@reclaimprotocol/agent 0.1.15 → 0.1.17

package/src/mcp/api/operations.gen.ts

@@ -8,7 +8,7 @@ import { toZod } from './to-zod.ts'
 
 export const MCP_TOOLS = {
 	"AddOrgMember": {
-		description: "Invite a member to an organization\n\nOwner only. Invites a user to the organization by email. The invitee does **not** need to be a registered user — an invite is created in either case, and an email is dispatched. The new row is returned with `status: PENDING`; it flips to `ACTIVE` on first sign-in by the invited email. `PERSONAL` organizations reject this call (409). In the current milestone the email is not actually dispatched — the invite is auto-claimed when the invitee next signs in.",
+		description: "Invite a member to an organization\n\nOwner only. Invites a user to the organization by email. The invitee does **not** need to be a registered user — an invite is created in either case, and an invite email with an accept link is dispatched. The new row is returned with `status: PENDING`; it flips to `ACTIVE` only when the invitee explicitly accepts via `POST /orgs/{orgId}/invite`. `PERSONAL` organizations reject this call (409).",
 		inputSchema: toZod({
 			"type": "object",
 			"properties": {
@@ -265,34 +265,6 @@ export const MCP_TOOLS = {
 			"additionalProperties": false
 		}),
 	},
-	"CreateAttachSession": {
-		description: "Open a device-pairing session to authorize a device\n\nOpens a short-lived (15-minute) device-pairing session. The CLI / MCP needs a bearer token to make authenticated API calls: the human opens `attachUrl`, signs in, and taps \"Authorize this device\". On confirmation the CLI receives a 2-day auth token via `GetAttachSession` polling. Linking a credential to an org is a separate step (`POST /credentials`) and is not part of pairing.",
-		inputSchema: toZod({
-			"type": "object",
-			"properties": {
-				"params": {
-					"type": "object",
-					"properties": {
-
-					}
-				},
-				"query": {
-					"type": "object",
-					"properties": {
-
-					}
-				},
-				"body": {
-					"type": "object"
-				}
-			},
-			"required": [
-				"params",
-				"query"
-			],
-			"additionalProperties": false
-		}),
-	},
 	"CreateCallbackSubscription": {
 		description: "Register a callback subscription\n\nRegisters a destination for verification results on the organization\nthe presented `OrgToken` resolves to. The body is just `callbackUrl`\nand `events`. At least one subscription must exist for the org before a\nverification session can be created. Delivery is scoped by org: terminal\nresults are ECIES-encrypted to the org's eth public key when its\n`canEncryptResult` is enabled (see `PUT /orgs/{orgId}/keypair`), else\ndelivered as plaintext.\n",
 		inputSchema: toZod({
@@ -379,26 +351,15 @@ export const MCP_TOOLS = {
 				"body": {
 					"type": "object",
 					"additionalProperties": false,
-					"description": "Body for `POST /orgs`. Explicitly-created orgs must declare their Ethereum (secp256k1) encryption public key — it identifies the org and, when `canEncryptResult` is enabled, encrypts delivered results.",
+					"description": "Body for `POST /orgs` — just a name. Every org is created keyless, like auto-provisioned personal orgs; its Ethereum (secp256k1) key pair is published separately via `PUT /orgs/{orgId}/keypair`, which is also where `canEncryptResult` is set. Creation deliberately collects nothing else so it never blocks on generating and safeguarding a private key.",
 					"required": [
-						"name",
-						"publicKey"
+						"name"
 					],
 					"properties": {
 						"name": {
 							"type": "string",
 							"minLength": 1,
 							"maxLength": 200
-						},
-						"publicKey": {
-							"type": "string",
-							"description": "The org's eth public key, uncompressed hex (`0x04` + 128 hex) — the eth-native form wallets/ethers emit. The matching private key never leaves the consumer.",
-							"pattern": "^0x04[0-9a-fA-F]{128}$"
-						},
-						"canEncryptResult": {
-							"type": "boolean",
-							"description": "When true, terminal results are ECIES-encrypted to this key; when false (the default), they are delivered as plaintext.",
-							"default": false
 						}
 					}
 				}
@@ -706,8 +667,7 @@ export const MCP_TOOLS = {
 						},
 						"initialUrl": {
 							"type": "string",
-							"format": "uri",
-							"maxLength": 300
+							"format": "uri"
 						},
 						"requests": {
 							"type": "array",
@@ -869,172 +829,177 @@ export const MCP_TOOLS = {
 							"items": {
 								"type": "object",
 								"additionalProperties": false,
-								"description": "A template for selecting request",
-								"allOf": [
-									{
+								"description": "A template for selecting requests. Same matcher shape as `RequestSelection`, plus template flags (`multiple`/`required`) and optional `templateParams` expansion.",
+								"required": [
+									"url",
+									"method",
+									"multiple",
+									"required"
+								],
+								"properties": {
+									"url": {
+										"type": "string",
+										"description": "The URL or generic path of the HTTP request."
