@reclaimprotocol/agent 0.1.38 → 0.1.40

package/lib/mcp/tools/authenticate/issue-org-keypair.js

@@ -1,14 +1,17 @@
+import { conflict } from '@hapi/boom';
 import { deriveFromPrivateKey, generateKeypair } from '@reclaimprotocol/client';
+import { isProblemError } from '@reclaimprotocol/client/api';
 import assert from 'node:assert';
 import { isAbsolute, relative, resolve } from 'node:path';
 import { defineTool } from "../../server.js";
-import { normalizeEthHex, readDotenvKey, upsertEnvVar } from "./eth-key.js";
+import { backupEnvVar, normalizeEthHex, readDotenvKey, removeEnvVar, upsertEnvVar, } from "./eth-key.js";
 /**
  * Creates the organization's eth key pair for session binding and encrypted
  * results: writes the private key to the app's server env file and registers
  * only the public key with Builder, so the private key never passes through
  * the agent's transcript. Reuses a key the env file already holds, so a
- * repeat call (for example, to turn on encryption) keeps the same key.
+ * repeat call (for example, to turn on encryption) keeps the same key. With
+ * `replace`, always generates a fresh key and rotates the org's key to it.
  */
 export function issueOrgKeypairTool(client) {
     return defineTool({
@@ -20,8 +23,12 @@ export function issueOrgKeypairTool(client) {
             + 'private key to a server env file in the project (reusing a key '
             + 'already there) and registers only the public key. Returns the '
             + 'address, file, and variable; never the key. Returns 409 when the '
-            + 'org already has a different key: ask the developer for that key '
-            + 'rather than replacing it.',
+            + 'org already has a different key. Set `replace: true` only when '
+            + 'the developer asked to rotate or replace the key: it generates '
+            + 'a new key and swaps it in one step, and apps holding the old '
+            + 'key can no longer decrypt new results. The old key is first '
+            + 'appended to `<envFile>.backup` (gitignored); tell the developer '
+            + 'its path.',
         inputSchema: {
             type: 'object',
             required: ['orgId', 'projectDir'],
@@ -42,11 +49,17 @@ export function issueOrgKeypairTool(client) {
                 },
                 encryptResults: {
                     type: 'boolean',
-                    description: 'Encrypt delivered results to this key. Default false.',
+                    description: 'Encrypt delivered results to this key. Default false, or the '
+                        + 'org\'s current setting with `replace`.',
+                },
+                replace: {
+                    type: 'boolean',
+                    description: 'Rotate: generate a new key and replace the org\'s current '
+                        + 'one. Default false.',
                 },
             },
         },
-        annotations: { openWorldHint: true, destructiveHint: false },
+        annotations: { openWorldHint: true, destructiveHint: true },
     }, async (args) => {
         assert(isAbsolute(args.projectDir), new Error('`projectDir` must be an absolute path.'));
         const envFile = args.envFile || '.env';
@@ -54,22 +67,53 @@ export function issueOrgKeypairTool(client) {
         const envPath = resolve(args.projectDir, envFile);
         const inside = relative(args.projectDir, envPath);
         assert(inside && !inside.startsWith('..') && !isAbsolute(inside), new Error('`envFile` must be inside `projectDir`.'));
-        const existing = readDotenvKey(envPath, envVar);
+        const replace = args.replace ?? false;
+        // Rotation always generates a fresh key: the env file's key may or
+        // may not be the one the org holds, and reuse would be a no-op.
+        const existing = replace ? undefined : readDotenvKey(envPath, envVar);
         const keypair = existing
             ? deriveFromPrivateKey(normalizeEthHex(existing))
             : generateKeypair();
-        // Register first: a 409 (the org has another key) must not leave a
-        // key Builder doesn't know in the env file.
-        const canEncryptResult = args.encryptResults ?? false;
-        await client.call('SetOrgKeypair', {
-            params: { orgId: args.orgId },
-            body: {
-                publicKey: keypair.publicKey,
-                canEncryptResult,
-                replace: false,
-            },
-        });
+        // A rotation keeps the org's current setting unless the caller sets it.
+        const canEncryptResult = args.encryptResults
+            ?? (replace && await currentCanEncryptResult());
+        // Back up and save the key before the org switches to it, so a
+        // failed write can't leave the org on a key no app holds. A failed
+        // registration (for example, a 409) puts the env file back.
+        const old = readDotenvKey(envPath, envVar);
+        const backupFile = old && !existing
+            ? backupEnvVar(args.projectDir, envFile, envVar, 'replaced by issue_org_keypair')
+            : undefined;
         const path = upsertEnvVar(args.projectDir, envFile, envVar, keypair.privateKey);
+        try {
+            await client.call('SetOrgKeypair', {
+                params: { orgId: args.orgId },
+                body: {
+                    publicKey: keypair.publicKey,
+                    canEncryptResult,
+                    replace,
+                },
+            });
+        }
+        catch (err) {
+            if (old) {
+                upsertEnvVar(args.projectDir, envFile, envVar, old);
+            }
+            else {
+                removeEnvVar(args.projectDir, envFile, envVar);
+            }
+            if (!replace && isProblemError(err) && err.output.statusCode === 409) {
+                throw conflict('The org already has a different key. Ask the developer to '
+                    + 'choose: (a) reuse it: they paste its private key into '
+                    + `\`${envFile}\` as \`${envVar}\` themselves, never into the `
+                    + 'chat; (b) rotate it: call `issue_org_keypair` again with '
+                    + '`replace: true`, after which apps holding the old key can no '
+                    + 'longer decrypt new results; (c) turn off result encryption: '
+                    + 'call `update_org_keypair` with `canEncryptResult: false`, '
+                    + 'which keeps the key.');
+            }
+            throw err;
+        }
         return {
             orgId: args.orgId,
             address: keypair.address,
@@ -77,6 +121,27 @@ export function issueOrgKeypairTool(client) {
             envFile: path,
             envVar,
             reused: Boolean(existing),
+            backupFile: backupFile ?? null,
+            ...(replace && !backupFile && !old
+                ? {
+                    note: 'Nothing was backed up: the old private key is not in '
+                        + 'this file. Another app may hold it.',
+                }
+                : {}),
         };
+        async function currentCanEncryptResult() {
+            try {
+                const { data } = await client.call('GetOrgKeypair', {
+                    params: { orgId: args.orgId },
+                });
+                return data.canEncryptResult;
+            }
+            catch (err) {
+                if (isProblemError(err) && err.output.statusCode === 404) {
+                    return false;
+                }
+                throw err;
+            }
+        }
     });
 }

