@reclaimprotocol/agent 0.1.2 → 0.1.3

package/lib/mcp/api/operations.gen.d.ts

@@ -75,6 +75,14 @@ export declare const MCP_TOOLS: {
         description: string;
         inputSchema: import("zod").ZodType<unknown, unknown, import("zod/v4/core").$ZodTypeInternals<unknown, unknown>>;
     };
+    DiscoverDataPoints: {
+        description: string;
+        inputSchema: import("zod").ZodType<unknown, unknown, import("zod/v4/core").$ZodTypeInternals<unknown, unknown>>;
+    };
+    DiscoverResolve: {
+        description: string;
+        inputSchema: import("zod").ZodType<unknown, unknown, import("zod/v4/core").$ZodTypeInternals<unknown, unknown>>;
+    };
     GetAttachSession: {
         description: string;
         inputSchema: import("zod").ZodType<unknown, unknown, import("zod/v4/core").$ZodTypeInternals<unknown, unknown>>;

package/lib/mcp/api/operations.gen.js

@@ -1421,6 +1421,98 @@ export const MCP_TOOLS = {
             "additionalProperties": false
         }),
     },
+    "DiscoverDataPoints": {
+        description: "List the verifiable data points on a website\n\nThe data points existing providers can prove on a website — the menu to pick from before `GET /discover/resolve`. Optionally filter by `q`.",
+        inputSchema: toZod({
+            "type": "object",
+            "properties": {
+                "params": {
+                    "type": "object",
+                    "properties": {}
+                },
+                "query": {
+                    "type": "object",
+                    "properties": {
+                        "domain": {
+                            "type": "string",
+                            "format": "hostname",
+                            "minLength": 1,
+                            "maxLength": 200
+                        },
+                        "q": {
+                            "type": "string",
+                            "maxLength": 200
+                        }
+                    },
+                    "required": [
+                        "domain"
+                    ],
+                    "additionalProperties": false
+                },
+                "body": {
+                    "type": "object"
+                }
+            },
+            "required": [
+                "params",
+                "query"
+            ],
+            "additionalProperties": false
+        }),
+    },
+    "DiscoverResolve": {
+        description: "Resolve a website + data points to verification providers\n\nProvider resolution: given a website and the data points the user wants their users to prove, return the smallest set of existing providers whose data points COVER the selection (greedy combine), the `requiredContext` inputs the consumer must supply, and any `uncovered` points no provider exposes yet (`needsCreation` is true then — author a provider with the agent tools). When the chosen providers can be fused into one (same start page, no clashing page scripts) `merge.mergeable` is true.\n\nAgent flow: pick a website (`GET /discover/data-points` lists what's verifiable there), confirm the data points with the user, call this to get the `providers` + `requiredContext`, collect those context values from the user, then `POST /verifications/sessions` with `providers` (pass every id) and `context` to mint a verification.",
+        inputSchema: toZod({
+            "type": "object",
+            "properties": {
+                "params": {
+                    "type": "object",
+                    "properties": {}
+                },
+                "query": {
+                    "type": "object",
+                    "properties": {
+                        "domain": {
+                            "type": "string",
+                            "format": "hostname",
+                            "minLength": 1,
+                            "maxLength": 200
+                        },
+                        "dataPoints": {
+                            "type": "array",
+                            "minItems": 1,
+                            "maxItems": 200,
+                            "items": {
+                                "type": "string",
+                                "minLength": 1,
+                                "maxLength": 200
+                            }
+                        },
+                        "mode": {
+                            "type": "string",
+                            "enum": [
+                                "combine",
+                                "ai"
+                            ]
+                        }
+                    },
+                    "required": [
+                        "domain",
+                        "dataPoints"
+                    ],
+                    "additionalProperties": false
+                },
+                "body": {
+                    "type": "object"
+                }
+            },
+            "required": [
+                "params",
+                "query"
+            ],
+            "additionalProperties": false
+        }),
+    },
     "GetAttachSession": {
         description: "Poll a pairing session\n\nAnonymous poll endpoint used by the CLI / MCP while it waits for the human to complete the dashboard step. Once `status` is `LINKED`, the response includes a `token` (2-day bearer token) the CLI / MCP can use for authenticated API calls. Expired or unknown codes return `404`.",
         inputSchema: toZod({

