@reclaimprotocol/agent 0.1.3 → 0.1.5

package/lib/mcp/tools/agent/shared.js

@@ -0,0 +1,115 @@
+/**
+ * Build the shared authoring tools for the MCP, bound to a per-capture LOCAL
+ * backend: a Chrome tab over CDP + the in-process attestor SDK. The tool logic
+ * (navigate/inspect/propose/replay/prove) is authored once in `../../../
+ * authoring` with the shared `defineTool` primitive; this only supplies the
+ * MCP host — resolve the backend from `captureId` (the session handle from
+ * `start_capture`, since one capture bundles the tab, its requests, and its
+ * drafts) and the rich, credential-aware `run_proof` schema.
+ */
+import { buildAuthoringTools, } from "../../../authoring/index.js";
+import { runAttestorProof } from "../../../proof/attestor.js";
+import { replayProvider } from "../../../proof/replay.js";
+import { shapeRichProofResult } from "./proof.js";
+/** The local backend for one capture: drive its tab over CDP, read its
+ *  captured requests, prove via the in-process attestor, replay by re-fetch. */
+function localBackend(entry) {
+    const { tabClient, session, drafts } = entry;
+    // The per-tab CDP client is strongly typed to `keyof Commands`; the shared
+    // tools drive it with dynamic method/event names, so view it as string-keyed.
+    const client = tabClient;
+    return {
+        capture: session,
+        drafts,
+        sendCdp: (method, params) => client.send(method, params ?? {}),
+        waitForEvent: (method, timeoutMs) => new Promise((resolve) => {
+            const onEvent = () => {
+                cleanup();
+                resolve('fired');
+            };
+            const timer = setTimeout(() => {
+                cleanup();
+                resolve('timeout');
+            }, timeoutMs);
+            const cleanup = () => {
+                clearTimeout(timer);
+                client.removeListener(method, onEvent);
+            };
+            client.once(method, onEvent);
+        }),
+        replay: async (draft, opts) => {
+            // Auth-bound check: re-fetch with the secrets dropped. replayProvider
+            // already does a live Node fetch, so empty secrets == anonymous.
+            const secrets = opts?.withoutSecrets ? {} : draft.secrets;
+            const result = await replayProvider(draft.provider, secrets);
+            return {
+                status: result.status,
+                matchesOriginal: result.matchesOriginal,
+                bodySnippet: result.body.slice(0, 256),
+                ...(result.hints !== undefined ? { hints: result.hints } : {}),
+            };
+        },
+        prove: async (draft, opts) => {
+            const result = await runAttestorProof(draft.provider, draft.secrets, {
+                ...(opts?.ownerAddress ? { ownerAddress: opts.ownerAddress } : {}),
+                ...(opts?.attestorUrl ? { attestorUrl: opts.attestorUrl } : {}),
+            });
+            return shapeRichProofResult(result, {
+                provider: draft.provider,
+                hasSecrets: Object.keys(draft.secrets).length > 0,
+                ...(opts?.attestorUrl ? { attestorUrl: opts.attestorUrl } : {}),
+            });
+        },
+    };
+}
+/** The MCP's rich, credential-aware `run_proof` schema, merged onto the shared
+ *  tool by the host below (the cloud's TEE signs in-enclave, so it needs none
+ *  of this). */
+const RUN_PROOF_EXTRAS = {
+    description: 'Run a full zkTLS proof of the drafted recipe through the Reclaim '
+        + 'attestor SDK. Use only after replay_request looks right — attestor '
+        + 'calls are expensive. Writes the full claim to '
+        + '~/.reclaim/claims/<timestamp>.json and returns identifier + '
+        + 'extractedParameters + claimPath + a prettified `claim` (request '
+        + 'dropped, byte arrays as base64). With RECLAIM_AGENT_TRACE=1, also '
+        + 'writes a per-call diagnostic dump (input provider, sentParams, full '
+        + 'attestor log stream, result) and returns it as `runLogPath`. '
+        + '`attestorUrl` overrides the default only when the dev supplies a '
+        + 'specific alternative — do NOT invent backup URLs. `ownerAddress` '
+        + '(the credential to sign with) is REQUIRED — call resolve_owner_key '
+        + 'first. errorKind="missing-owner-key" means that address has no known '
+        + 'private key; re-run resolve_owner_key or issue/import a credential.',
+    properties: {
+        ownerAddress: {
+            type: 'string',
+            pattern: '^0x[0-9a-fA-F]{40}$',
+            description: 'ETH address of the credential to sign the claim with. Get it '
+                + 'from resolve_owner_key first. The private key is resolved '
+                + 'locally (cache / env / .env) — never passed here.',
+        },
+        attestorUrl: { type: 'string' },
+    },
+    required: ['ownerAddress'],
+};
+/** The shared authoring tools as MCP `RegisteredTool`s: each resolves its
+ *  capture's local backend from `args.captureId`; the schema carries
+ *  `captureId` plus the rich `run_proof` contract. */
+export function sharedAuthoringTools(captures) {
+    const host = {
+        resolveBackend: (args) => {
+            const captureId = String(args.captureId);
+            const entry = captures.sessions.get(captureId);
+            if (!entry) {
+                throw new Error(`no capture ${captureId} — call start_capture first `
+                    + '(it has been reset or never started).');
+            }
+            return localBackend(entry);
+        },
+        sessionSchema: {
+            properties: { captureId: { type: 'string' } },
+            required: ['captureId'],
+        },
+        toolExtras: { run_proof: RUN_PROOF_EXTRAS },
+    };
+    return buildAuthoringTools(host);
+}