package/lib/mcp/tools/authenticate/issue-org-token.js

@@ -1,7 +1,7 @@
 import assert from 'node:assert';
 import { isAbsolute, relative, resolve } from 'node:path';
 import { defineTool } from "../../server.js";
-import { upsertEnvVar } from "./eth-key.js";
+import { backupEnvVar, readDotenvKey, upsertEnvVar } from "./eth-key.js";
 import { saveOrgKey } from "./org-key-store.js";
 /**
  * Issues an organization API key and stores it on disk, so the key never
@@ -15,7 +15,9 @@ export function issueOrgTokenTool(client) {
             + 'server env file in the project, so the app can read it at runtime. '
             + 'Also saves it on this machine for the org-key tools. Returns the '
             + 'org, file, variable, and last four characters; never the key. '
-            + 'Replaces an existing variable of the same name in the file. '
+            + 'Replaces an existing variable of the same name in the file, first '
+            + 'appending the old value to `<envFile>.backup` (gitignored); tell '
+            + 'the developer its path. '
             + 'Adds the file to .gitignore. Use when the app needs a key, or '
             + 'before `create_verification_session`.',
         inputSchema: {
@@ -48,6 +50,10 @@ export function issueOrgTokenTool(client) {
         const { data } = await client.call('IssueOrgToken', {
             params: { orgId: args.orgId },
         });
+        const old = readDotenvKey(resolve(args.projectDir, envFile), envVar);
+        const backupFile = old && old !== data.orgSecret
+            ? backupEnvVar(args.projectDir, envFile, envVar, 'replaced by issue_org_token')
+            : undefined;
         const path = upsertEnvVar(args.projectDir, envFile, envVar, data.orgSecret);
         saveOrgKey(args.orgId, data.orgSecret);
         return {
@@ -55,6 +61,7 @@ export function issueOrgTokenTool(client) {
             envFile: path,
             envVar,
             last4: data.last4,
+            backupFile: backupFile ?? null,
         };
     });
 }