package/lib/old/to-register.d.ts

@@ -23,12 +23,14 @@ export interface OldProviderOpts {
     useProxy?: boolean;
     providerType?: 'PRIVATE' | 'PUBLIC';
 }
-/** Body for `POST /api/providers/register` — new provider + v1.0.0. */
-export declare function providerToRegisterBody(provider: ReclaimProvider, opts: OldProviderOpts): RegisterProviderBody;
+/** Body for `POST /api/providers/register` — new provider + v1.0.0. Every
+ *  drafted request becomes a `requestData` entry; provider-level fields (name)
+ *  come from the first draft. */
+export declare function providerToRegisterBody(providers: ReclaimProvider[], opts: OldProviderOpts): RegisterProviderBody;
 /** Body for `POST /api/providers/:providerId/config` — adds a new version to
  *  an EXISTING provider. `version` must not already exist; `versionInfo` is
  *  required and must be ≥10 chars (enforced by the backend). */
-export declare function providerToConfigBody(provider: ReclaimProvider, opts: OldProviderOpts, version: string, versionInfo: string): UpdateProviderConfigBody;
+export declare function providerToConfigBody(providers: ReclaimProvider[], opts: OldProviderOpts, version: string, versionInfo: string): UpdateProviderConfigBody;
 /** Minimal version triplet as the old backend stores it. */
 export interface SemverTriplet {
     major: number;

package/lib/old/to-register.js

@@ -72,16 +72,24 @@ function requestDataFromProvider(provider) {
     // it ourselves would risk drifting from the server's own extraction.
     return requestData;
 }
-/** Body for `POST /api/providers/register` — new provider + v1.0.0. */
-export function providerToRegisterBody(provider, opts) {
+/** One `requestData` entry per drafted provider. A multi-request provider
+ *  becomes parallel entries that the old backend runs together at verification
+ *  (the same way the builder version carries multiple `requests`). */
+function requestDataFrom(providers) {
+    return providers.map(requestDataFromProvider);
+}
+/** Body for `POST /api/providers/register` — new provider + v1.0.0. Every
+ *  drafted request becomes a `requestData` entry; provider-level fields (name)
+ *  come from the first draft. */
+export function providerToRegisterBody(providers, opts) {
     const body = {
-        name: provider.name,
+        name: providers[0].name,
         loginUrl: opts.initialUrl,
         providerType: opts.providerType ?? 'PRIVATE',
         // Web-settings defaults mirror the builder openapi defaults.
         geoLocation: opts.geoLocation ?? DEFAULT_GEO_LOCATION,
         useProxy: opts.useProxy ?? DEFAULT_USE_PROXY,
-        requestData: [requestDataFromProvider(provider)],
+        requestData: requestDataFrom(providers),
     };
     if (opts.description !== undefined) {
         body.description = opts.description;
@@ -91,14 +99,14 @@ export function providerToRegisterBody(provider, opts) {
 /** Body for `POST /api/providers/:providerId/config` — adds a new version to
  *  an EXISTING provider. `version` must not already exist; `versionInfo` is
  *  required and must be ≥10 chars (enforced by the backend). */
-export function providerToConfigBody(provider, opts, version, versionInfo) {
+export function providerToConfigBody(providers, opts, version, versionInfo) {
     // `useProxy` is a Provider-level flag on the old backend, not part of a
     // version's providerConfig — so the config (new-version) path only carries
     // `geoLocation`. It defaults the same way as register.
     const providerConfig = {
         loginUrl: opts.initialUrl,
         geoLocation: opts.geoLocation ?? DEFAULT_GEO_LOCATION,
-        requestData: [requestDataFromProvider(provider)],
+        requestData: requestDataFrom(providers),
     };
     return { providerConfig, version, versionInfo };
 }