+									},
+									"method": {
+										"type": "string",
+										"description": "The HTTP method used for the request.",
+										"enum": [
+											"GET",
+											"POST",
+											"PUT",
+											"PATCH",
+											"DELETE"
+										]
+									},
+									"requestBodyTemplate": {
+										"type": "string",
+										"description": "Template used to match or capture an outgoing request body. Template can use regex templates as placeholders. For example, to match an outgoing request body that contains a request ID, you can use the following template: `(?<requestId>.*)`.",
+										"maxLength": 100000
+									},
+									"credentials": {
+										"type": "string",
+										"description": "Mirrors the Fetch API `RequestCredentials` value used when issuing the request — controls whether cookies and auth headers are sent.",
+										"enum": [
+											"omit",
+											"same-origin",
+											"include"
+										]
+									},
+									"writeRedactionMode": {
+										"type": "string",
+										"description": "How the matched portion of the response should be redacted before the transcript is handed to the attestor.\n- `zk`: redact using a zero-knowledge proof over the original\n  bytes.\n\n- `key-update`: redact by performing a TLS key update so the\n  attestor never observes the matched bytes in cleartext.",
+										"enum": [
+											"zk",
+											"key-update"
+										]
+									},
+									"additionalClientOptions": {
 										"type": "object",
 										"additionalProperties": false,
-										"description": "A matcher for one HTTP request in observed traffic, together with the response constraints that must hold for a Reclaim proof over that request to be valid. Used by interceptors, in-page injections, and LLM agents.",
-										"required": [
-											"url",
-											"method"
-										],
+										"description": "Apply TLS configuration when creating the tunnel to the attestor.",
 										"properties": {
-											"url": {
-												"type": "string",
-												"description": "The URL or generic path of the HTTP request."
-											},
-											"method": {
-												"type": "string",
-												"description": "The HTTP method used for the request.",
-												"enum": [
-													"GET",
-													"POST",
-													"PUT",
-													"PATCH",
-													"DELETE"
-												]
-											},
-											"requestBodyTemplate": {
-												"type": "string",
-												"description": "Template used to match or capture an outgoing request body. Template can use regex templates as placeholders. For example, to match an outgoing request body that contains a request ID, you can use the following template: `(?<requestId>.*)`.",
-												"maxLength": 100000
-											},
-											"credentials": {
-												"type": "string",
-												"description": "Mirrors the Fetch API `RequestCredentials` value used when issuing the request — controls whether cookies and auth headers are sent.",
-												"enum": [
-													"omit",
-													"same-origin",
-													"include"
-												]
-											},
-											"writeRedactionMode": {
-												"type": "string",
-												"description": "How the matched portion of the response should be redacted before the transcript is handed to the attestor.\n- `zk`: redact using a zero-knowledge proof over the original\n  bytes.\n\n- `key-update`: redact by performing a TLS key update so the\n  attestor never observes the matched bytes in cleartext.",
-												"enum": [
-													"zk",
-													"key-update"
-												]
-											},
-											"additionalClientOptions": {
-												"type": "object",
-												"additionalProperties": false,
-												"description": "Apply TLS configuration when creating the tunnel to the attestor.",
-												"properties": {
-													"supportedProtocolVersions": {
-														"type": "array",
-														"description": "TLS protocol versions the client is allowed to negotiate.",
-														"minItems": 1,
-														"uniqueItems": true,
-														"items": {
-															"type": "string",
-															"enum": [
-																"TLS1_2",
-																"TLS1_3"
-															]
-														}
-													}
-												}
-											},
-											"responseMatches": {
+											"supportedProtocolVersions": {
 												"type": "array",
-												"description": "Conditions the (redacted) response must satisfy for the proof to be valid. Each runs against the union of the portions revealed by `responseRedactions` (or the whole response when there are none). Mirrors attestor-core `responseMatches`.",
+												"description": "TLS protocol versions the client is allowed to negotiate.",
 												"minItems": 1,
+												"uniqueItems": true,
 												"items": {
-													"type": "object",
-													"additionalProperties": false,
-													"description": "Specifies a rule to match against a string in response to validate proof content.",
-													"required": [
-														"type",
-														"value"
-													],
-													"properties": {
-														"isOptional": {
-															"type": "boolean",
-															"description": "If true, the match condition is optional and won't fail if absent",
-															"default": false
-														},
-														"description": {
-															"type": "string",
-															"description": "The description of the field that is extracted using this match rule",
-															"minLength": 1,
-															"maxLength": 1000
-														},
-														"order": {
-															"type": "integer",
-															"description": "The order in which the field should be displayed to user in UI",
-															"minimum": 0
-														},
-														"type": {
-															"type": "string",
-															"description": "The matching mechanism to use value as against response. Typically regex or simple string containment",
-															"enum": [
-																"regex",
-																"contains"
-															]
-														},
-														"value": {
-															"type": "string",
-															"description": "The pattern or value to look for in the response. When `type` is 'contains', supports template variable declaration using `{{variable}}` syntax. When `type` is 'regex', can be used to extract variables using regex named groups."