package/lib/provider/draft.js

@@ -80,10 +80,11 @@ export function assertPortableMatches(matches, redactions, targets) {
     // proving an email's domain substring. Reject it regardless of the declared
     // targets (the local part is usually not itself a target, so the value scan
     // below wouldn't catch it). Strip params + named groups + regex escapes
-    // first, then look for `localpart@` as a surviving literal.
+    // first, then look for `localpart@` as a surviving literal. A placeholder
+    // never contains a brace, and `[^{}]` keeps the scan linear on `{{{{…`.
     const EMAIL_LOCAL_BAKED = /[A-Za-z0-9._%+-]{3,}@/;
     const deregex = (s) => s
-        .replace(/\{\{[^}]*\}\}/g, '')
+        .replace(/\{\{[^{}]*\}\}/g, '')
         .replace(/\(\?<[^>]*>[^)]*\)/g, '')
         .replace(/\\(.)/g, '$1');
     const scanEmail = (text, where) => {
@@ -110,7 +111,7 @@ export function assertPortableMatches(matches, redactions, targets) {
     if (!guarded.length) {
         return;
     }
-    const stripParams = (s) => s.replace(/\{\{[^}]*\}\}/g, '');
+    const stripParams = (s) => s.replace(/\{\{[^{}]*\}\}/g, '');
     const scan = (text, where, own) => {
         const bare = stripParams(text);
         for (const v of guarded) {

package/lib/provider/matcher.js

@@ -572,7 +572,7 @@ function stableOpeningTail(openTag) {
  *  content (the JSON body the attestor exposes when a jsonPath is paired with
  *  the script's xPath); otherwise undefined. */
 function scriptJsonContent(markup) {
-    const match = /^<script\b[^>]*>([\s\S]*)<\/script>\s*$/i.exec(markup);
+    const match = /^<script\b[^>]*>([\s\S]*)<\/script\b[^>]*>\s*$/i.exec(markup);
     if (!match) {
         return undefined;
     }

package/package.json

@@ -1,7 +1,7 @@
 {
 	"name": "@reclaimprotocol/agent",
 	"title": "Reclaim Agent",
-	"version": "0.1.38",
+	"version": "0.1.40",
 	"description": "Reclaim Protocol tools for AI coding agents. Reclaim lets your app verify data points about its users, such as a follower count, an account balance, or an order history. This package is the Reclaim MCP server: it gives your agent the tools to find, build, test, and fix data verification providers by capturing and replaying browser requests, drafting provider recipes, running zkTLS proofs, and publishing provider versions.",
 	"type": "module",
 	"main": "./lib/index.js",
@@ -84,7 +84,7 @@
 		"@noble/hashes": "^2.2.0",
 		"@puppeteer/browsers": "3.2.4",
 		"@reclaimprotocol/attestor-core": "^5.1.6",
-		"@reclaimprotocol/client": "0.1.38",
+		"@reclaimprotocol/client": "0.1.40",
 		"@reclaimprotocol/tls": "^0.1.3",
 		"chrome-remote-interface": "^0.33.0",
 		"domhandler": "^6.0.0",

package/samples/demo-server/package.json

@@ -8,6 +8,7 @@
   "dependencies": {
     "@reclaimprotocol/js-sdk": "^5.8.1",
     "dotenv": "^16.4.5",
-    "express": "^4.21.2"
+    "express": "^4.21.2",
+    "express-rate-limit": "^8.7.1"
   }
 }

package/samples/demo-server/server.js

@@ -1,4 +1,5 @@
 import express from "express";
+import { rateLimit } from "express-rate-limit";
 import "dotenv/config";
 import { ReclaimProofRequest, verifyProof } from "@reclaimprotocol/js-sdk";
 import { randomUUID } from "node:crypto";
@@ -9,8 +10,12 @@ const providerId = __PROVIDER_ID__;
 // Left unpinned by default — set this if you need to pin a specific version.
 const providerVersion = __PROVIDER_VERSION__;
 