package/lib/old/tools/publish.js

@@ -43,10 +43,15 @@ function rethrowOwnershipError(err, providerId) {
 export function createVersionFromCaptureTool(client) {
     return defineTool({
         name: 'create_provider_version_from_capture',
-        description: 'Publish a drafted ReclaimProvider to the OLD devtools backend. ' +
+        description: 'Publish drafted ReclaimProvider(s) to the OLD devtools backend. ' +
             'Pass the `provider` object from propose_provider VERBATIM and the ' +
             '`initialUrl` the user landed on (the login/landing page, NOT the ' +
             'API url). \n\n' +
+            'For a MULTI-REQUEST provider, pass `providers: [...]` (each entry a ' +
+            'proven draft from propose_provider) — every entry becomes one ' +
+            '`requestData` entry on the SAME version, and all are verified ' +
+            'together. Pass a single `provider` for the one-request case ' +
+            '(provide exactly one of `provider` / `providers`). \n\n' +
             'Omit `providerId` to REGISTER A NEW provider (creates it + version ' +
             '1.0.0; re-running creates a duplicate). Pass `providerId` (from ' +
             'get_me_providers) to add a NEW VERSION to that existing provider ' +
@@ -61,7 +66,8 @@ export function createVersionFromCaptureTool(client) {
             properties: {
                 provider: {
                     type: 'object',
-                    description: 'The `provider` object from propose_provider, verbatim.',
+                    description: 'A single `provider` object from propose_provider, verbatim. ' +
+                        'For multiple requests use `providers` instead.',
                     properties: {
                         name: { type: 'string' },
                         url: { type: 'string' },
@@ -74,6 +80,28 @@ export function createVersionFromCaptureTool(client) {
                     },
                     required: ['name', 'url', 'method', 'responseMatches'],
                 },
+                providers: {
+                    type: 'array',
+                    description: 'Multiple proven drafts → one multi-request version (each ' +
+                        'becomes a parallel `requestData` entry, all verified ' +
+                        'together). Each item has the same shape as `provider`. Pass ' +
+                        'this OR `provider`, not both.',
+                    minItems: 1,
+                    items: {
+                        type: 'object',
+                        properties: {
+                            name: { type: 'string' },
+                            url: { type: 'string' },
+                            method: { type: 'string' },
+                            headers: { type: 'object' },
+                            body: { type: 'string' },
+                            responseMatches: { type: 'array' },
+                            responseRedactions: { type: 'array' },
+                            paramValues: { type: 'object' },
+                        },
+                        required: ['name', 'url', 'method', 'responseMatches'],
+                    },
+                },
                 initialUrl: {
                     type: 'string',
                     description: 'The website URL the user landed on to trigger the request ' +
@@ -105,9 +133,18 @@ export function createVersionFromCaptureTool(client) {
                         'chars or a default is used).',
                 },
             },
-            required: ['provider', 'initialUrl'],
+            required: ['initialUrl'],
         },
     }, async (args) => {
+        // Exactly one of `provider` / `providers` — normalize to an array so a
+        // multi-request capture publishes every request, not just the first.
+        const hasMany = Array.isArray(args.providers) && args.providers.length > 0;
+        const hasOne = !!args.provider;
+        if (hasMany === hasOne) {
+            throw new Boom('Pass exactly one of `provider` (a single draft) or `providers` ' +
+                '(an array of 1+ drafts).', { statusCode: 400 });
+        }
+        const providers = hasMany ? args.providers : [args.provider];
         const opts = { initialUrl: args.initialUrl };
         if (args.description !== undefined) {
             opts.description = args.description;
@@ -121,11 +158,9 @@ export function createVersionFromCaptureTool(client) {
         if (args.providerType !== undefined) {
             opts.providerType = args.providerType;
         }
-        // Non-blocking advisory — never alters or blocks the publish; the
-        // author keeps full control. Attaches under `_notes` when relevant.
-        const notes = matchRedactionWarnings([
-            countsFor('Request', args.provider),
-        ]);
+        // Non-blocking advisory per request — never alters or blocks the
+        // publish; the author keeps full control. Attaches under `_notes`.
+        const notes = matchRedactionWarnings(providers.map((p, i) => countsFor(`Request ${i + 1}`, p)));
         const withNotes = (result) => {
             if (notes.length && result && typeof result === 'object') {
                 return { ...result, _notes: notes };
@@ -134,7 +169,7 @@ export function createVersionFromCaptureTool(client) {
         };
         // New provider.
         if (!args.providerId) {
-            const body = providerToRegisterBody(args.provider, opts);
+            const body = providerToRegisterBody(providers, opts);
             return withNotes(await client.registerProvider(body));
         }
         // New version of an existing provider — pick the next patch above
@@ -148,7 +183,7 @@ export function createVersionFromCaptureTool(client) {
             const versionInfo = args.notes && args.notes.trim().length >= 10
                 ? args.notes.trim()
                 : DEFAULT_VERSION_INFO;
-            const body = providerToConfigBody(args.provider, opts, version, versionInfo);
+            const body = providerToConfigBody(providers, opts, version, versionInfo);
             return withNotes(await client.updateProviderConfig(providerId, body));
         }
         catch (err) {