package/lib/old/client.d.ts

@@ -2,6 +2,9 @@
  *  `/api` route prefix itself, so this is the bare origin. Override with
  *  `RECLAIM_OLD_API_URL`. */
 export declare const DEFAULT_OLD_API_URL = "https://devapi.reclaimprotocol.org";
+/** Default origin of the OLD-devtools analytics-logs service — a SEPARATE host
+ *  from the devtools API. Override with `RECLAIM_OLD_LOGS_URL`. */
+export declare const DEFAULT_OLD_LOGS_URL = "https://logs.reclaimprotocol.org";
 /**
  * Externally-supplied caller identity. We do NOT mint these — the dev
  * provides one:
@@ -53,8 +56,10 @@ export interface MyProvidersQuery {
 export declare class ReclaimOldClient {
     #private;
     readonly baseUrl: string;
+    readonly logsBaseUrl: string;
     constructor(opts?: {
         baseUrl?: string;
+        logsBaseUrl?: string;
         identity?: OldIdentity;
         fetch?: typeof fetch;
     });
@@ -66,5 +71,10 @@ export declare class ReclaimOldClient {
     registerProvider(body: RegisterProviderBody): Promise<unknown>;
     updateProviderConfig(providerId: string, body: UpdateProviderConfigBody): Promise<unknown>;
     listVersions(providerId: string): Promise<unknown>;
+    /** Analytics logs for a verification session, from the logs service (a
+     *  DIFFERENT host than the devtools API — hence its own fetch, not
+     *  `#request`). Attaches the caller identity when one is set; queried
+     *  anonymously otherwise. */
+    getSessionAnalyticsLogs(sessionId: string): Promise<unknown>;
     getMyProviders(query?: MyProvidersQuery): Promise<unknown>;
 }