-app.set("trust proxy", true);
+// One proxy hop (ngrok or a load balancer), so the rate limit below keys on
+// the client's address rather than the proxy's.
+app.set("trust proxy", 1);
 app.use(express.json({ limit: "2mb" }));
+// Every route verifies or creates something; cap each client's request rate.
+app.use(rateLimit({ windowMs: 60_000, limit: 60 }));
 
 app.get("/health", (_req, res) => {
   res.json({ ok: true });

package/skill/SKILL.builder.md

@@ -68,6 +68,12 @@ immediately with a `code` and `attachUrl` — it does NOT poll.
 The 2-day token is cached in `~/.reclaim/config.json` and reused on later runs
 (`RECLAIM_API_TOKEN` in the server env overrides it).
 
+### Backend mode
+
+`get_devtools_mode` reports the active mode. `set_devtools_mode` persists a
+switch to `~/.reclaim/config.json`, effective on the next server start. An
+explicit `USE_OLD_DEVTOOLS` env var wins.
+
 <!-- topic: devtools-migration -->
 ## Import providers from devtools
 
@@ -316,6 +322,14 @@ with no secrets/cookies, as an anonymous visitor.
 — **show it to the developer as a fenced JSON block at the end**, with the
 provider JSON. That's the final result.
 
+**Country.** `run_proof` sends the attestor's request from the developer's own
+IP country, which is what `{{DYNAMIC_GEO}}` becomes when they verify; `egress`
+in the result names the country. If a site that serves one country (for
+example, a US airline) blocks the attestor, retry once with
+`geoLocation: "US"`. If that verifies, pin it with
+`update_draft({ geoLocation: "US" })` so the published version goes out from
+there too.
+
 **`errorKind: "missing-owner-key"`** → no eth proof-owner key yet. Tell the
 developer what's happening and drive the bootstrap yourself — see topic
 `credentials`. No restart needed, and the existing `draftId` stays valid.
@@ -396,16 +410,17 @@ in, navigate to `initialUrl`; if a user script is present, run
 `test_user_script` with that script and `initialUrl`. When the existing capture
 has enough data, replay and prove every required request. Do not clear
 cookies or force another sign-in. Treat an unavailable or inconclusive retest as
-advisory and do not block publication. Ask whether the developer wants to keep
-the session for further edits; call `dispose_browser` only after they confirm.
-A `builder` session is quota-accounted, so don't leave it idle.
+advisory and do not block publication. Don't ask whether to close the
+browser. Mention once in the final summary that it stays open for provider
+changes and you can close it on request; call `dispose_browser` only when the
+developer says so. A `builder` session is quota-accounted, so close it as soon
+as they say the work is done.
 
 <!-- topic: discover -->
 ## Discover and resolve existing providers
 
-Use this flow only when the developer asks to reuse existing providers or
-doesn't know what a site supports. Otherwise build a new provider (server
-instructions, "Choose the provider").
+Use this flow only when the developer asks to reuse existing providers, names
+one, or doesn't know what a site supports. Otherwise build a new provider.
 
 1. Ask which website their users prove data from.
 2. `discover_data_points({ domain })` → what's verifiable there. Confirm the
@@ -415,13 +430,17 @@ instructions, "Choose the provider").
    any `uncovered` points (author those with the checklist in topic
    `overview`, then re-resolve).
 4. Use only the data points the developer confirmed: show and read only those
-   and ignore the rest. A provider that needs any change gets your own copy
-   (server instructions, "Choose the provider"). Otherwise it's usable as-is;
-   don't capture, replay, or prove it unless the developer asks.
+   and ignore the rest. A provider that needs any change (a missing data point, extra inputs, a different extraction) gets your own copy
+   (`create_provider_version` when your org owns it; otherwise
+   `create_provider`, then `create_provider_version` from a copy of its
+   config, trimmed to the requested data points). Otherwise it's published and
+   usable as-is; don't capture, replay, or prove it unless the developer asks.
+   When a requirement (site, account, or value) is ambiguous, ask one concise
+   question; don't guess.
 5. To try them: `create_verification_session({ providers: [{ providerId }, …],
    context, verificationClientUrl })` with EVERY resolved provider id and the
-   collected context. The server instructions ("Try a provider without an
-   app") cover the callback and polling. To integrate: topic `integration`.
+   collected context. Topic `integration` ("Try a provider without an app")
+   covers the callback and polling, and the integration steps.
 
