay here.',
 			inputSchema: objectSchema(
 				{ value: { type: 'string' }, limit: { type: 'number' } },
 				['value'],
@@ -29,37 +34,60 @@ export function findTool(resolveBackend: ResolveBackend): RegisteredTool {
 		},
 		async(args) => {
 			const backend = resolveBackend(args)
-			const variants = normalizeCandidates(String(args.value))
+			const value = String(args.value)
+			const variants = normalizeCandidates(value)
+			// Name-part tokens (≥3 chars) for split-field detection — a JSON API
+			// often carries a full name as separate first/last fields, so the whole
+			// string never matches even though the value IS there.
+			const tokens = value.split(/\s+/).filter((t) => t.length >= 3)
+			const snip = (body: string, idx: number, len: number) => {
+				const s = Math.max(0, idx - 40)
+
+				return body.slice(s, Math.min(body.length, idx + len + 40))
+			}
+
 			const ranked = []
 			for(const r of backend.capture.requests.values()) {
 				if(!r.responseBody) {
 					continue
 				}
 
+				const body = r.responseBody
+				// Prefer JSON responses + smaller bodies (likely API endpoints).
+				const base = (r.contentType.includes('json') ? 10 : 0)
+					+ Math.max(0, 5 - Math.log10(Math.max(r.size, 1)))
+
 				let hit: { snippet: string, variant: string } | undefined
 				for(const v of variants) {
-					const idx = r.responseBody.indexOf(v)
+					const idx = body.indexOf(v)
 					if(idx >= 0) {
-						const start = Math.max(0, idx - 40)
-						const end = Math.min(r.responseBody.length, idx + v.length + 40)
-						hit = { snippet: r.responseBody.slice(start, end), variant: v }
+						hit = { snippet: snip(body, idx, v.length), variant: v }
 						break
 					}
 				}
 
-				if(!hit) {
+				if(hit) {
+					// Whole-value match — ranked above split matches (+5).
+					ranked.push({
+						...publicRequest(r),
+						matchedVariant: hit.variant,
+						snippet: hit.snippet,
+						score: base + 5,
+					})
 					continue
 				}
 
-				// Prefer JSON responses + smaller bodies (likely API endpoints).
-				const score = (r.contentType.includes('json') ? 10 : 0)
-					+ Math.max(0, 5 - Math.log10(Math.max(r.size, 1)))
-				ranked.push({
-					...publicRequest(r),
-					matchedVariant: hit.variant,
-					snippet: hit.snippet,
-					score,
-				})
+				// Split match: every word present separately (e.g. first/last name
+				// in distinct JSON fields). Requires ≥2 tokens so it's specific.
+				if(tokens.length >= 2 && tokens.every((t) => body.includes(t))) {
+					ranked.push({
+						...publicRequest(r),
+						matchedVariant: `split:${tokens.join('+')}`,
+						splitMatch: true,
+						snippet: snip(body, body.indexOf(tokens[0]), tokens[0].length),
+						score: base,
+					})
+				}
 			}
 
 			ranked.sort((a, b) => b.score - a.score)

package/src/mcp/tools/agent/propose.ts

@@ -83,12 +83,12 @@ export function proposeTool(resolveBackend: ResolveBackend): RegisteredTool {
 			}
 
 			for(const t of targets) {
-				if((t.hash ?? defaultHash) !== undefined
-					&& t.value.length > OPRF_MAX_BYTES) {
+				const bytes = Buffer.byteLength(t.value, 'utf8')
+				if((t.hash ?? defaultHash) !== undefined && bytes > OPRF_MAX_BYTES) {
 					throw new Error(
 						`OPRF caps hashed values at ${OPRF_MAX_BYTES} bytes; got `
-						+ `${t.value.length}-byte "${t.value}". Use a tighter `
-						+ 'target or drop `hash`.',
+						+ `${bytes}-byte "${t.value}". Use a tighter target or drop `
+						+ '`hash`.',
 					)
 				}
 			}

package/src/old/client.ts

@@ -74,6 +74,22 @@ export interface MyProvidersQuery {
 	searchQuery?: string
 }
 
+/** `POST /api/applications/issue-credentials` response — a brand-new,
+ *  unassociated (sandboxed) app. `appSecret` is the raw eth private key;
+ *  it's returned once and never stored server-side in recoverable form. */
+export interface IssuedAppCredentials {
+	appId: string
+	appSecret: string
+}
+
+/** `GET /api/applications/link/nonce` response — a one-time, 5-minute-TTL
+ *  challenge the caller signs with the app's private key to prove ownership
+ *  in `linkAppToAccount`. */
+export interface LinkNonce {
+	nonce: string
+	expiresInSeconds: number
+}
+
 interface RequestOpts {
 	query?: Record<string, string | number | undefined>
 	body?: unknown
@@ -147,24 +163,6 @@ export class ReclaimOldClient {
 		)
 	}
 