package/lib/old/client.js

@@ -4,6 +4,9 @@ import { NAME, VERSION } from "../pkg.js";
  *  `/api` route prefix itself, so this is the bare origin. Override with
  *  `RECLAIM_OLD_API_URL`. */
 export const DEFAULT_OLD_API_URL = 'https://devapi.reclaimprotocol.org';
+/** Default origin of the OLD-devtools analytics-logs service — a SEPARATE host
+ *  from the devtools API. Override with `RECLAIM_OLD_LOGS_URL`. */
+export const DEFAULT_OLD_LOGS_URL = 'https://logs.reclaimprotocol.org';
 /**
  * Minimal REST client for the OLD devtools Express backend (base `/api`).
  * Deliberately NOT a clone of `@reclaimprotocol/client`'s operationId
@@ -16,10 +19,13 @@ export const DEFAULT_OLD_API_URL = 'https://devapi.reclaimprotocol.org';
  */
 export class ReclaimOldClient {
     baseUrl;
+    logsBaseUrl;
     #identity;
     #fetch;
     constructor(opts = {}) {
         this.baseUrl = (opts.baseUrl || DEFAULT_OLD_API_URL).replace(/\/+$/, '');
+        this.logsBaseUrl = (opts.logsBaseUrl || DEFAULT_OLD_LOGS_URL)
+            .replace(/\/+$/, '');
         this.#identity = opts.identity;
         this.#fetch = opts.fetch ?? fetch;
     }
@@ -43,6 +49,27 @@ export class ReclaimOldClient {
     listVersions(providerId) {
         return this.#request('GET', `/providers/${encodeURIComponent(providerId)}/versions`, { auth: true });
     }
+    /** Analytics logs for a verification session, from the logs service (a
+     *  DIFFERENT host than the devtools API — hence its own fetch, not
+     *  `#request`). Attaches the caller identity when one is set; queried
+     *  anonymously otherwise. */
+    async getSessionAnalyticsLogs(sessionId) {
+        const url = `${this.logsBaseUrl}/api/analytics-logs/session/`
+            + encodeURIComponent(sessionId);
+        const headers = {
+            Accept: 'application/json',
+            'User-Agent': `${NAME}/${VERSION}`,
+        };
+        if (this.#identity) {
+            headers[this.#authHeaderName()] = this.#authHeaderValue();
+        }
+        const res = await this.#fetch(url, { method: 'GET', headers });
+        const json = await this.#parseBody(res);
+        if (!res.ok) {
+            throw this.#asBoom(res, json);
+        }
+        return json;
+    }
     getMyProviders(query = {}) {
         // Every one of these query params is REQUIRED by the backend
         // validator (missing/invalid → 400), so default them all here.

package/lib/old/login-cdp.d.ts

@@ -17,4 +17,9 @@ export declare function captureFirebaseTokenViaCdp(opts: {
     loginUrl?: string;
     timeoutMs?: number;
     pollMs?: number;
+    /** Called every ~10s while waiting for the human to finish signing in, so
+     *  MCP clients that track progress on this call can reset their own
+     *  request timeout instead of giving up on a login that's still in
+     *  flight (see `ToolContext` in `mcp/server.ts`). */
+    onProgress?: (message: string) => Promise<void>;
 }): Promise<CdpLoginResult>;

package/lib/old/login-cdp.js

@@ -65,6 +65,8 @@ export async function captureFirebaseTokenViaCdp(opts) {
     const loginUrl = opts.loginUrl || oldLoginUrl() || DEFAULT_LOGIN_URL;
     const timeoutMs = opts.timeoutMs ?? 180_000;
     const pollMs = opts.pollMs ?? 1000;
+    const onProgress = opts.onProgress ?? (async () => { });
+    const progressIntervalMs = 10_000;
     const cfg = new ConfigStore().read()?.browser_agent;
     const mode = cfg?.attachMode ?? 'dedicated';
     const port = cfg?.port ?? 9222;
@@ -89,7 +91,9 @@ export async function captureFirebaseTokenViaCdp(opts) {
     try {
         const session = await handles.attachToTab(targetId);
         const { Runtime } = session;
-        const deadline = Date.now() + timeoutMs;
+        const startedAt = Date.now();
+        const deadline = startedAt + timeoutMs;
+        let lastProgressAt = startedAt;
         while (Date.now() < deadline) {
             const r = await Runtime.evaluate({
                 expression: EXTRACT_TOKEN_JS,
@@ -100,6 +104,13 @@ export async function captureFirebaseTokenViaCdp(opts) {
             if (typeof value === 'string' && value.length > 0) {
                 return { token: value, closedBrowser: launchedByUs };
             }
+            const now = Date.now();
+            if (now - lastProgressAt >= progressIntervalMs) {
+                lastProgressAt = now;
+                const remainingSec = Math.round((deadline - now) / 1000);
+                await onProgress(`Still waiting for sign-in at ${loginUrl} ` +
+                    `(${remainingSec}s left before this call times out).`);
+            }
             await new Promise((resolve) => setTimeout(resolve, pollMs));
         }
         throw new Error('Timed out waiting for login. Finish signing in at the opened ' +