 `merge.mergeable` only signals the set *could* collapse into one provider. Pass
 them all; the Builder runs them in one session.

package/skill/SKILL.old.md

@@ -74,6 +74,14 @@ and are NOT interchangeable.
 `reclaim_authenticate` ran earlier, the old-devtools token has expired — re-run
 it. Don't assume `authenticate_builder` fixes it.
 
+### Backend mode
+
+The BUILDER backend (generated API tools, orgs, verification sessions, public
+review) is one switch away. `get_devtools_mode` reports the active mode and
+why; `set_devtools_mode` persists a switch to `~/.reclaim/config.json`,
+effective on the NEXT server start. An explicit `USE_OLD_DEVTOOLS` env var wins
+over the persisted choice.
+
 <!-- topic: browser -->
 <!-- common: browser -->
 
@@ -320,8 +328,17 @@ applies them.
 There's no create-then-version step and no org / public-review workflow here.
 When done, tell the developer the version is live, then ask once how they want
 to use it — try it now, integrate it into an existing backend or frontend, or
-create a new app — unless they already said (see "Using a provider" in the
-server instructions).
+create a new app — unless they already said:
+
+> Want to (1) try it right now here, (2) integrate it into an existing backend
+> or frontend (this directory or another path), or (3) create a new app for it?
+
+Try it now → `scaffold_reclaim_demo_server` with its `providerId`. Integrate,
+or new app → `get_js_sdk_integration_guide`, then work in the path they named.
+
+A provider found with `get_me_providers` or `get_provider_info` is published
+and usable as-is. Don't capture, `replay_request`, or `run_proof` against it
+unless the developer asks you to check or test it.
 
 **If the response includes `_notes` for an attached browser, follow them for an
 optional authenticated-state retest.** Only when its profile is still signed in,
@@ -329,9 +346,10 @@ navigate to `initialUrl`; if `customInjection` is present, run
 `test_user_script` with that script and `initialUrl`. When the existing capture
 has enough data, replay and prove every required request. Do not clear
 cookies or force another sign-in. Treat an unavailable or inconclusive retest as
-advisory and do not block the completed provider. Ask whether the developer
-wants to keep the session for further edits; call `dispose_browser` only after
-they confirm.
+advisory and do not block the completed provider. Don't ask whether to close the
+browser. Mention once in the final summary that it stays open for provider
+changes and you can close it on request; call `dispose_browser` only when the
+developer says so.
 
 <!-- topic: never-do -->
 ## Things to never do

package/skill/builder-mode.md

@@ -1,186 +1,51 @@
 # Builder mode
 
-Reclaim provider-authoring tools run against the Builder backend: generated
-Builder API tools, credential and verification helpers, and browser authoring
-tools.
+Provider-authoring and verification tools for the Builder backend.
 
-**A provider is a recipe for extracting a data point from a site. A
-verification is an end-user session that proves a data point with a provider.
-Never call a provider a "verification."**
+**A provider is a recipe for extracting a data point from a site. A verification is an end-user session that proves a data point with a provider. Never call a provider a "verification."**
 
-## What the developer wants
+## Routing
 
-- **"Add Reclaim to my app" or similar:** call `start_integration` first and
-  follow the plan it returns. Don't ask what they want to do with the result.
-- **A claim they describe** (for example, "prove the user is over 18 on
-  example.com"): build a new org-private provider for exactly that claim. See
-  "Choose the provider".
-- **Intent unclear:** ask one short question.
+- "Add Reclaim to my app" or similar: call `start_integration` first and follow its plan. Don't ask what they want to do with the result.
+- A claim they describe (for example, "prove the user is over 18 on example.com"): build a new org-private provider for exactly that claim. Use an existing provider only when they name one or ask to reuse one (topic `discover`).
+- Intent unclear: ask one short question.
 