-														}
-													}
+													"type": "string",
+													"enum": [
+														"TLS1_2",
+														"TLS1_3"
+													]
 												}
-											},
-											"responseRedactions": {
-												"type": "array",
-												"description": "Portions to select/reveal from the response, applied in order (xPath => jsonPath => regex). Done client-side; only the selected portions (plus the first response line) are sent to the attestor. An independent ordered list — NOT paired 1:1 with `responseMatches`. Mirrors attestor-core `responseRedactions`.",
-												"items": {
-													"type": "object",
-													"additionalProperties": false,
-													"description": "Which portions to select from a response. These are selected in order, xpath => jsonPath => regex * These redactions are done client side and only the selected portions are sent to the attestor. The attestor will only be able to see the selected portions alongside the first line of the HTTP response (i.e. \"HTTP/1.1 200 OK\")",
-													"properties": {
-														"xPath": {
-															"type": "string",
-															"description": "expect an HTML response, and to contain a certain xpath for eg. \"/html/body/div.a1/div.a2/span.a5\""
-														},
-														"jsonPath": {
-															"type": "string",
-															"description": "expect a JSON response, retrieve the item at this path using dot notation for e.g. 'email.addresses.0'"
-														},
-														"regex": {
-															"type": "string",
-															"description": "select a regex match from the response"
-														},
-														"hash": {
-															"type": "string",
-															"description": "If provided, the value inside will be hashed instead of being redacted. Useful for cases where the data inside is an identifiying piece of information that you don't want to reveal to the attestor, eg. an email address.\nIf the hash function produces more bytes than the original value, the hash will be truncated.\nEg. if hash is enabled, the original value is \"hello\", and hashed is \"a1b2c\", then the attestor will only see \"a1b2c\".\nNote: if a regex with named groups is provided, only the named groups will be hashed.",
-															"enum": [
-																"oprf",
-																"oprf-mpc",
-																"oprf-raw"
-															]
-														}
-													}
+											}
+										}
+									},
+									"responseMatches": {
+										"type": "array",
+										"description": "Conditions the (redacted) response must satisfy for the proof to be valid. Each runs against the union of the portions revealed by `responseRedactions` (or the whole response when there are none). Mirrors attestor-core `responseMatches`.",
+										"minItems": 1,
+										"items": {
+											"type": "object",
+											"additionalProperties": false,
+											"description": "Specifies a rule to match against a string in response to validate proof content.",
+											"required": [
+												"type",
+												"value"
+											],
+											"properties": {
+												"isOptional": {
+													"type": "boolean",
+													"description": "If true, the match condition is optional and won't fail if absent",
+													"default": false
+												},
+												"description": {
+													"type": "string",
+													"description": "The description of the field that is extracted using this match rule",
+													"minLength": 1,
+													"maxLength": 1000
+												},
+												"order": {
+													"type": "integer",
+													"description": "The order in which the field should be displayed to user in UI",
+													"minimum": 0
+												},
+												"type": {
+													"type": "string",
+													"description": "The matching mechanism to use value as against response. Typically regex or simple string containment",
+													"enum": [
+														"regex",
+														"contains"
+													]
+												},
+												"value": {
+													"type": "string",
+													"description": "The pattern or value to look for in the response. When `type` is 'contains', supports template variable declaration using `{{variable}}` syntax. When `type` is 'regex', can be used to extract variables using regex named groups."
 												}
 											}
 										}
 									},
-									{
-										"type": "object",
-										"required": [
-											"multiple",
-											"required"
-										],
-										"properties": {
-											"multiple": {
-												"type": "boolean",
-												"description": "If true, the template is allowed for multiple requests. Useful for requests like paginated API calls.",
-												"default": true
-											},
-											"required": {
-												"type": "boolean",
-												"description": "If true, a request is required to match with this template. If not requests matches this template in proof, then validation fails.",
-												"default": true
+									"responseRedactions": {
+										"type": "array",
+										"description": "Portions to select/reveal from the response, applied in order (xPath => jsonPath => regex). Done client-side; only the selected portions (plus the first response line) are sent to the attestor. An independent ordered list — NOT paired 1:1 with `responseMatches`. Mirrors attestor-core `responseRedactions`.",
+										"items": {
+											"type": "object",
+											"additionalProperties": false,
+											"description": "Which portions to select from a response. These are selected in order, xpath => jsonPath => regex * These redactions are done client side and only the selected portions are sent to the attestor. The attestor will only be able to see the selected portions alongside the first line of the HTTP response (i.e. \"HTTP/1.1 200 OK\")",
+											"properties": {
+												"xPath": {
+													"type": "string",
+													"description": "expect an HTML response, and to contain a certain xpath for eg. \"/html/body/div.a1/div.a2/span.a5\""
+												},
+												"jsonPath": {
+													"type": "string",
+													"description": "expect a JSON response, retrieve the item at this path using dot notation for e.g. 'email.addresses.0'"
+												},
+												"regex": {
+													"type": "string",
