@reclaimprotocol/agent 0.1.2 → 0.1.4

package/src/cdp/capture-engine.ts

@@ -55,6 +55,73 @@ export function stripPseudoHeaders(
 	return out
 }
 
+/** Extensions for static assets we never prove over — scripts, styles, fonts,
+ *  images, media, source maps. A real page pulls hundreds of these; tracking
+ *  them (and fetching their bodies) just bloats the request map and body store
+ *  with traffic no recipe ever matches. Note: `.json` is deliberately absent —
+ *  that's the API shape recipes care about. */
+const STATIC_ASSET_EXTENSIONS = new Set([
+	'js', 'mjs', 'cjs', 'css', 'map',
+	'png', 'jpg', 'jpeg', 'gif', 'svg', 'webp', 'avif', 'ico', 'bmp',
+	'woff', 'woff2', 'ttf', 'otf', 'eot',
+	'mp4', 'webm', 'mp3', 'ogg', 'wav',
+])
+
+/** True when the URL's path names a static asset (by file extension; query and
+ *  hash are ignored, so `chunk.js?v=1` still counts). The capture engine drops
+ *  these up front — they never carry JSON/HTML a recipe matches. */
+export function isStaticAsset(url: string): boolean {
+	let path: string
+	try {
+		path = new URL(url).pathname
+	} catch{
+		path = url.split(/[?#]/)[0] ?? url
+	}
+
+	// Extension of the last path segment only, so `/v1.2/data` isn't misread.
+	const base = path.slice(path.lastIndexOf('/') + 1)
+	const dot = base.lastIndexOf('.')
+	if(dot <= 0) {
+		return false
+	}
+
+	return STATIC_ASSET_EXTENSIONS.has(base.slice(dot + 1).toLowerCase())
+}
+
+/** Response Content-Types for static assets. The URL-extension filter misses
+ *  extension-less bundler/CDN URLs (e.g. `/assets/3b8f1c`), so we also drop by
+ *  MIME at response time. `text/html`, `application/json`, and `text/plain`
+ *  are NOT here — those are the document/API shapes recipes match. */
+const STATIC_ASSET_MIME_EXACT = new Set([
+	'text/css',
+	'application/javascript', 'text/javascript', 'application/x-javascript',
+	'application/ecmascript', 'text/ecmascript',
+	'application/wasm',
+	'application/font-woff', 'application/font-woff2',
+	'application/vnd.ms-fontobject', 'application/x-font-ttf',
+])
+
+const STATIC_ASSET_MIME_PREFIXES = ['image/', 'font/', 'audio/', 'video/']
+
+/** True when a response Content-Type is a static asset (scripts/styles/fonts/
+ *  images/media). Parameters (`; charset=…`) and case are ignored. */
+export function isStaticAssetMime(mimeType: string | undefined): boolean {
+	if(!mimeType) {
+		return false
+	}
+
+	const m = mimeType.toLowerCase().split(';')[0].trim()
+	if(!m) {
+		return false
+	}
+
+	if(STATIC_ASSET_MIME_PREFIXES.some((p) => m.startsWith(p))) {
+		return true
+	}
+
+	return STATIC_ASSET_MIME_EXACT.has(m)
+}
+
 export interface CaptureSession {
 	captureId: string
 	requests: Map<string, CapturedRequest>
@@ -173,6 +240,14 @@ export function createCaptureEngine(opts: CaptureEngineOptions): CaptureEngine {
 	}
 