-	/** Full `providerConfig` (loginUrl, customInjection, requestData, ...) for
-	 *  one version — the latest when `version` is omitted. Readable for ANY
-	 *  non-archived provider (not owner-restricted), same as the dashboard's
-	 *  edit-form prefill fetch. */
-	getProviderConfig(
-		providerId: string,
-		version?: string,
-	): Promise<unknown> {
-		return this.#request(
-			'GET',
-			`/providers/${encodeURIComponent(providerId)}/config`,
-			{
-				auth: true,
-				query: version ? { versionNumber: version } : undefined,
-			},
-		)
-	}
-
 	/** Partial update on the PROVIDER document itself — name/description/
 	 *  providerType/tags/isActive, after creation. The backend 403s if you
 	 *  don't own the provider (and aren't admin); other providerConfig-style
@@ -205,6 +203,50 @@ export class ReclaimOldClient {
 		return json
 	}
 
+	/** Mint a brand-new, unassociated (sandboxed) app — no auth required. Link
+	 *  it to an account afterwards with `getLinkNonce` + `linkAppToAccount`, or
+	 *  use it as-is within the sandbox session limit. */
+	async issueCredentials(): Promise<IssuedAppCredentials> {
+		const res = await this.#request('POST', '/applications/issue-credentials')
+		return (res as { data: IssuedAppCredentials }).data
+	}
+
+	/** One-time, 5-minute challenge for `linkAppToAccount`. Requires auth —
+	 *  the nonce is scoped to the authenticated user's uid. */
+	async getLinkNonce(): Promise<LinkNonce> {
+		const res = await this.#request('GET', '/applications/link/nonce', {
+			auth: true,
+		})
+		return (res as { data: LinkNonce }).data
+	}
+
+	/** Link an unassociated (`issueCredentials`-minted) app to the
+	 *  authenticated account. `signature` must be an EIP-191 signature, made
+	 *  with the app's private key, over the exact string
+	 *  `` `Link ${appId} to account ${userId} | nonce: ${nonce}` `` — see
+	 *  `buildLinkMessage` in the backend's `application.controller.ts`. Fails
+	 *  with `APP_ALREADY_LINKED` (400) if the app already belongs to someone. */
+	linkAppToAccount(
+		appId: string,
+		signature: string,
+		nonce: string,
+	): Promise<unknown> {
+		return this.#request('POST', '/applications/link', {
+			body: { appId, signature, nonce },
+			auth: true,
+		})
+	}
+
+	/** Public, unauthenticated app status — `isLinked`, sandbox/quota info.
+	 *  Works for any appId, owned or not. */
+	async getApplicationStatus(appId: string): Promise<unknown> {
+		const res = await this.#request(
+			'GET',
+			`/applications/status/${encodeURIComponent(appId)}`,
+		)
+		return (res as { data: unknown }).data
+	}
+
 	getMyProviders(query: MyProvidersQuery = {}): Promise<unknown> {
 		// Every one of these query params is REQUIRED by the backend
 		// validator (missing/invalid → 400), so default them all here.

package/src/old/to-register.ts

@@ -93,6 +93,8 @@ interface OldRequestData {
 export interface OldInjectedRequestData extends OldRequestData {
 	required?: boolean
 	multiple?: boolean
+	templateParams?: string[]
+	templateParamsMode?: 'separate' | 'merge'
 }
 
 /** Build the single `requestData` entry shared by register + update. Takes
@@ -200,11 +202,15 @@ function requestDataFrom(providers: ReclaimProvider[]): OldRequestData[] {
 export function injectedRequestDataFrom(
 	requests: AllowedJsRequest[],
 ): OldInjectedRequestData[] {
-	return requests.map((req) => ({
-		...requestDataFromProvider(req),
-		required: req.required ?? true,
-		multiple: req.multiple ?? true,
-	}))
+	return requests.map((req) => {
+		return {
+			...requestDataFromProvider(req),
+			required: req.required ?? true,
+			multiple: req.multiple ?? true,
+			templateParams: req.templateParams,
+			templateParamsMode: req.templateParamsMode,
+		}
+	})
 }
 