+													"description": "select a regex match from the response"
+												},
+												"hash": {
+													"type": "string",
+													"description": "If provided, the value inside will be hashed instead of being redacted. Useful for cases where the data inside is an identifiying piece of information that you don't want to reveal to the attestor, eg. an email address.\nIf the hash function produces more bytes than the original value, the hash will be truncated.\nEg. if hash is enabled, the original value is \"hello\", and hashed is \"a1b2c\", then the attestor will only see \"a1b2c\".\nNote: if a regex with named groups is provided, only the named groups will be hashed.",
+													"enum": [
+														"oprf",
+														"oprf-mpc",
+														"oprf-raw"
+													]
+												}
 											}
 										}
+									},
+									"multiple": {
+										"type": "boolean",
+										"description": "If true, the template is allowed for multiple requests. Useful for requests like paginated API calls.",
+										"default": true
+									},
+									"required": {
+										"type": "boolean",
+										"description": "If true, a request is required to match with this template. If not requests matches this template in proof, then validation fails.",
+										"default": true
+									},
+									"templateParams": {
+										"type": "array",
+										"description": "Names of `${param}` placeholders used in this template's `responseMatches` / `responseRedactions`, substituted at verification time from array-valued extracted parameters (each name must resolve to an array of values; all named arrays must have the same length). Absent or empty means the template is used as-is with no expansion.",
+										"maxItems": 50,
+										"items": {
+											"type": "string",
+											"minLength": 1,
+											"maxLength": 100
+										}
+									},
+									"templateParamsMode": {
+										"type": "string",
+										"description": "How array values of `templateParams` expand the template: `separate` (default) emits one expanded request — its own claim — per value; `merge` emits a single request whose `responseMatches`/`responseRedactions` contain all substituted entries, proven by one claim.",
+										"enum": [
+											"separate",
+											"merge"
+										],
+										"default": "separate"
 									}
-								]
+								}
 							}
 						},
 						"webSettings": {
@@ -1121,6 +1086,12 @@ export const MCP_TOOLS = {
 													}
 												}
 											}
+										},
+										"extension": {
+											"type": "object",
+											"description": "Free-form key-value configuration for the browser-extension verification client. Keys and value shapes are defined by the extension client; values may be any JSON. Absent by default.",
+											"maxProperties": 100,
+											"additionalProperties": true
 										}
 									}
 								},
@@ -1175,8 +1146,7 @@ export const MCP_TOOLS = {
 					"description": "Body for `POST /verifications/sessions`. Authenticated by the consumer's `OrgToken`. Carries no callback URLs — they come from the org's callback subscriptions. The one shared `context` is validated against every provider's `requiredContext`.",
 					"required": [
 						"providers",
-						"context",
-						"verificationClientUrl"
+						"context"
 					],
 					"properties": {
 						"providers": {
@@ -1210,8 +1180,13 @@ export const MCP_TOOLS = {
 						},
 						"verificationClientUrl": {
 							"type": "string",
-							"description": "Must contain a `{sessionId}` placeholder. Must be an http(s) URL.",
-							"maxLength": 2000
+							"description": "Optional. Must exactly equal the base URL of a registered verification client (see the `verification_clients` registry / `/admin/verification-clients`). Omit to use the default (`builder`) client. The Builder attaches the session id — into a `{sessionId}` placeholder if the registered base has one, otherwise as a `?sessionId=…` query parameter — and returns the ready-to-share result as `verificationUrl`. A URL that is not a registered client's base is rejected with 400.",
+							"maxLength": 2000,
+							"pattern": "^https?://"
+						},
+						"preferAiAgent": {
+							"type": "boolean",
+							"description": "Optional. Whether the Verification Client is preferred (allowed) to run this session's providers with an LLM/AI agent instead of the structured recipe. Omit to default per provider from its `verificationType` (`llm` → agent preferred, `structured` → not). The recipe endpoint exposes the effective per-provider value as `preferAiAgent`. A preference, not a hard gate — clients without agent support run the structured recipe regardless."
 						}
 					}
 				}
@@ -1566,10 +1541,12 @@ export const MCP_TOOLS = {
 						},
 						"mode": {
 							"type": "string",
+							"description": "How the resolver picks providers. `combine` (default) minimizes to the fewest providers (set-cover); `ai` is a forward-compat alias that currently resolves like combine.",
 							"enum": [
 								"combine",
 								"ai"
-							]
+							],
+							"default": "combine"
 						}
 					},
 					"required": [
@@ -1589,44 +1566,6 @@ export const MCP_TOOLS = {
 			"additionalProperties": false
 		}),
 	},
-	"GetAttachSession": {
-		description: "Poll a pairing session\n\nAnonymous poll endpoint used by the CLI / MCP while it waits for the human to complete the dashboard step. Once `status` is `LINKED`, the response includes a `token` (2-day bearer token) the CLI / MCP can use for authenticated API calls. Expired or unknown codes return `404`.",
-		inputSchema: toZod({
-			"type": "object",
-			"properties": {
-				"params": {
-					"type": "object",
-					"properties": {
-						"code": {
-							"type": "string",
-							"description": "Five-character device-pairing code. The CLI / MCP shows this to the user, who types it into the dashboard's `/attach` page to confirm the link. Always uppercase alphanumeric; chars `O`/`0` and `I`/`1` are excluded to avoid ambiguity when copied from a terminal.",
-							"pattern": "^[A-HJ-NP-Z2-9]{5}$",
-							"minLength": 5,
-							"maxLength": 5
-						}
-					},
-					"required": [
-						"code"
-					],
-					"additionalProperties": false
-				},
-				"query": {
-					"type": "object",
-					"properties": {
-
-					}
-				},
-				"body": {