package/lib/old/tools/authenticate.js

@@ -1,5 +1,5 @@
 import { agentDisabled } from "../../consts.js";
-import { defineTool } from "../../mcp/server.js";
+import { defineTool, } from "../../mcp/server.js";
 import { persistIdentity, toEthUid } from "../identity.js";
 import { captureFirebaseTokenViaCdp } from "../login-cdp.js";
 /**
@@ -69,7 +69,7 @@ export function authenticateTool(client) {
                 },
             },
         },
-    }, async ({ token, ethAddress, loginUrl, timeoutMs, useBrowser }) => {
+    }, async ({ token, ethAddress, loginUrl, timeoutMs, useBrowser }, ctx) => {
         if (token && ethAddress) {
             throw new Error('Provide only ONE of `token` or `ethAddress`, not both.');
         }
@@ -113,7 +113,11 @@ export function authenticateTool(client) {
             throw new Error('Browser login is unavailable (RECLAIM_AGENT_DISABLED=1). Pass a ' +
                 '`token` (Firebase ID token) or `ethAddress` instead.');
         }
-        const result = await captureFirebaseTokenViaCdp({ loginUrl, timeoutMs });
+        const result = await captureFirebaseTokenViaCdp({
+            loginUrl,
+            timeoutMs,
+            onProgress: ctx.reportProgress,
+        });
         const identity = { kind: 'bearer', token: result.token };
         await validate(identity);
         persistIdentity(identity);

package/lib/old/tools/build.d.ts

@@ -3,7 +3,7 @@ import type { ReclaimOldClient } from '../client.ts';
 /**
  * The backend-facing tools for OLD-devtools mode. Mirrors
  * `buildCredentialTools` / `buildAgentTools`: returns a flat `RegisteredTool`
- * list for `registerToolList`. These three replace the builder credential +
- * publish tools and the (disabled) generated provider tools.
+ * list for `registerToolList`. These replace the builder credential + publish
+ * tools and the (disabled) generated provider tools.
  */
 export declare function buildOldBackendTools(client: ReclaimOldClient): RegisteredTool[];

package/lib/old/tools/build.js

@@ -1,16 +1,18 @@
 import { authenticateTool } from "./authenticate.js";
 import { getMeProvidersTool } from "./me-providers.js";
 import { createVersionFromCaptureTool } from "./publish.js";
+import { sessionAnalyticsLogsTool } from "./session-analytics-logs.js";
 /**
  * The backend-facing tools for OLD-devtools mode. Mirrors
  * `buildCredentialTools` / `buildAgentTools`: returns a flat `RegisteredTool`
- * list for `registerToolList`. These three replace the builder credential +
- * publish tools and the (disabled) generated provider tools.
+ * list for `registerToolList`. These replace the builder credential + publish
+ * tools and the (disabled) generated provider tools.
  */
 export function buildOldBackendTools(client) {
     return [
         authenticateTool(client),
         createVersionFromCaptureTool(client),
         getMeProvidersTool(client),
+        sessionAnalyticsLogsTool(client),
     ];
 }

package/lib/old/tools/session-analytics-logs.d.ts

@@ -0,0 +1,9 @@
+import { type RegisteredTool } from '../../mcp/server.ts';
+import type { ReclaimOldClient } from '../client.ts';
+/**
+ * Fetch analytics logs for a verification session from the OLD-devtools logs
+ * service (`GET https://logs.reclaimprotocol.org/api/analytics-logs/session/
+ * :sessionId`). Old mode only — useful for diagnosing why a session failed or
+ * stalled. The logs service is a separate host from the devtools API.
+ */
+export declare function sessionAnalyticsLogsTool(client: ReclaimOldClient): RegisteredTool;