 	function onRequestWillBeSent(p: RequestWillBeSentLike) {
+		// Static assets never match a recipe — never track them (so we don't
+		// fetch their bodies or grow the store). Drop any extra-info that raced
+		// ahead of this event so it can't linger.
+		if(isStaticAsset(p.request.url)) {
+			pendingRequestExtra.delete(p.requestId)
+			return
+		}
+
 		const f: InFlight = {
 			requestId: p.requestId,
 			method: p.request.method,
@@ -197,6 +272,20 @@ export function createCaptureEngine(opts: CaptureEngineOptions): CaptureEngine {
 	function onResponseReceived(p: ResponseReceivedLike) {
 		const f = inFlight.get(p.requestId)
 		if(!f) {
+			// No in-flight entry → the request was skipped (e.g. a static asset)
+			// or never seen. Discard any buffered response extra-info so a skipped
+			// asset can't leave a dangling entry.
+			pendingResponseExtra.delete(p.requestId)
+			return
+		}
+
+		// Second-line asset filter by Content-Type: catches extension-less
+		// bundler/CDN URLs the request-time URL filter can't. Forget the
+		// in-flight entry so it never reaches `requests` and a later
+		// loadingFinished/extra-info for it becomes a no-op.
+		if(isStaticAssetMime(p.response.mimeType)) {
+			inFlight.delete(p.requestId)
+			pendingResponseExtra.delete(p.requestId)
 			return
 		}
 

package/src/cdp/capture.ts

@@ -11,7 +11,11 @@ import {
 	type StartCaptureOptions,
 } from './capture-engine.ts'
 
-export { stripPseudoHeaders } from './capture-engine.ts'
+export {
+	isStaticAsset,
+	isStaticAssetMime,
+	stripPseudoHeaders,
+} from './capture-engine.ts'
 export type { CaptureSession, StartCaptureOptions } from './capture-engine.ts'
 
 export async function startCapture(

package/src/consts.ts

@@ -18,7 +18,7 @@
 import { DEFAULT_BASE_URL } from '@reclaimprotocol/client'
 import { homedir } from 'node:os'
 import { join } from 'node:path'
-import { DEFAULT_OLD_API_URL } from './old/client.ts'
+import { DEFAULT_OLD_API_URL, DEFAULT_OLD_LOGS_URL } from './old/client.ts'
 
 // ---------------------------------------------------------------------------
 // Default / fallback literals (used only as env fallbacks).
@@ -32,7 +32,7 @@ export const DEFAULT_LOGIN_URL = 'https://dev.reclaimprotocol.org'
 
 // Re-export the two non-env-fallback defaults so callers can keep importing
 // their URL defaults from a single place if they wish.
-export { DEFAULT_BASE_URL, DEFAULT_OLD_API_URL }
+export { DEFAULT_BASE_URL, DEFAULT_OLD_API_URL, DEFAULT_OLD_LOGS_URL }
 
 // ---------------------------------------------------------------------------
 // Logging.
@@ -96,6 +96,11 @@ export function oldApiUrl(): string {
 	return process.env.RECLAIM_OLD_API_URL || DEFAULT_OLD_API_URL
 }
 
+/** Old-devtools analytics-logs service base URL (separate host). */
+export function oldLogsUrl(): string {
+	return process.env.RECLAIM_OLD_LOGS_URL || DEFAULT_OLD_LOGS_URL
+}
+
 /** Builder backend base URL. Shared by mcp/start and the verification tool. */
 export function apiUrl(): string {
 	return process.env.RECLAIM_API_URL || DEFAULT_BASE_URL