package/package.json

@@ -1,7 +1,7 @@
 {
 	"name": "@reclaimprotocol/agent",
 	"title": "Reclaim Agent",
-	"version": "0.1.2",
+	"version": "0.1.3",
 	"description": "Reclaim Protocol agent — SDK, CLI, and MCP server in one package. SDK + CLI talk to the builder backend; MCP server adds Chrome CDP capture, provider synthesis, replay, and zkTLS proof.",
 	"type": "module",
 	"main": "./lib/index.js",

package/skill/builder-mode.md

@@ -10,4 +10,6 @@ This server targets the Reclaim BUILDER backend. It exposes three tool layers: g
 
 **Templating:** bare `{{name}}` placeholders are provider params (values extracted from the response by the attestor). Values the CONSUMER must supply at verification time (e.g. a username in the URL path) are templated `{{context.<name>}}` and declared on the version as `requiredContext` — a JSON Schema set via `update_provider_version` while the version is on draft. The Builder validates every session-create's `context` against it (400 on mismatch; extra context fields are always allowed). `requiredContext` is optional — skip it when the recipe has no `{{context.*}}` placeholders. At verification time, requests are matched by exact origin+path: `{{context.<name>}}` segments match the consumer-sent value only, bare `{{name}}` values are extracted from the live traffic (plain-text alignment — works for JSON, XML, HTML, form-encoded, any text). Extract selectors apply client-side in spec order xPath → jsonPath → regex, each to the prior selection, so only the first selector constrains the full response; responses that cannot satisfy it (or miss a required match) are skipped. `propose_provider` returns advisory `verificationWarnings` for author-only decisions — surface them to the dev before publishing.
 
+**Discover & resolve (find providers for the user's app):** when a dev wants to add verification but doesn't know which providers to use, run the same flow the Discover UI does. Ask which website their users prove data from, then `discover_data_points({ domain })` to list what's verifiable there. Confirm the data points with the dev, then `discover_resolve({ domain, dataPoints })` → the smallest provider set (`providers`, greedy combine), the `requiredContext` inputs to collect from the dev, and any `uncovered` points (author those with the provider-authoring flow above, then re-resolve). Create the session with `create_verification_session({ providers: [{ providerId }, …], context, verificationClientUrl })`, passing EVERY resolved provider id and the collected context. `merge.mergeable` only signals the set could collapse into one provider — you still pass them all; the Builder runs them in one session.
+
 **Verification sessions:** consumers authenticate with a per-org token (`rorg_…`, issued in the dashboard via `POST /orgs/{orgId}/token`) and create sessions via `POST /verifications/sessions`. Results are ECIES-encrypted (secp256k1 + AES-256-GCM) to the org's eth public key when its `canEncryptResult` is enabled — set via `PUT /orgs/{orgId}/keypair` with an eth public key — and delivered to the org's callback subscriptions (plaintext otherwise). Use the org/session tools (`get_verification_session`, `list_verification_events`, `list_org_verification_sessions`) to troubleshoot.

package/skill/old-mode.md

@@ -4,8 +4,8 @@ This server is running against the LEGACY Reclaim devtools backend (temporary, w
 