package/lib/old/tools/session-analytics-logs.js

@@ -0,0 +1,25 @@
+import { defineTool } from "../../mcp/server.js";
+/**
+ * Fetch analytics logs for a verification session from the OLD-devtools logs
+ * service (`GET https://logs.reclaimprotocol.org/api/analytics-logs/session/
+ * :sessionId`). Old mode only — useful for diagnosing why a session failed or
+ * stalled. The logs service is a separate host from the devtools API.
+ */
+export function sessionAnalyticsLogsTool(client) {
+    return defineTool({
+        name: 'session_analytics_logs',
+        description: 'Fetch analytics logs for a verification session by id from the '
+            + 'old-devtools logs service — use to diagnose what happened in a '
+            + 'session (matches, claims, failures). Pass the `sessionId`.',
+        inputSchema: {
+            type: 'object',
+            properties: {
+                sessionId: {
+                    type: 'string',
+                    description: 'The verification session id to fetch logs for.',
+                },
+            },
+            required: ['sessionId'],
+        },
+    }, async (args) => client.getSessionAnalyticsLogs(args.sessionId));
+}

package/lib/proof/proof-core.d.ts

@@ -18,7 +18,7 @@ export declare function ensureAttestorCrypto(): void;
  *  default. Resolved per-call so an env change or per-request override takes
  *  effect without restarting. */
 export declare function resolveAttestorUrl(override?: string): string;
-/** Map a verification's provider recipe straight to the attestor's HTTP
+/** Map a provider's recipe straight to the attestor's HTTP
  *  params — never synthesized from captured traffic. */
 export declare function buildHttpParams(provider: ReclaimProvider): ProviderParams<'http'>;
 export interface ParsedClaim {

package/lib/proof/proof-core.js

@@ -21,7 +21,7 @@ export function ensureAttestorCrypto() {
 export function resolveAttestorUrl(override) {
     return (override ?? attestorUrlOverride() ?? FALLBACK_ATTESTOR_URL);
 }
-/** Map a verification's provider recipe straight to the attestor's HTTP
+/** Map a provider's recipe straight to the attestor's HTTP
  *  params — never synthesized from captured traffic. */
 export function buildHttpParams(provider) {
     // A blank egress is treated as unset: omit it so the local proof uses the

package/lib/tools/registry.d.ts

@@ -0,0 +1,36 @@
+/**
+ * The ONE tool primitive for the agent. A tool is authored once with
+ * {@link defineTool} — `{ definition, handler }`, where the handler receives
+ * args already parsed + validated against the definition's JSON Schema (via
+ * zod), so the schema shown to the model and the validation applied to inbound
+ * args cannot drift.
+ *
+ * This lives outside `mcp/` on purpose: it depends only on zod (NOT the MCP
+ * SDK), so non-MCP consumers — the cloud authoring loop — can author and run
+ * these tools without pulling in `@modelcontextprotocol/sdk`. The MCP-specific
+ * glue (`registerToolList` onto an `McpServer`) stays in `mcp/server.ts`, which
+ * re-exports this primitive for the MCP-side tool files.
+ */
+import type { JSONSchema } from 'zod/v4/core';
+export interface ToolDefinition {
+    name: string;
+    description: string;
+    inputSchema: JSONSchema.ObjectSchema;
+}
+export interface RegisteredTool {
+    definition: ToolDefinition;
+    /**
+     * @param args Tool arguments (already zod-validated against the schema).
+     * @returns A JSON-stringifiable value to return to the LLM.
+     * @throws Any error; the host (MCP `registerToolList` / the cloud loop)
+     * catches it and surfaces it as an error tool-result.
+     */
+    handler: (args: unknown) => Promise<unknown>;
+}
+/**
+ * Define a tool with a single inputSchema (JSON Schema) as the source of truth.
+ * The handler receives args already parsed and type-narrowed via a Zod schema
+ * derived from that same JSON Schema — so the description sent to the client
+ * and the validation applied to inbound args cannot drift.
+ */
+export declare function defineTool<TArgs>(definition: ToolDefinition, handler: (args: TArgs) => Promise<unknown>): RegisteredTool;