-					"type": "object"
-				}
-			},
-			"required": [
-				"params",
-				"query"
-			],
-			"additionalProperties": false
-		}),
-	},
 	"GetMe": {
 		description: "Get the authenticated user",
 		inputSchema: toZod({
@@ -1686,6 +1625,15 @@ export const MCP_TOOLS = {
 								"sessions",
 								"billing"
 							]
+						},
+						"billing": {
+							"type": "string",
+							"enum": [
+								"success",
+								"cancelled",
+								"changed",
+								"credits"
+							]
 						}
 					}
 				},
@@ -1770,43 +1718,8 @@ export const MCP_TOOLS = {
 			"additionalProperties": false
 		}),
 	},
-	"GetOrgToken": {
-		description: "Get the organization's API token metadata\n\nReturns metadata about the organization's current API token — its last four characters, when it was created, and when it was last used — never the token itself. The caller must be an active **OWNER** of the organization. Returns `404` when no token has been issued.",
-		inputSchema: toZod({
-			"type": "object",
-			"properties": {
-				"params": {
-					"type": "object",
-					"properties": {
-						"orgId": {
-							"type": "string",
-							"format": "uuid"
-						}
-					},
-					"required": [
-						"orgId"
-					],
-					"additionalProperties": false
-				},
-				"query": {
-					"type": "object",
-					"properties": {
-
-					}
-				},
-				"body": {
-					"type": "object"
-				}
-			},
-			"required": [
-				"params",
-				"query"
-			],
-			"additionalProperties": false
-		}),
-	},
-	"GetProvider": {
-		description: "Get a provider\n\nFetch a single Reclaim provider by id. Returns every field needed\nto integrate it into a flow: domain, the live version (initialUrl + requests),\nand the data points it can prove. Use `providers` first if you only\nhave a query string.\n\nReturns the provider record.\n\n**Canonical URL.** For SEO and stable sharing, the canonical\nHTML URL for a provider is `/providers/{providerId}/{slug}`\n(see `GetProviderBySlug`). HTML callers (`Accept: text/html`)\nthat hit this route — which omits the slug — receive a `301`\nredirect to the slugged URL. JSON callers\n(`Accept: application/json`) receive the body directly without\nredirect; the slug is on the response.\n",
+	"GetProvider": {
+		description: "Get a provider\n\nFetch a single Reclaim provider by id. Returns every field needed\nto integrate it into a flow: domain, the live version (initialUrl + requests),\nand the data points it can prove. Use `providers` first if you only\nhave a query string.\n\nReturns the provider record.\n\n**Canonical URL.** For SEO and stable sharing, the canonical\nHTML URL for a provider is `/providers/{providerId}/{slug}`\n(see `GetProviderBySlug`). HTML callers (`Accept: text/html`)\nthat hit this route — which omits the slug — receive a `301`\nredirect to the slugged URL. JSON callers\n(`Accept: application/json`) receive the body directly without\nredirect; the slug is on the response.\n",
 		inputSchema: toZod({
 			"type": "object",
 			"properties": {
@@ -1882,7 +1795,7 @@ export const MCP_TOOLS = {
 		}),
 	},
 	"GetUser": {
-		description: "Get a user's profile\n\nReturns a user record. Visible to: the user themselves, or any member of an organization the subject also belongs to.",
+		description: "Get a user's profile\n\nReturns a user record. Visible to the user themselves, any member of an organization the subject also belongs to, and staff.",
 		inputSchema: toZod({
 			"type": "object",
 			"properties": {
@@ -1953,7 +1866,7 @@ export const MCP_TOOLS = {
 		}),
 	},
 	"IssueOrgToken": {
-		description: "Issue (or regenerate) the organization's API token\n\nIssues a fresh per-organization API token (`rorg_…`). The caller must be an active **OWNER** of the organization. A successful call invalidates any previously issued token for the org. The plaintext token is returned **only once** in this response (the server stores only its HMAC); treat it like a password and store it securely.",
+		description: "Issue a new organization API key\n\nIssues a fresh per-organization API key (`rorg_…`). The caller must be an active **OWNER** of the organization. An org may hold several keys; issuing a new one does **not** invalidate existing keys (revoke those explicitly). The plaintext key is returned **only once** in this response (the server stores only its HMAC); treat it like a password.",
 		inputSchema: toZod({
 			"type": "object",
 			"properties": {
@@ -2109,6 +2022,41 @@ export const MCP_TOOLS = {
 			"additionalProperties": false
 		}),
 	},
+	"ListOrgTokens": {
+		description: "List the organization's API keys\n\nLists metadata for every API key the organization holds — id, last four characters, when issued, and when last used — never the keys themselves. The caller must be an active **OWNER** of the organization.",
+		inputSchema: toZod({
+			"type": "object",
+			"properties": {
+				"params": {
+					"type": "object",
+					"properties": {
+						"orgId": {
+							"type": "string",
+							"format": "uuid"
+						}
+					},
+					"required": [
+						"orgId"
+					],
+					"additionalProperties": false
+				},
+				"query": {
+					"type": "object",
+					"properties": {
+
+					}
+				},
+				"body": {
+					"type": "object"
+				}
+			},
+			"required": [
+				"params",
+				"query"
+			],
+			"additionalProperties": false
+		}),
+	},
 	"ListOrgVerificationSessions": {
 		description: "List an organization's verification sessions\n\nReturns verification sessions created under the organization, newest first. Optionally filter by `providerId`, `status`, `resolvedVersion`, `claimantClientId`, and a `createdAfter`/`createdBefore` time range. Caller must be an active member of the org. Opaque cursor pagination.\n\nNote: `status` filters on the stored column. A session that has passed `expiresAt` but has not yet been swept is reported as `expired` in its body while still stored as `pending`, so `status=expired` may not match such sessions until the sweep runs.",
 		inputSchema: toZod({
@@ -2511,6 +2459,46 @@ export const MCP_TOOLS = {
 			"additionalProperties": false
 		}),
 	},
+	"RevokeOrgToken": {
+		description: "Revoke one of the organization's API keys\n\nRevokes a single API key by id (leaving the org's other keys intact). The caller must be an active **OWNER** of the organization. The key stops authenticating immediately.",
+		inputSchema: toZod({
+			"type": "object",
+			"properties": {
+				"params": {