package/src/mcp/api/operations.gen.ts

@@ -1479,6 +1479,102 @@ export const MCP_TOOLS = {
 			"additionalProperties": false
 		}),
 	},
+	"DiscoverDataPoints": {
+		description: "List the verifiable data points on a website\n\nThe data points existing providers can prove on a website — the menu to pick from before `GET /discover/resolve`. Optionally filter by `q`.",
+		inputSchema: toZod({
+			"type": "object",
+			"properties": {
+				"params": {
+					"type": "object",
+					"properties": {
+
+					}
+				},
+				"query": {
+					"type": "object",
+					"properties": {
+						"domain": {
+							"type": "string",
+							"format": "hostname",
+							"minLength": 1,
+							"maxLength": 200
+						},
+						"q": {
+							"type": "string",
+							"maxLength": 200
+						}
+					},
+					"required": [
+						"domain"
+					],
+					"additionalProperties": false
+				},
+				"body": {
+					"type": "object"
+				}
+			},
+			"required": [
+				"params",
+				"query"
+			],
+			"additionalProperties": false
+		}),
+	},
+	"DiscoverResolve": {
+		description: "Resolve a website + data points to verification providers\n\nProvider resolution: given a website and the data points the user wants their users to prove, return the smallest set of existing providers whose data points COVER the selection (greedy combine), the `requiredContext` inputs the consumer must supply, and any `uncovered` points no provider exposes yet (`needsCreation` is true then — author a provider with the agent tools). When the chosen providers can be fused into one (same start page, no clashing page scripts) `merge.mergeable` is true.\n\nAgent flow: pick a website (`GET /discover/data-points` lists what's verifiable there), confirm the data points with the user, call this to get the `providers` + `requiredContext`, collect those context values from the user, then `POST /verifications/sessions` with `providers` (pass every id) and `context` to mint a verification.",
+		inputSchema: toZod({
+			"type": "object",
+			"properties": {
+				"params": {
+					"type": "object",
+					"properties": {
+
+					}
+				},
+				"query": {
+					"type": "object",
+					"properties": {
+						"domain": {
+							"type": "string",
+							"format": "hostname",
+							"minLength": 1,
+							"maxLength": 200
+						},
+						"dataPoints": {
+							"type": "array",
+							"minItems": 1,
+							"maxItems": 200,
+							"items": {
+								"type": "string",
+								"minLength": 1,
+								"maxLength": 200
+							}
+						},
+						"mode": {
+							"type": "string",
+							"enum": [
+								"combine",
+								"ai"
+							]
+						}
+					},
+					"required": [
+						"domain",
+						"dataPoints"
+					],
+					"additionalProperties": false
+				},
+				"body": {
+					"type": "object"
+				}
+			},
+			"required": [
+				"params",
+				"query"
+			],
+			"additionalProperties": false
+		}),
+	},
 	"GetAttachSession": {
 		description: "Poll a pairing session\n\nAnonymous poll endpoint used by the CLI / MCP while it waits for the human to complete the dashboard step. Once `status` is `LINKED`, the response includes a `token` (2-day bearer token) the CLI / MCP can use for authenticated API calls. Expired or unknown codes return `404`.",
 		inputSchema: toZod({

package/src/mcp/instructions.ts

@@ -13,3 +13,21 @@ export const BUILDER_MODE_INSTRUCTIONS = readFileSync(
 	fileURLToPath(new URL('../../skill/builder-mode.md', import.meta.url)),
 	'utf8',
 ).trim()
+
+/**
+ * The full provider-authoring guide — the deep capture→prove→publish workflow,
+ * decision frameworks, and troubleshooting. Served on demand by the
+ * `how_it_works` MCP tool so every client (not just Claude Code, which
+ * auto-loads skills) can pull it. There's a guide PER MODE so an agent is never
+ * shown auth/publish tools that don't exist in its backend: the server picks
+ * one by `oldMode` (see `mcp/start.ts`). Same `../../skill/` path resolution as
+ * the instructions above; any leading frontmatter is stripped defensively.
+ */
+function readGuide(file: string): string {
+	return readFileSync(fileURLToPath(new URL(file, import.meta.url)), 'utf8')
+		.replace(/^---\n[\s\S]*?\n---\n/, '')
+		.trim()
+}
+
+export const PROVIDER_GUIDE_BUILDER = readGuide('../../skill/SKILL.builder.md')
+export const PROVIDER_GUIDE_OLD = readGuide('../../skill/SKILL.old.md')