 1. `reclaim_authenticate` — by default opens the dashboard in Chrome, waits for you to sign in, captures the token automatically, and closes the tab (or paste a `token` / pass an eth `ethAddress` to skip the browser). Do this once before publishing or listing.
 2. `attach_chrome` → `start_capture` → drive the page (`navigate`, `wait_for_page`) → inspect (`list_requests`, `get_request`, `find_requests_containing`).
-3. `propose_provider` to draft a provider, `replay_request` to pre-flight, `run_proof` to verify with the attestor. OPRF/`hash` redactions are optional and supported.
-4. `create_provider_version_from_capture` to publish. With NO `providerId` it REGISTERS A NEW provider (re-running creates a duplicate); pass a `providerId` from `get_me_providers` to add a new version to an existing provider instead.
+3. `propose_provider` to draft a provider, `replay_request` to pre-flight, `run_proof` to verify with the attestor. OPRF/`hash` redactions are optional and supported. When the data spans MULTIPLE requests (e.g. a landing call + a details call), propose + `run_proof` EACH request to get one proven draft per request.
+4. `create_provider_version_from_capture` to publish. With NO `providerId` it REGISTERS A NEW provider (re-running creates a duplicate); pass a `providerId` from `get_me_providers` to add a new version to an existing provider instead. For a MULTI-REQUEST provider, pass `providers: [draftA, draftB, …]` (every proven draft) so EACH becomes a parallel `requestData` entry on the one version — passing a single `provider` saves only that one request.
 5. `get_me_providers` lists the providers you own (the only provider-listing tool available in this mode).
 
 **Editing / new versions (ownership):** you can only add a version to a provider **you own** — the `providerId` must come from `get_me_providers`. Trying to version a public provider you don't own fails with a permission error; that is expected. To publish your own version of such a site, re-run `create_provider_version_from_capture` **without** `providerId` to register your own copy (a separate provider you own). If versioning a provider you *do* own fails, confirm you authenticated as the account that created it.

package/src/mcp/api/operations.gen.ts

@@ -1479,6 +1479,102 @@ export const MCP_TOOLS = {
 			"additionalProperties": false
 		}),
 	},
+	"DiscoverDataPoints": {
+		description: "List the verifiable data points on a website\n\nThe data points existing providers can prove on a website — the menu to pick from before `GET /discover/resolve`. Optionally filter by `q`.",
+		inputSchema: toZod({
+			"type": "object",
+			"properties": {
+				"params": {
+					"type": "object",
+					"properties": {
+
+					}
+				},
+				"query": {
+					"type": "object",
+					"properties": {
+						"domain": {
+							"type": "string",
+							"format": "hostname",
+							"minLength": 1,
+							"maxLength": 200
+						},
+						"q": {
+							"type": "string",
+							"maxLength": 200
+						}
+					},
+					"required": [
+						"domain"
+					],
+					"additionalProperties": false
+				},
+				"body": {
+					"type": "object"
+				}
+			},
+			"required": [
+				"params",
+				"query"
+			],
+			"additionalProperties": false
+		}),
+	},
+	"DiscoverResolve": {
+		description: "Resolve a website + data points to verification providers\n\nProvider resolution: given a website and the data points the user wants their users to prove, return the smallest set of existing providers whose data points COVER the selection (greedy combine), the `requiredContext` inputs the consumer must supply, and any `uncovered` points no provider exposes yet (`needsCreation` is true then — author a provider with the agent tools). When the chosen providers can be fused into one (same start page, no clashing page scripts) `merge.mergeable` is true.\n\nAgent flow: pick a website (`GET /discover/data-points` lists what's verifiable there), confirm the data points with the user, call this to get the `providers` + `requiredContext`, collect those context values from the user, then `POST /verifications/sessions` with `providers` (pass every id) and `context` to mint a verification.",
+		inputSchema: toZod({
+			"type": "object",
+			"properties": {
+				"params": {
+					"type": "object",
+					"properties": {
+
+					}
+				},
+				"query": {
+					"type": "object",
+					"properties": {
+						"domain": {
+							"type": "string",
+							"format": "hostname",
+							"minLength": 1,
+							"maxLength": 200
+						},
+						"dataPoints": {
+							"type": "array",
+							"minItems": 1,
+							"maxItems": 200,
+							"items": {
+								"type": "string",
+								"minLength": 1,
+								"maxLength": 200
+							}
+						},
+						"mode": {
+							"type": "string",
+							"enum": [
+								"combine",
+								"ai"
+							]
+						}
+					},
+					"required": [
+						"domain",
+						"dataPoints"
+					],
+					"additionalProperties": false
+				},
+				"body": {
+					"type": "object"
+				}
+			},
+			"required": [
+				"params",
+				"query"
+			],
+			"additionalProperties": false
+		}),
+	},
 	"GetAttachSession": {
 		description: "Poll a pairing session\n\nAnonymous poll endpoint used by the CLI / MCP while it waits for the human to complete the dashboard step. Once `status` is `LINKED`, the response includes a `token` (2-day bearer token) the CLI / MCP can use for authenticated API calls. Expired or unknown codes return `404`.",
 		inputSchema: toZod({