+					"type": "object",
+					"properties": {
+						"orgId": {
+							"type": "string",
+							"format": "uuid"
+						},
+						"tokenId": {
+							"type": "string",
+							"format": "uuid"
+						}
+					},
+					"required": [
+						"orgId",
+						"tokenId"
+					],
+					"additionalProperties": false
+				},
+				"query": {
+					"type": "object",
+					"properties": {
+
+					}
+				},
+				"body": {
+					"type": "object"
+				}
+			},
+			"required": [
+				"params",
+				"query"
+			],
+			"additionalProperties": false
+		}),
+	},
 	"SetOrgKeypair": {
 		description: "Set (or rotate) the organization's encryption keypair\n\nUpserts the organization's single Ethereum (secp256k1) encryption keypair. The body carries the org's **eth public key** — as an uncompressed hex string (`0x04`+128 hex) or a secp256k1 public JWK (`{kty:'EC', crv:'secp256k1', x, y}`) — and `canEncryptResult`. The matching private key never leaves the consumer. Setting overwrites the single row (and creates it for a keyless org). When `canEncryptResult` is true, terminal results are delivered as an ECIES ciphertext encrypted to this key; otherwise plaintext. Authenticated by the org's `OrgToken` or a human `BearerAuth` session for an active member of the org.",
 		inputSchema: toZod({
@@ -2783,61 +2771,6 @@ export const MCP_TOOLS = {
 			"additionalProperties": false
 		}),
 	},
-	"UpdateOrgBilling": {
-		description: "Add or update billing details for an organization\n\nOwner only. Upserts the billing row. The first successful call flips every credential linked to this org from `SANDBOX` to `PRODUCTION` (see `Credential.mode`). Subsequent calls update the contact fields without affecting credential mode.",
-		inputSchema: toZod({
-			"type": "object",
-			"properties": {
-				"params": {
-					"type": "object",
-					"properties": {
-						"orgId": {
-							"type": "string",
-							"format": "uuid"
-						}
-					},
-					"required": [
-						"orgId"
-					],
-					"additionalProperties": false
-				},
-				"query": {
-					"type": "object",
-					"properties": {
-
-					}
-				},
-				"body": {
-					"type": "object",
-					"additionalProperties": false,
-					"description": "Body for `PUT /orgs/{orgId}/billing`.",
-					"required": [
-						"contactEmail",
-						"contactName"
-					],
-					"properties": {
-						"contactEmail": {
-							"type": "string",
-							"format": "email",
-							"minLength": 3,
-							"maxLength": 320
-						},
-						"contactName": {
-							"type": "string",
-							"minLength": 1,
-							"maxLength": 200
-						}
-					}
-				}
-			},
-			"required": [
-				"params",
-				"query",
-				"body"
-			],
-			"additionalProperties": false
-		}),
-	},
 	"UpdateProvider": {
 		description: "Update a provider\n\nUpdate a Reclaim provider's metadata. Partial PATCH — pass only fields you want to change. The caller must be an active member of the owning organization. To change the provider's recipe (initialUrl, requests, …) cut a new version via the dashboard. Use `seo` to control how the provider appears in search results and social shares; omit a subfield to keep the server default.\nCaller must be a member of the provider's owning organization. `id`, `orgId`, and `slug` are immutable. Supports optimistic concurrency via `If-Match`.",
 		inputSchema: toZod({
@@ -3022,8 +2955,7 @@ export const MCP_TOOLS = {
 					"properties": {
 						"initialUrl": {
 							"type": "string",
-							"format": "uri",
-							"maxLength": 300
+							"format": "uri"
 						},
 						"verificationType": {
 							"type": "string",
@@ -3193,172 +3125,177 @@ export const MCP_TOOLS = {
 							"items": {
 								"type": "object",
 								"additionalProperties": false,
-								"description": "A template for selecting request",
-								"allOf": [
-									{
+								"description": "A template for selecting requests. Same matcher shape as `RequestSelection`, plus template flags (`multiple`/`required`) and optional `templateParams` expansion.",
+								"required": [
+									"url",
+									"method",
+									"multiple",
+									"required"
+								],
+								"properties": {
+									"url": {
+										"type": "string",
+										"description": "The URL or generic path of the HTTP request."
+									},
+									"method": {
+										"type": "string",
+										"description": "The HTTP method used for the request.",
+										"enum": [
+											"GET",
+											"POST",
+											"PUT",
+											"PATCH",
+											"DELETE"
+										]
+									},
+									"requestBodyTemplate": {
+										"type": "string",
+										"description": "Template used to match or capture an outgoing request body. Template can use regex templates as placeholders. For example, to match an outgoing request body that contains a request ID, you can use the following template: `(?<requestId>.*)`.",
+										"maxLength": 100000
+									},
+									"credentials": {
+										"type": "string",
+										"description": "Mirrors the Fetch API `RequestCredentials` value used when issuing the request — controls whether cookies and auth headers are sent.",
+										"enum": [
+											"omit",
+											"same-origin",
+											"include"
+										]
+									},
+									"writeRedactionMode": {
+										"type": "string",
+										"description": "How the matched portion of the response should be redacted before the transcript is handed to the attestor.\n- `zk`: redact using a zero-knowledge proof over the original\n  bytes.\n\n- `key-update`: redact by performing a TLS key update so the\n  attestor never observes the matched bytes in cleartext.",
+										"enum": [
+											"zk",
+											"key-update"
+										]
+									},
+									"additionalClientOptions": {
 										"type": "object",
 										"additionalProperties": false,
-										"description": "A matcher for one HTTP request in observed traffic, together with the response constraints that must hold for a Reclaim proof over that request to be valid. Used by interceptors, in-page injections, and LLM agents.",
-										"required": [
-											"url",
-											"method"
-										],
+										"description": "Apply TLS configuration when creating the tunnel to the attestor.",
 										"properties": {
-											"url": {
-												"type": "string",
-												"description": "The URL or generic path of the HTTP request."