package/src/mcp/start.ts

@@ -6,6 +6,7 @@ import {
 	apiToken,
 	apiUrl,
 	oldApiUrl,
+	oldLogsUrl,
 	useOldDevtools,
 } from '../consts.ts'
 import { ReclaimOldClient } from '../old/client.ts'
@@ -49,6 +50,7 @@ export async function startMcpServer() {
 		// get_me_providers instead.
 		const oldClient = new ReclaimOldClient({
 			baseUrl: oldApiUrl(),
+			logsBaseUrl: oldLogsUrl(),
 			identity: resolveInitialIdentity(),
 		})
 

package/src/mcp/tools/agent/build.ts

@@ -17,6 +17,7 @@ import { type AttachState, attachTool } from './attach.ts'
 import { type CaptureStore, captureTools } from './capture.ts'
 import { browserTools } from './eval.ts'
 import { findTool } from './find.ts'
+import { howItWorksTool } from './how-it-works.ts'
 import { proofTool } from './proof.ts'
 import {
 	makeSecretStore,
@@ -52,6 +53,9 @@ export function buildAgentTools(
 	const state = buildAgentState()
 	ensureAttestorCrypto()
 	const tools: RegisteredTool[] = []
+	// Stateless docs tool — serve the mode-specific authoring guide to any
+	// client. No `client` ⇒ old-devtools mode (see `mcp/start.ts`).
+	tools.push(howItWorksTool(!client))
 	tools.push(attachTool(state.attach))
 	for(const t of captureTools(state.attach, state.captures)) {
 		tools.push(t)

package/src/mcp/tools/agent/how-it-works.ts

@@ -0,0 +1,32 @@
+import {
+	PROVIDER_GUIDE_BUILDER,
+	PROVIDER_GUIDE_OLD,
+} from '../../instructions.ts'
+import { defineTool, type RegisteredTool } from '../../server.ts'
+
+/**
+ * Serves the full provider-authoring guide on demand. The MCP server's
+ * always-on `instructions` are a terse tool-flow reference; this tool returns
+ * the deep version (workflow, decision frameworks, gotchas, "never do" rules)
+ * so any MCP client — not just Claude Code, which alone auto-loads skills — can
+ * pull it. `oldMode` selects the backend-specific guide so the agent is never
+ * told to call auth/publish tools that aren't registered in its mode.
+ * Stateless: callable before `attach_chrome`.
+ */
+export function howItWorksTool(oldMode: boolean): RegisteredTool {
+	const guide = oldMode ? PROVIDER_GUIDE_OLD : PROVIDER_GUIDE_BUILDER
+	return defineTool<Record<string, never>>(
+		{
+			name: 'how_it_works',
+			description:
+				'Return the full Reclaim provider-authoring guide for THIS server: '
+				+ 'the capture → draft → replay → prove → publish workflow, decision '
+				+ 'frameworks (login detection, OPRF privacy, context vs bare params), '
+				+ 'multi-request handling, troubleshooting, and what never to do. '
+				+ 'Call this BEFORE building a provider unless you are already '
+				+ 'fluent in the flow.',
+			inputSchema: { type: 'object', properties: {} },
+		},
+		async() => ({ guide }),
+	)
+}

package/src/old/client.ts

@@ -6,6 +6,10 @@ import { NAME, VERSION } from '../pkg.ts'
  *  `RECLAIM_OLD_API_URL`. */
 export const DEFAULT_OLD_API_URL = 'https://devapi.reclaimprotocol.org'
 
+/** Default origin of the OLD-devtools analytics-logs service — a SEPARATE host
+ *  from the devtools API. Override with `RECLAIM_OLD_LOGS_URL`. */
+export const DEFAULT_OLD_LOGS_URL = 'https://logs.reclaimprotocol.org'
+
 /**
  * Externally-supplied caller identity. We do NOT mint these — the dev
  * provides one:
@@ -63,15 +67,19 @@ interface RequestOpts {
  */
 export class ReclaimOldClient {
 	readonly baseUrl: string
+	readonly logsBaseUrl: string
 	#identity?: OldIdentity
 	#fetch: typeof fetch
 
 	constructor(opts: {
 		baseUrl?: string
+		logsBaseUrl?: string
 		identity?: OldIdentity
 		fetch?: typeof fetch
 	} = {}) {
 		this.baseUrl = (opts.baseUrl || DEFAULT_OLD_API_URL).replace(/\/+$/, '')
+		this.logsBaseUrl = (opts.logsBaseUrl || DEFAULT_OLD_LOGS_URL)
+			.replace(/\/+$/, '')
 		this.#identity = opts.identity
 		this.#fetch = opts.fetch ?? fetch
 	}
@@ -113,6 +121,30 @@ export class ReclaimOldClient {
 		)
 	}
 