package/lib/tools/registry.js

@@ -0,0 +1,17 @@
+import { toZod } from "../mcp/api/to-zod.js";
+/**
+ * Define a tool with a single inputSchema (JSON Schema) as the source of truth.
+ * The handler receives args already parsed and type-narrowed via a Zod schema
+ * derived from that same JSON Schema — so the description sent to the client
+ * and the validation applied to inbound args cannot drift.
+ */
+export function defineTool(definition, handler) {
+    const schema = toZod(definition.inputSchema);
+    return {
+        definition,
+        handler: async (raw) => {
+            const args = schema.parse(raw);
+            return await handler(args);
+        },
+    };
+}

package/package.json

@@ -1,7 +1,7 @@
 {
 	"name": "@reclaimprotocol/agent",
 	"title": "Reclaim Agent",
-	"version": "0.1.3",
+	"version": "0.1.5",
 	"description": "Reclaim Protocol agent — SDK, CLI, and MCP server in one package. SDK + CLI talk to the builder backend; MCP server adds Chrome CDP capture, provider synthesis, replay, and zkTLS proof.",
 	"type": "module",
 	"main": "./lib/index.js",
@@ -26,8 +26,7 @@
 		"./mcp/register": {
 			"types": "./lib/mcp/register.d.ts",
 			"import": "./lib/mcp/register.js"
-		},
-		"./skill": "./skill/SKILL.md"
+		}
 	},
 	"bin": {
 		"reclaim": "./lib/cli.js",

package/skill/{SKILL.md → SKILL.builder.md}

@@ -1,39 +1,19 @@
----
-name: reclaim-provider
-description: Activate when the developer asks how to verify a value from a website (e.g. "create a provider for X", "verify my GitHub username", "prove my X follower count"). Drives the reclaim-agent MCP server to capture browser traffic, draft a Reclaim provider JSON, replay it, and run an end-to-end zkTLS proof.
----
-
-# Authoring a Reclaim Provider / Verification
-
-> **Terminology note:** "provider" and "verification" refer to the same
-> thing. The API and tool parameters use **provider** / **providerId**
-> (the technical term). Conversations with developers prefer
-> **verification** (the user-facing term). Either is acceptable — never
-> correct the developer for using one or the other.
+# Authoring a Reclaim Provider
+
+> **Terminology note:** A **provider** is the recipe you author here — the
+> instructions for extracting a data point from a website (the
+> `responseMatches` / `responseRedactions` spec, identified by a
+> `providerId`). Always call it a **provider**; never call a provider a
+> "verification." A **verification** (or **verification session**) is the
+> separate runtime act in which an end-user proves a data point *using* a
+> provider — reserve that word for the session/result, never for the recipe.
+> If a developer calls the recipe a "verification," gently use "provider"
+> yourself rather than correcting them.
 
 You drive the browser through the capture → draft → replay → prove loop using the `reclaim-agent` MCP server. **Your default stance is driver, not orchestrator.** Only pause to ask the dev for things that genuinely require a human: typing credentials, completing 2FA, solving a captcha, confirming an ambiguous value. Navigation, reloads, DOM inspection, request capture — all yours.
 
-## Modes
-
-This MCP server targets one of two backends. Detect which from the tools available to you:
-
-- **Old devtools (the default).** `get_me_providers` is present; the generated API tools (`get_me`, `create_verification`, `list_orgs`, …) are absent.
-- **Builder.** The generated API tools are present; `get_me_providers` is absent.
-
-Only **authentication** (below), **publishing** (the final step), and the **consumer-supplied param namespace** differ between modes: values the Consumer supplies at verification time are templated `{{context.<name>}}` on builder vs `{{context_<name>}}` on old devtools (no dotted interpolation there) — see step 10. The capture → draft → replay → prove loop in between is identical, and OPRF is optional and supported in both.
-
 ## Getting authenticated
 