 /** Body for `POST /api/providers/register` — new provider + v1.0.0. Every

package/src/old/tools/build.ts

@@ -2,12 +2,17 @@ import type { RegisteredTool } from '../../mcp/server.ts'
 import type { ReclaimOldClient } from '../client.ts'
 import type { ReclaimSdkClient } from '../sdk-client.ts'
 import { authenticateTool } from './authenticate.ts'
+import { checkAppStatusTool } from './check-app-status.ts'
 import { getProviderInfoTool } from './get-provider-info.ts'
-import { getProviderVersionConfigTool } from './get-version-config.ts'
+import { issueAppCredentialsTool } from './issue-app-credentials.ts'
+import { getJsSdkIntegrationGuideTool } from './js-sdk-integration-guide.ts'
+import { linkAppTool } from './link-app.ts'
 import { getMeProvidersTool } from './me-providers.ts'
 import { createVersionFromCaptureTool } from './publish.ts'
+import { scaffoldDemoServerTool } from './scaffold-demo-server.ts'
 import { sessionAnalyticsLogsTool } from './session-analytics-logs.ts'
 import { updateProviderMetadataTool } from './update-provider-metadata.ts'
+import { verifySdkSetupTool } from './verify-sdk-setup.ts'
 
 /**
  * The backend-facing tools for OLD-devtools mode. Mirrors
@@ -27,9 +32,14 @@ export function buildOldBackendTools(
 		authenticateTool(client),
 		createVersionFromCaptureTool(client),
 		getMeProvidersTool(client),
-		getProviderVersionConfigTool(client),
 		getProviderInfoTool(sdkClient),
 		updateProviderMetadataTool(client),
 		sessionAnalyticsLogsTool(client),
+		issueAppCredentialsTool(client),
+		linkAppTool(client),
+		checkAppStatusTool(client),
+		getJsSdkIntegrationGuideTool(),
+		scaffoldDemoServerTool(),
+		verifySdkSetupTool(client),
 	]
 }

package/src/old/tools/check-app-status.ts

@@ -0,0 +1,33 @@
+import { defineTool, type RegisteredTool } from '../../mcp/server.ts'
+import type { ReclaimOldClient } from '../client.ts'
+
+/**
+ * Public, unauthenticated app status lookup — works for any `appId`, owned
+ * or not, linked or sandboxed. Mirrors the backend's
+ * `GET /api/applications/status/:appId`.
+ */
+export function checkAppStatusTool(client: ReclaimOldClient): RegisteredTool {
+	return defineTool<{ appId: string }>(
+		{
+			name: 'check_app_status',
+			description:
+				'Check a Reclaim app\'s link/sandbox status by appId — no ' +
+				'authentication required. Returns whether the app is linked to a ' +
+				'dashboard account (`isLinked`), and for linked apps, remaining ' +
+				'session quota. A 404 means the appId has never been used yet — ' +
+				'it is created lazily on the first ReclaimProofRequest.init() call ' +
+				'or via issue_app_credentials.',
+			inputSchema: {
+				type: 'object',
+				properties: {
+					appId: {
+						type: 'string',
+						description: 'The eth-address appId to check.',
+					},
+				},
+				required: ['appId'],
+			},
+		},
+		async({ appId }) => client.getApplicationStatus(appId),
+	)
+}