package/src/old/to-register.ts

@@ -150,19 +150,28 @@ function requestDataFromProvider(provider: ReclaimProvider): OldRequestData {
 	return requestData
 }
 
-/** Body for `POST /api/providers/register` — new provider + v1.0.0. */
+/** One `requestData` entry per drafted provider. A multi-request provider
+ *  becomes parallel entries that the old backend runs together at verification
+ *  (the same way the builder version carries multiple `requests`). */
+function requestDataFrom(providers: ReclaimProvider[]): OldRequestData[] {
+	return providers.map(requestDataFromProvider)
+}
+
+/** Body for `POST /api/providers/register` — new provider + v1.0.0. Every
+ *  drafted request becomes a `requestData` entry; provider-level fields (name)
+ *  come from the first draft. */
 export function providerToRegisterBody(
-	provider: ReclaimProvider,
+	providers: ReclaimProvider[],
 	opts: OldProviderOpts,
 ): RegisterProviderBody {
 	const body: RegisterProviderBody = {
-		name: provider.name,
+		name: providers[0].name,
 		loginUrl: opts.initialUrl,
 		providerType: opts.providerType ?? 'PRIVATE',
 		// Web-settings defaults mirror the builder openapi defaults.
 		geoLocation: opts.geoLocation ?? DEFAULT_GEO_LOCATION,
 		useProxy: opts.useProxy ?? DEFAULT_USE_PROXY,
-		requestData: [requestDataFromProvider(provider)],
+		requestData: requestDataFrom(providers),
 	}
 	if(opts.description !== undefined) {
 		body.description = opts.description
@@ -175,7 +184,7 @@ export function providerToRegisterBody(
  *  an EXISTING provider. `version` must not already exist; `versionInfo` is
  *  required and must be ≥10 chars (enforced by the backend). */
 export function providerToConfigBody(
-	provider: ReclaimProvider,
+	providers: ReclaimProvider[],
 	opts: OldProviderOpts,
 	version: string,
 	versionInfo: string,
@@ -186,7 +195,7 @@ export function providerToConfigBody(
 	const providerConfig: Record<string, unknown> = {
 		loginUrl: opts.initialUrl,
 		geoLocation: opts.geoLocation ?? DEFAULT_GEO_LOCATION,
-		requestData: [requestDataFromProvider(provider)],
+		requestData: requestDataFrom(providers),
 	}
 