-### Old devtools mode
-
-Call `reclaim_authenticate({})` with no arguments. It opens the Reclaim dashboard in Chrome, waits for the dev to sign in, reads the token from the page automatically, and closes the tab — a still-valid cached identity is reused first, so it's often instant. Tell the dev once: _"A browser window is opening the Reclaim dashboard — please sign in and I'll continue automatically."_
-
-- Force a fresh login (ignore the cached identity): `reclaim_authenticate({ useBrowser: true })`.
-- Skip the browser: `reclaim_authenticate({ token: "<firebase-id-token>" })`, or `reclaim_authenticate({ ethAddress: "0x..." })` for an already-provisioned eth user.
-- Tokens are short-lived (~1h). If a later call returns 401, call `reclaim_authenticate({})` again.
-
-### Builder mode
-
 **Check first:** try `get_me`. If it returns the user's profile, you're authenticated — proceed to the loop.
 
 **On 401:** call `authenticate({})` to start a device-pairing session:
@@ -150,15 +130,14 @@ The 2-day token is cached in `~/.reclaim/config.json` and reused on later runs (
 
 10. **Parameterize user-specific URL segments** so the provider isn't user-specific at the URL level. The matcher already populates `paramValues` with the _captured value_ (e.g. `{username: "Scratch-net"}` for a username target). If the URL ALSO contains user-identifying segments, those are **consumer-supplied context params** — at verification time their values come from the Consumer's session `context`, not from extraction. They use a namespaced placeholder, and the namespace differs by mode:
 
-- **Builder mode:** replace with `{{context.<name>}}`. E.g. `https://github.com/Scratch-net/repos` → `https://github.com/{{context.username}}/repos`, with `paramValues: { ..., "context.username": "Scratch-net" }` for replay/proof (the paramValues key must match the placeholder name exactly, dot included). Declare these in the version's `requiredContext` at publish time (step 13).
-- **Old devtools mode:** same idea, but the legacy backend doesn't support dotted interpolation — use `{{context_<name>}}` and `paramValues: { ..., "context_username": "Scratch-net" }`.
+replace with `{{context.<name>}}`. E.g. `https://github.com/Scratch-net/repos` → `https://github.com/{{context.username}}/repos`, with `paramValues: { ..., "context.username": "Scratch-net" }` for replay/proof (the paramValues key must match the placeholder name exactly, dot included). Declare these in the version's `requiredContext` at publish time (step 13).
 - Query parameters with user-specific values → same treatment.
 - Generic segments (`/api/v3`, `/users`, `/repos`) stay literal.
 - If the URL has no user-identifying segments (e.g. `/settings/profile`), leave it untouched — the matcher already handled the value via paramValues.
 
 **Do not rename the match-template param.** The synthesizer's `{{name}}` in `responseMatches[].value` is an _extraction_ template (the attestor pulls the value out of the response) — it stays bare and never gets the `context.` prefix. Only URL/body placeholders whose values the Consumer must supply are context params.
 
-**How the verification client resolves these at runtime** (builder mode — use this to make the context-vs-bare call):
+**How the verification client resolves these at runtime**:
 
 - Requests are matched by **exact origin+path** (query ignored). A `{{context.<name>}}` segment matches **only the value the consumer sent** in the session context (validated by `requiredContext`); a bare `{{name}}` segment matches any one path segment and its value is **auto-extracted from the live traffic**.
 - Interpolation and `contains` matching are **plain text** — they work for any captured content (JSON, XML, HTML, form-encoded bodies, …).
@@ -198,17 +177,9 @@ The 2-day token is cached in `~/.reclaim/config.json` and reused on later runs (
 
     **Missing ZK circuit files:** if the error says "ZK circuit resources are missing" and points at a `circuit.wasm` path, the npm postinstall didn't run (commonly because the dev used `npm install --ignore-scripts` or a corp policy disabled it). Tell the dev to run `npm run download:zk-files` from the project root and then retry `run_proof` — no need to redo capture or propose. The MCP server doesn't need a restart either; the next `run_proof` call will see the files.
 