+	/** Analytics logs for a verification session, from the logs service (a
+	 *  DIFFERENT host than the devtools API — hence its own fetch, not
+	 *  `#request`). Attaches the caller identity when one is set; queried
+	 *  anonymously otherwise. */
+	async getSessionAnalyticsLogs(sessionId: string): Promise<unknown> {
+		const url = `${this.logsBaseUrl}/api/analytics-logs/session/`
+			+ encodeURIComponent(sessionId)
+		const headers: Record<string, string> = {
+			Accept: 'application/json',
+			'User-Agent': `${NAME}/${VERSION}`,
+		}
+		if(this.#identity) {
+			headers[this.#authHeaderName()] = this.#authHeaderValue()
+		}
+
+		const res = await this.#fetch(url, { method: 'GET', headers })
+		const json = await this.#parseBody(res)
+		if(!res.ok) {
+			throw this.#asBoom(res, json)
+		}
+
+		return json
+	}
+
 	getMyProviders(query: MyProvidersQuery = {}): Promise<unknown> {
 		// Every one of these query params is REQUIRED by the backend
 		// validator (missing/invalid → 400), so default them all here.

package/src/old/to-register.ts

@@ -150,19 +150,28 @@ function requestDataFromProvider(provider: ReclaimProvider): OldRequestData {
 	return requestData
 }
 
-/** Body for `POST /api/providers/register` — new provider + v1.0.0. */
+/** One `requestData` entry per drafted provider. A multi-request provider
+ *  becomes parallel entries that the old backend runs together at verification
+ *  (the same way the builder version carries multiple `requests`). */
+function requestDataFrom(providers: ReclaimProvider[]): OldRequestData[] {
+	return providers.map(requestDataFromProvider)
+}
+
+/** Body for `POST /api/providers/register` — new provider + v1.0.0. Every
+ *  drafted request becomes a `requestData` entry; provider-level fields (name)
+ *  come from the first draft. */
 export function providerToRegisterBody(
-	provider: ReclaimProvider,
+	providers: ReclaimProvider[],
 	opts: OldProviderOpts,
 ): RegisterProviderBody {
 	const body: RegisterProviderBody = {
-		name: provider.name,
+		name: providers[0].name,
 		loginUrl: opts.initialUrl,
 		providerType: opts.providerType ?? 'PRIVATE',
 		// Web-settings defaults mirror the builder openapi defaults.
 		geoLocation: opts.geoLocation ?? DEFAULT_GEO_LOCATION,
 		useProxy: opts.useProxy ?? DEFAULT_USE_PROXY,
-		requestData: [requestDataFromProvider(provider)],
+		requestData: requestDataFrom(providers),
 	}
 	if(opts.description !== undefined) {
 		body.description = opts.description
@@ -175,7 +184,7 @@ export function providerToRegisterBody(
  *  an EXISTING provider. `version` must not already exist; `versionInfo` is
  *  required and must be ≥10 chars (enforced by the backend). */
 export function providerToConfigBody(
-	provider: ReclaimProvider,
+	providers: ReclaimProvider[],
 	opts: OldProviderOpts,
 	version: string,
 	versionInfo: string,
@@ -186,7 +195,7 @@ export function providerToConfigBody(
 	const providerConfig: Record<string, unknown> = {
 		loginUrl: opts.initialUrl,
 		geoLocation: opts.geoLocation ?? DEFAULT_GEO_LOCATION,
-		requestData: [requestDataFromProvider(provider)],
+		requestData: requestDataFrom(providers),
 	}
 