-											},
-											"method": {
-												"type": "string",
-												"description": "The HTTP method used for the request.",
-												"enum": [
-													"GET",
-													"POST",
-													"PUT",
-													"PATCH",
-													"DELETE"
-												]
-											},
-											"requestBodyTemplate": {
-												"type": "string",
-												"description": "Template used to match or capture an outgoing request body. Template can use regex templates as placeholders. For example, to match an outgoing request body that contains a request ID, you can use the following template: `(?<requestId>.*)`.",
-												"maxLength": 100000
-											},
-											"credentials": {
-												"type": "string",
-												"description": "Mirrors the Fetch API `RequestCredentials` value used when issuing the request — controls whether cookies and auth headers are sent.",
-												"enum": [
-													"omit",
-													"same-origin",
-													"include"
-												]
-											},
-											"writeRedactionMode": {
-												"type": "string",
-												"description": "How the matched portion of the response should be redacted before the transcript is handed to the attestor.\n- `zk`: redact using a zero-knowledge proof over the original\n  bytes.\n\n- `key-update`: redact by performing a TLS key update so the\n  attestor never observes the matched bytes in cleartext.",
-												"enum": [
-													"zk",
-													"key-update"
-												]
-											},
-											"additionalClientOptions": {
-												"type": "object",
-												"additionalProperties": false,
-												"description": "Apply TLS configuration when creating the tunnel to the attestor.",
-												"properties": {
-													"supportedProtocolVersions": {
-														"type": "array",
-														"description": "TLS protocol versions the client is allowed to negotiate.",
-														"minItems": 1,
-														"uniqueItems": true,
-														"items": {
-															"type": "string",
-															"enum": [
-																"TLS1_2",
-																"TLS1_3"
-															]
-														}
-													}
-												}
-											},
-											"responseMatches": {
+											"supportedProtocolVersions": {
 												"type": "array",
-												"description": "Conditions the (redacted) response must satisfy for the proof to be valid. Each runs against the union of the portions revealed by `responseRedactions` (or the whole response when there are none). Mirrors attestor-core `responseMatches`.",
+												"description": "TLS protocol versions the client is allowed to negotiate.",
 												"minItems": 1,
+												"uniqueItems": true,
 												"items": {
-													"type": "object",
-													"additionalProperties": false,
-													"description": "Specifies a rule to match against a string in response to validate proof content.",
-													"required": [
-														"type",
-														"value"
-													],
-													"properties": {
-														"isOptional": {
-															"type": "boolean",
-															"description": "If true, the match condition is optional and won't fail if absent",
-															"default": false
-														},
-														"description": {
-															"type": "string",
-															"description": "The description of the field that is extracted using this match rule",
-															"minLength": 1,
-															"maxLength": 1000
-														},
-														"order": {
-															"type": "integer",
-															"description": "The order in which the field should be displayed to user in UI",
-															"minimum": 0
-														},
-														"type": {
-															"type": "string",
-															"description": "The matching mechanism to use value as against response. Typically regex or simple string containment",
-															"enum": [
-																"regex",
-																"contains"
-															]
-														},
-														"value": {
-															"type": "string",
-															"description": "The pattern or value to look for in the response. When `type` is 'contains', supports template variable declaration using `{{variable}}` syntax. When `type` is 'regex', can be used to extract variables using regex named groups."
-														}
-													}
+													"type": "string",
+													"enum": [
+														"TLS1_2",
+														"TLS1_3"
+													]
 												}
-											},
-											"responseRedactions": {
-												"type": "array",
-												"description": "Portions to select/reveal from the response, applied in order (xPath => jsonPath => regex). Done client-side; only the selected portions (plus the first response line) are sent to the attestor. An independent ordered list — NOT paired 1:1 with `responseMatches`. Mirrors attestor-core `responseRedactions`.",
-												"items": {
-													"type": "object",
-													"additionalProperties": false,
-													"description": "Which portions to select from a response. These are selected in order, xpath => jsonPath => regex * These redactions are done client side and only the selected portions are sent to the attestor. The attestor will only be able to see the selected portions alongside the first line of the HTTP response (i.e. \"HTTP/1.1 200 OK\")",
-													"properties": {
-														"xPath": {
-															"type": "string",
-															"description": "expect an HTML response, and to contain a certain xpath for eg. \"/html/body/div.a1/div.a2/span.a5\""
-														},
-														"jsonPath": {
-															"type": "string",
-															"description": "expect a JSON response, retrieve the item at this path using dot notation for e.g. 'email.addresses.0'"
-														},
-														"regex": {
-															"type": "string",
-															"description": "select a regex match from the response"
-														},
-														"hash": {
-															"type": "string",
-															"description": "If provided, the value inside will be hashed instead of being redacted. Useful for cases where the data inside is an identifiying piece of information that you don't want to reveal to the attestor, eg. an email address.\nIf the hash function produces more bytes than the original value, the hash will be truncated.\nEg. if hash is enabled, the original value is \"hello\", and hashed is \"a1b2c\", then the attestor will only see \"a1b2c\".\nNote: if a regex with named groups is provided, only the named groups will be hashed.",
-															"enum": [
-																"oprf",
-																"oprf-mpc",
-																"oprf-raw"
-															]
-														}
-													}
+											}
+										}
+									},
+									"responseMatches": {
+										"type": "array",
+										"description": "Conditions the (redacted) response must satisfy for the proof to be valid. Each runs against the union of the portions revealed by `responseRedactions` (or the whole response when there are none). Mirrors attestor-core `responseMatches`.",
+										"minItems": 1,
+										"items": {
+											"type": "object",
+											"additionalProperties": false,
+											"description": "Specifies a rule to match against a string in response to validate proof content.",
+											"required": [
+												"type",
+												"value"
+											],
+											"properties": {
+												"isOptional": {
+													"type": "boolean",
+													"description": "If true, the match condition is optional and won't fail if absent",
+													"default": false
+												},
+												"description": {
+													"type": "string",
+													"description": "The description of the field that is extracted using this match rule",
+													"minLength": 1,
+													"maxLength": 1000
+												},
+												"order": {
+													"type": "integer",
+													"description": "The order in which the field should be displayed to user in UI",
+													"minimum": 0
+												},
+												"type": {
+													"type": "string",
+													"description": "The matching mechanism to use value as against response. Typically regex or simple string containment",
+													"enum": [
+														"regex",
+														"contains"
+													]
+												},
+												"value": {
+													"type": "string",
+													"description": "The pattern or value to look for in the response. When `type` is 'contains', supports template variable declaration using `{{variable}}` syntax. When `type` is 'regex', can be used to extract variables using regex named groups."