-13. **Publish the proved provider.** This is the step that differs by mode (see [Modes](#modes)). In both, `provider` is the exact JSON from step 9 with the step-10 URL parameterisation applied, and `initialUrl` is the page where the user logs in / the value is displayed (e.g. `https://github.com/Syed`) — **not** the API endpoint URL inside the provider.
-
-    **Old devtools mode** — call `create_provider_version_from_capture`:
-    - **New verification:** omit `providerId`. It registers a new provider (version 1.0.0). Pass `provider`, `initialUrl`, and optionally `description`, `geoLocation`, `providerType` (`PRIVATE` default | `PUBLIC`).
-    - **New version of an existing verification:** pass its `providerId` — the patch is auto-bumped above the highest existing version. Pass `notes` (≥10 chars) as the change note.
-    - `get_me_providers({ searchQuery? })` lists the verifications you own — use it to find a `providerId` or to confirm the result. It's the only provider-listing tool in this mode.
-    - There's no separate "create-then-version" step and no org / public-review workflow here.
-    - Consumer-supplied params (step 10) keep the `{{context_<name>}}` form in this mode; there is no `requiredContext` declaration on the legacy backend.
+13. **Publish the proved provider.** `provider` is the exact JSON from step 9 with the step-10 URL parameterisation applied, and `initialUrl` is the page where the user logs in / the value is displayed (e.g. `https://github.com/Syed`) — **not** the API endpoint URL inside the provider.
 
-    **Builder mode:**
-    1. **Create the verification if it doesn't exist:** `create_verification(orgId, domain, slug, title, description)` — find `orgId` via `list_orgs`. `domain` e.g. `github.com`; `slug` e.g. `github-username`; `title` e.g. "GitHub Username". Starts PRIVATE with an empty seed version. Skip if the dev already has a `providerId`.
+    1. **Create the provider if it doesn't exist:** `create_provider(orgId, domain, slug, title, description)` — find `orgId` via `list_orgs`. `domain` e.g. `github.com`; `slug` e.g. `github-username`; `title` e.g. "GitHub Username". Starts PRIVATE with an empty seed version. Skip if the dev already has a `providerId`.
     2. **Persist the version:** `create_provider_version_from_capture(providerId, provider, initialUrl, notes)` — `notes` e.g. `"Initial draft from browser capture"`. The version lands on the `draft` branch.
     3. **`requiredContext` is derived for you.** The publish tool scans the recipe's url/body for `{{context.<name>}}` placeholders (step 10) and emits a JSON Schema requiring each one — the Builder then validates every session-create's `context` against it (a clear 400 instead of a late attestor failure). Extra context fields are always allowed. The derived properties are plain strings; to refine types or add human-readable descriptions, call `update_provider_version` with a `requiredContext` override while the version is on `draft`, e.g.:
 
@@ -216,7 +187,7 @@ The 2-day token is cached in `~/.reclaim/config.json` and reused on later runs (
        { "requiredContext": { "type": "object", "required": ["username"], "properties": { "username": { "type": "string", "description": "GitHub username to verify" } } } }
        ```
     4. **Go live:** PRIVATE → `publish_provider_version`; PUBLIC → `submit_provider_version_for_review(providerId, version)` and tell the dev it's awaiting admin review.
-    5. **Tell the dev how consumers call it:** sessions for this verification must include the context params, e.g. `context: { "username": "..." }` in `POST /verifications/sessions`. Quote the `requiredContext` returned on the created version — a session missing those fields gets a 400, and verification matches the supplied values exactly.
+    5. **Tell the dev how consumers call it:** sessions for this provider must include the context params, e.g. `context: { "username": "..." }` in `POST /verifications/sessions`. Quote the `requiredContext` returned on the created version — a session missing those fields gets a 400, and verification matches the supplied values exactly.
 
     When done, tell the developer the version is live (PRIVATE) or submitted for review (PUBLIC), and that they can integrate using the `providerId`.