 	return { providerConfig, version, versionInfo }

package/src/old/tools/publish.ts

@@ -62,7 +62,8 @@ export function createVersionFromCaptureTool(
 	client: ReclaimOldClient,
 ): RegisteredTool {
 	return defineTool<{
-		provider: ReclaimProvider
+		provider?: ReclaimProvider
+		providers?: ReclaimProvider[]
 		initialUrl: string
 		providerId?: string
 		description?: string
@@ -74,10 +75,15 @@ export function createVersionFromCaptureTool(
 		{
 			name: 'create_provider_version_from_capture',
 			description:
-				'Publish a drafted ReclaimProvider to the OLD devtools backend. ' +
+				'Publish drafted ReclaimProvider(s) to the OLD devtools backend. ' +
 				'Pass the `provider` object from propose_provider VERBATIM and the ' +
 				'`initialUrl` the user landed on (the login/landing page, NOT the ' +
 				'API url). \n\n' +
+				'For a MULTI-REQUEST provider, pass `providers: [...]` (each entry a ' +
+				'proven draft from propose_provider) — every entry becomes one ' +
+				'`requestData` entry on the SAME version, and all are verified ' +
+				'together. Pass a single `provider` for the one-request case ' +
+				'(provide exactly one of `provider` / `providers`). \n\n' +
 				'Omit `providerId` to REGISTER A NEW provider (creates it + version ' +
 				'1.0.0; re-running creates a duplicate). Pass `providerId` (from ' +
 				'get_me_providers) to add a NEW VERSION to that existing provider ' +
@@ -93,7 +99,8 @@ export function createVersionFromCaptureTool(
 					provider: {
 						type: 'object',
 						description:
-							'The `provider` object from propose_provider, verbatim.',
+							'A single `provider` object from propose_provider, verbatim. ' +
+							'For multiple requests use `providers` instead.',
 						properties: {
 							name: { type: 'string' },
 							url: { type: 'string' },
@@ -106,6 +113,29 @@ export function createVersionFromCaptureTool(
 						},
 						required: ['name', 'url', 'method', 'responseMatches'],
 					},
+					providers: {
+						type: 'array',
+						description:
+							'Multiple proven drafts → one multi-request version (each ' +
+							'becomes a parallel `requestData` entry, all verified ' +
+							'together). Each item has the same shape as `provider`. Pass ' +
+							'this OR `provider`, not both.',
+						minItems: 1,
+						items: {
+							type: 'object',
+							properties: {
+								name: { type: 'string' },
+								url: { type: 'string' },
+								method: { type: 'string' },
+								headers: { type: 'object' },
+								body: { type: 'string' },
+								responseMatches: { type: 'array' },
+								responseRedactions: { type: 'array' },
+								paramValues: { type: 'object' },
+							},
+							required: ['name', 'url', 'method', 'responseMatches'],
+						},
+					},
 					initialUrl: {
 						type: 'string',
 						description:
@@ -142,10 +172,24 @@ export function createVersionFromCaptureTool(
 							'chars or a default is used).',
 					},
 				},
-				required: ['provider', 'initialUrl'],
+				required: ['initialUrl'],
 			},
 		},
 		async(args) => {
+			// Exactly one of `provider` / `providers` — normalize to an array so a
+			// multi-request capture publishes every request, not just the first.
+			const hasMany = Array.isArray(args.providers) && args.providers.length > 0
+			const hasOne = !!args.provider
+			if(hasMany === hasOne) {
+				throw new Boom(
+					'Pass exactly one of `provider` (a single draft) or `providers` ' +
+					'(an array of 1+ drafts).',
+					{ statusCode: 400 },
+				)
+			}
+
+			const providers = hasMany ? args.providers! : [args.provider!]
+
 			const opts: OldProviderOpts = { initialUrl: args.initialUrl }
 			if(args.description !== undefined) {
 				opts.description = args.description
@@ -163,11 +207,11 @@ export function createVersionFromCaptureTool(
 				opts.providerType = args.providerType
 			}
 
-			// Non-blocking advisory — never alters or blocks the publish; the
-			// author keeps full control. Attaches under `_notes` when relevant.
-			const notes = matchRedactionWarnings([
-				countsFor('Request', args.provider),
-			])
+			// Non-blocking advisory per request — never alters or blocks the
+			// publish; the author keeps full control. Attaches under `_notes`.
+			const notes = matchRedactionWarnings(
+				providers.map((p, i) => countsFor(`Request ${i + 1}`, p)),
+			)
 			const withNotes = (result: unknown) => {
 				if(notes.length && result && typeof result === 'object') {
 					return { ...result, _notes: notes }
@@ -178,7 +222,7 @@ export function createVersionFromCaptureTool(
 
 			// New provider.
 			if(!args.providerId) {
-				const body = providerToRegisterBody(args.provider, opts)
+				const body = providerToRegisterBody(providers, opts)
 				return withNotes(await client.registerProvider(body))
 			}
 
@@ -195,7 +239,7 @@ export function createVersionFromCaptureTool(
 						? args.notes.trim()
 						: DEFAULT_VERSION_INFO
 				const body = providerToConfigBody(
-					args.provider,
+					providers,
 					opts,
 					version,
 					versionInfo,