 												}
 											}
 										}
 									},
-									{
-										"type": "object",
-										"required": [
-											"multiple",
-											"required"
-										],
-										"properties": {
-											"multiple": {
-												"type": "boolean",
-												"description": "If true, the template is allowed for multiple requests. Useful for requests like paginated API calls.",
-												"default": true
-											},
-											"required": {
-												"type": "boolean",
-												"description": "If true, a request is required to match with this template. If not requests matches this template in proof, then validation fails.",
-												"default": true
+									"responseRedactions": {
+										"type": "array",
+										"description": "Portions to select/reveal from the response, applied in order (xPath => jsonPath => regex). Done client-side; only the selected portions (plus the first response line) are sent to the attestor. An independent ordered list — NOT paired 1:1 with `responseMatches`. Mirrors attestor-core `responseRedactions`.",
+										"items": {
+											"type": "object",
+											"additionalProperties": false,
+											"description": "Which portions to select from a response. These are selected in order, xpath => jsonPath => regex * These redactions are done client side and only the selected portions are sent to the attestor. The attestor will only be able to see the selected portions alongside the first line of the HTTP response (i.e. \"HTTP/1.1 200 OK\")",
+											"properties": {
+												"xPath": {
+													"type": "string",
+													"description": "expect an HTML response, and to contain a certain xpath for eg. \"/html/body/div.a1/div.a2/span.a5\""
+												},
+												"jsonPath": {
+													"type": "string",
+													"description": "expect a JSON response, retrieve the item at this path using dot notation for e.g. 'email.addresses.0'"
+												},
+												"regex": {
+													"type": "string",
+													"description": "select a regex match from the response"
+												},
+												"hash": {
+													"type": "string",
+													"description": "If provided, the value inside will be hashed instead of being redacted. Useful for cases where the data inside is an identifiying piece of information that you don't want to reveal to the attestor, eg. an email address.\nIf the hash function produces more bytes than the original value, the hash will be truncated.\nEg. if hash is enabled, the original value is \"hello\", and hashed is \"a1b2c\", then the attestor will only see \"a1b2c\".\nNote: if a regex with named groups is provided, only the named groups will be hashed.",
+													"enum": [
+														"oprf",
+														"oprf-mpc",
+														"oprf-raw"
+													]
+												}
 											}
 										}
+									},
+									"multiple": {
+										"type": "boolean",
+										"description": "If true, the template is allowed for multiple requests. Useful for requests like paginated API calls.",
+										"default": true
+									},
+									"required": {
+										"type": "boolean",
+										"description": "If true, a request is required to match with this template. If not requests matches this template in proof, then validation fails.",
+										"default": true
+									},
+									"templateParams": {
+										"type": "array",
+										"description": "Names of `${param}` placeholders used in this template's `responseMatches` / `responseRedactions`, substituted at verification time from array-valued extracted parameters (each name must resolve to an array of values; all named arrays must have the same length). Absent or empty means the template is used as-is with no expansion.",
+										"maxItems": 50,
+										"items": {
+											"type": "string",
+											"minLength": 1,
+											"maxLength": 100
+										}
+									},
+									"templateParamsMode": {
+										"type": "string",
+										"description": "How array values of `templateParams` expand the template: `separate` (default) emits one expanded request — its own claim — per value; `merge` emits a single request whose `responseMatches`/`responseRedactions` contain all substituted entries, proven by one claim.",
+										"enum": [
+											"separate",
+											"merge"
+										],
+										"default": "separate"
 									}
-								]
+								}
 							}
 						},
 						"webSettings": {
@@ -3445,6 +3382,12 @@ export const MCP_TOOLS = {
 													}
 												}
 											}
+										},
+										"extension": {
+											"type": "object",
+											"description": "Free-form key-value configuration for the browser-extension verification client. Keys and value shapes are defined by the extension client; values may be any JSON. Absent by default.",
+											"maxProperties": 100,
+											"additionalProperties": true
 										}
 									}
 								},