 	return { providerConfig, version, versionInfo }

package/src/old/tools/build.ts

@@ -3,12 +3,13 @@ import type { ReclaimOldClient } from '../client.ts'
 import { authenticateTool } from './authenticate.ts'
 import { getMeProvidersTool } from './me-providers.ts'
 import { createVersionFromCaptureTool } from './publish.ts'
+import { sessionAnalyticsLogsTool } from './session-analytics-logs.ts'
 
 /**
  * The backend-facing tools for OLD-devtools mode. Mirrors
  * `buildCredentialTools` / `buildAgentTools`: returns a flat `RegisteredTool`
- * list for `registerToolList`. These three replace the builder credential +
- * publish tools and the (disabled) generated provider tools.
+ * list for `registerToolList`. These replace the builder credential + publish
+ * tools and the (disabled) generated provider tools.
  */
 export function buildOldBackendTools(
 	client: ReclaimOldClient,
@@ -17,5 +18,6 @@ export function buildOldBackendTools(
 		authenticateTool(client),
 		createVersionFromCaptureTool(client),
 		getMeProvidersTool(client),
+		sessionAnalyticsLogsTool(client),
 	]
 }

package/src/old/tools/publish.ts

@@ -62,7 +62,8 @@ export function createVersionFromCaptureTool(
 	client: ReclaimOldClient,
 ): RegisteredTool {
 	return defineTool<{
-		provider: ReclaimProvider
+		provider?: ReclaimProvider
+		providers?: ReclaimProvider[]
 		initialUrl: string
 		providerId?: string
 		description?: string
@@ -74,10 +75,15 @@ export function createVersionFromCaptureTool(
 		{
 			name: 'create_provider_version_from_capture',
 			description:
-				'Publish a drafted ReclaimProvider to the OLD devtools backend. ' +
+				'Publish drafted ReclaimProvider(s) to the OLD devtools backend. ' +
 				'Pass the `provider` object from propose_provider VERBATIM and the ' +
 				'`initialUrl` the user landed on (the login/landing page, NOT the ' +
 				'API url). \n\n' +
+				'For a MULTI-REQUEST provider, pass `providers: [...]` (each entry a ' +
+				'proven draft from propose_provider) — every entry becomes one ' +
+				'`requestData` entry on the SAME version, and all are verified ' +
+				'together. Pass a single `provider` for the one-request case ' +
+				'(provide exactly one of `provider` / `providers`). \n\n' +
 				'Omit `providerId` to REGISTER A NEW provider (creates it + version ' +
 				'1.0.0; re-running creates a duplicate). Pass `providerId` (from ' +
 				'get_me_providers) to add a NEW VERSION to that existing provider ' +
@@ -93,7 +99,8 @@ export function createVersionFromCaptureTool(
 					provider: {
 						type: 'object',
 						description:
-							'The `provider` object from propose_provider, verbatim.',
+							'A single `provider` object from propose_provider, verbatim. ' +
+							'For multiple requests use `providers` instead.',
 						properties: {
 							name: { type: 'string' },
 							url: { type: 'string' },
@@ -106,6 +113,29 @@ export function createVersionFromCaptureTool(
 						},
 						required: ['name', 'url', 'method', 'responseMatches'],
 					},
+					providers: {
+						type: 'array',
+						description:
+							'Multiple proven drafts → one multi-request version (each ' +
+							'becomes a parallel `requestData` entry, all verified ' +
+							'together). Each item has the same shape as `provider`. Pass ' +
+							'this OR `provider`, not both.',
+						minItems: 1,
+						items: {
+							type: 'object',
+							properties: {
+								name: { type: 'string' },
+								url: { type: 'string' },
+								method: { type: 'string' },
+								headers: { type: 'object' },
+								body: { type: 'string' },
+								responseMatches: { type: 'array' },
+								responseRedactions: { type: 'array' },
+								paramValues: { type: 'object' },
+							},
+							required: ['name', 'url', 'method', 'responseMatches'],
+						},
+					},
 					initialUrl: {
 						type: 'string',
 						description:
@@ -142,10 +172,24 @@ export function createVersionFromCaptureTool(
 							'chars or a default is used).',
 					},
 				},
-				required: ['provider', 'initialUrl'],
+				required: ['initialUrl'],
 			},
 		},
 		async(args) => {
+			// Exactly one of `provider` / `providers` — normalize to an array so a
+			// multi-request capture publishes every request, not just the first.
+			const hasMany = Array.isArray(args.providers) && args.providers.length > 0
+			const hasOne = !!args.provider
+			if(hasMany === hasOne) {
+				throw new Boom(
+					'Pass exactly one of `provider` (a single draft) or `providers` ' +
+					'(an array of 1+ drafts).',
+					{ statusCode: 400 },
+				)
+			}
+
+			const providers = hasMany ? args.providers! : [args.provider!]
+
 			const opts: OldProviderOpts = { initialUrl: args.initialUrl }
 			if(args.description !== undefined) {
 				opts.description = args.description
@@ -163,11 +207,11 @@ export function createVersionFromCaptureTool(
 				opts.providerType = args.providerType
 			}
 