package/src/old/tools/get-provider-info.ts

@@ -18,14 +18,17 @@ async function attempt(
 }
 
 /**
- * Read provider info from the PUBLIC production SDK backend
- * (`api.reclaimprotocol.org`) — the service the verification SDK/attestor
- * itself calls at runtime, NOT the old-devtools dashboard backend
- * (`get_provider_version_config`, `devapi.reclaimprotocol.org`, requires
- * auth). Both underlying reads are unauthenticated.
+ * The single provider-read tool for old-devtools mode. Reads from the PUBLIC
+ * production SDK backend (`api.reclaimprotocol.org`) — the service the
+ * verification SDK/attestor itself calls at runtime. No auth required, works
+ * for ANY provider.
  *
- * Fetches BOTH shapes in one call, since they're complementary:
- *   - `provider`: full provider + providerConfig, `customInjection` included.
+ * Fetches BOTH shapes in one call, since they're complementary and together
+ * cover everything a caller needs before re-publishing a new version:
+ *   - `provider`: the full provider + providerConfig — `customInjection`,
+ *     `userAgent`, `allowedInjectedRequestData`, `requestData`, everything.
+ *     This is what you read before create_provider_version_from_capture so
+ *     you can pass the whole config back (that tool carries nothing forward).
  *   - `configs`: the trimmed runtime recipe the attestor actually consumes —
  *     `customInjection` deliberately omitted, `isScriptRequestingClaim`
  *     computed instead.
@@ -38,15 +41,18 @@ export function getProviderInfoTool(client: ReclaimSdkClient): RegisteredTool {
 				'Read a PUBLISHED provider from the public production SDK backend ' +
 				'(api.reclaimprotocol.org — what the verification SDK/attestor ' +
 				'itself fetches at runtime), for ANY provider, no auth required. ' +
-				'Different from get_provider_version_config, which reads the old ' +
-				'devtools DASHBOARD backend and requires auth. \n\n' +
+				'This is the provider-read tool for old-devtools mode. \n\n' +
 				'Returns two complementary reads for the given version (latest ' +
-				'when `versionNumber` is omitted): `provider` (the full provider ' +
-				'+ providerConfig, including `customInjection`) and `configs` (the ' +
-				'trimmed recipe the attestor actually consumes — `customInjection` ' +
-				'is deliberately OMITTED there, replaced by a computed ' +
-				'`isScriptRequestingClaim` flag). One endpoint failing (e.g. an ' +
-				'invalid `versionNumber`) is reported under `errors` without ' +
+				'when `versionNumber` is omitted): `provider` (the FULL provider ' +
+				'+ providerConfig — `customInjection`, `userAgent`, ' +
+				'`allowedInjectedRequestData`, `requestData`, everything) and ' +
+				'`configs` (the trimmed recipe the attestor actually consumes — ' +
+				'`customInjection` is deliberately OMITTED there, replaced by a ' +
+				'computed `isScriptRequestingClaim` flag). Read `provider` here ' +
+				'BEFORE create_provider_version_from_capture so you can pass the ' +
+				'whole existing config back — that tool always creates a new ' +
+				'version and carries nothing forward. One endpoint failing (e.g. ' +
+				'an invalid `versionNumber`) is reported under `errors` without ' +
 				'hiding a result the other endpoint did return.',
 			inputSchema: {
 				type: 'object',

package/src/old/tools/issue-app-credentials.ts

@@ -0,0 +1,42 @@
+import { defineTool, type RegisteredTool } from '../../mcp/server.ts'
+import type { ReclaimOldClient } from '../client.ts'
+
+/**
+ * Mint a brand-new eth-keypair APP (as opposed to authenticating as a
+ * dashboard user). `appId` is the eth address, `appSecret` the raw private
+ * key — this is the pair `@reclaimprotocol/js-sdk`'s `ReclaimProofRequest.init`
+ * expects. No auth required: the app starts unassociated (`creatorUid: null`)
+ * and sandboxed (`sandboxLimit: 100` sessions). Use `link_app_to_account` to
+ * attach it to your dashboard account, or `check_app_status` to inspect it.
+ */
+export function issueAppCredentialsTool(client: ReclaimOldClient): RegisteredTool {
+	return defineTool<Record<string, never>>(
+		{
+			name: 'issue_app_credentials',
+			description:
+				'Mint a new Reclaim APP (eth keypair) on the old devtools backend — ' +
+				'no authentication required. Returns `{ appId, appSecret }`: ' +
+				'`appId` is the eth address, `appSecret` the raw private key. This ' +
+				'is the appId/appSecret pair for @reclaimprotocol/js-sdk ' +
+				'(`ReclaimProofRequest.init(appId, appSecret, providerId)`). The app ' +
+				'starts UNLINKED and sandboxed (100 sessions) — call ' +
+				'link_app_to_account to attach it to your dashboard account and ' +
+				'check_app_status to check its state. Store `appSecret` like a ' +
+				'password (e.g. in a gitignored .env as RECLAIM_APP_SECRET) — it ' +
+				'is returned once and cannot be recovered from the server.',
+			inputSchema: { type: 'object', properties: {} },
+		},
+		async() => {
+			const { appId, appSecret } = await client.issueCredentials()
+			return {
+				appId,
+				appSecret,
+				note:
+					'Unlinked, sandboxed app (100 session limit). Set RECLAIM_APP_ID ' +
+					'and RECLAIM_APP_SECRET in your .env (gitignored). Run ' +
+					'link_app_to_account to attach it to your dashboard account and ' +
+					'lift the sandbox limit.',
+			}
+		},
+	)
+}