-			// Non-blocking advisory — never alters or blocks the publish; the
-			// author keeps full control. Attaches under `_notes` when relevant.
-			const notes = matchRedactionWarnings([
-				countsFor('Request', args.provider),
-			])
+			// Non-blocking advisory per request — never alters or blocks the
+			// publish; the author keeps full control. Attaches under `_notes`.
+			const notes = matchRedactionWarnings(
+				providers.map((p, i) => countsFor(`Request ${i + 1}`, p)),
+			)
 			const withNotes = (result: unknown) => {
 				if(notes.length && result && typeof result === 'object') {
 					return { ...result, _notes: notes }
@@ -178,7 +222,7 @@ export function createVersionFromCaptureTool(
 
 			// New provider.
 			if(!args.providerId) {
-				const body = providerToRegisterBody(args.provider, opts)
+				const body = providerToRegisterBody(providers, opts)
 				return withNotes(await client.registerProvider(body))
 			}
 
@@ -195,7 +239,7 @@ export function createVersionFromCaptureTool(
 						? args.notes.trim()
 						: DEFAULT_VERSION_INFO
 				const body = providerToConfigBody(
-					args.provider,
+					providers,
 					opts,
 					version,
 					versionInfo,

package/src/old/tools/session-analytics-logs.ts

@@ -0,0 +1,33 @@
+import { defineTool, type RegisteredTool } from '../../mcp/server.ts'
+import type { ReclaimOldClient } from '../client.ts'
+
+/**
+ * Fetch analytics logs for a verification session from the OLD-devtools logs
+ * service (`GET https://logs.reclaimprotocol.org/api/analytics-logs/session/
+ * :sessionId`). Old mode only — useful for diagnosing why a session failed or
+ * stalled. The logs service is a separate host from the devtools API.
+ */
+export function sessionAnalyticsLogsTool(
+	client: ReclaimOldClient,
+): RegisteredTool {
+	return defineTool<{ sessionId: string }>(
+		{
+			name: 'session_analytics_logs',
+			description:
+				'Fetch analytics logs for a verification session by id from the '
+				+ 'old-devtools logs service — use to diagnose what happened in a '
+				+ 'session (matches, claims, failures). Pass the `sessionId`.',
+			inputSchema: {
+				type: 'object',
+				properties: {
+					sessionId: {
+						type: 'string',
+						description: 'The verification session id to fetch logs for.',
+					},
+				},
+				required: ['sessionId'],
+			},
+		},
+		async(args) => client.getSessionAnalyticsLogs(args.sessionId),
+	)
+}