-### Work order
+## Authoring rules
 
-Do the steps that need the developer first: sign in to Builder, attach the
-browser, capture, and prove the provider. They show early whether a proof is
-possible on the site. Write app code after the proof works, or while you wait
-on the developer.
+- Do the steps that need the developer first (sign in, attach the browser, capture, prove). Write app code after the proof works, or while you wait.
+- Call `attach_browser()` with no arguments. Don't ask which browser to use.
+- Propose only the data points the claim needs.
+- Provider versions are immutable: every change creates a new version.
 
-### Asking the developer
+## Asking the developer
 
-When you need an answer or an action from the developer before you can
-continue, end your turn with the question. Don't ask a blocking question
-through a background or asynchronous question tool: the developer may never
-see it. Put every link they need, such as a sign-in or verification URL, in
-that same message.
+- When you need an answer or an action, end your turn with the question. Don't use a background or asynchronous question tool: the developer may never see it.
+- Put every link they need, such as a sign-in or verification URL, in that same message.
+- Ask each question once. Act on the answer; don't ask again.
 
-### Choose the provider
+## Permission blocks
 
-Default: build a new provider for the claim the developer described. Use an
-existing provider only when they name one or ask to reuse one.
+When a permission check blocks a tool call or command:
 
-With an existing provider, use only the data points the developer asked for.
-Show the developer only those, collect only the inputs they need, and read
-only those from results. Ignore the provider's other data points.
-
-Make your own copy when it needs any change, for example it lacks a requested
-data point, requires inputs the developer didn't ask for, or extracts a value
-differently:
-
-- Your org owns it: create a new provider version.
-- Another org owns it: `create_provider`, then `create_provider_version` from a
-  copy of its config, trimmed to the requested data points.
-
-Requirement ambiguous (site, account, or value): ask one concise question.
-Don't guess.
-
-A provider used as-is is published and ready. Don't capture, `replay_request`,
-or `run_proof` against it unless the developer asks.
-
-### Try a provider without an app
-
-Session creation returns 409 while the org has no callback subscription.
-`read_callback_events` creates the org's pull listener, which satisfies that
-check and holds results for you to read. No tunnel or public URL is needed.
-
-1. Call `read_callback_events`.
-2. `create_verification_session`, then give the developer `verificationUrl`.
-3. Poll `get_verification_session` until it is terminal.
-   `list_verification_events` shows progress. Don't read the hosted
-   verification page for progress: it streams the site as an image, so text
-   and DOM checks of it come back empty.
-4. Call `read_callback_events({ sessionId })` for the verified result.
-
-When you set up a new provider build, call `check_attestor` once. If it fails,
-tell the developer before they spend time on the build.
+1. Don't retry it or work around it.
+2. In one message, name the blocked tool or command, what it does, and what approving it means.
+3. Ask for approval in words that name that exact action, for example: "Approve running `npm run dev` to start the example app?" A vague question doesn't cover it.
 
 ## Secrets
 
-- Never print, echo, or ask the developer to paste an org key (`rorg_…`) or
-  private key.
-- `issue_org_token` writes the key to the project's env file
-  (`RECLAIM_ORG_SECRET`) and returns only its last four characters. Session
-  and org-token tools use that key when you omit `orgToken`.
-- `issue_credentials` and `import_credentials({ keyFile })` write the proof
-  owner key to the env file. Use these tools, not shell commands that read
-  secret files.
-
-## Integrating into an app
-
-Call `start_integration` and follow its order: prove the provider first, then
-write app code. Read `how_it_works({ topic: "integration" })`
-for the HTTP session workflow, the `api=2` boundary, result verification, and
-TEE binding. Edit the app with your file tools. Use the HTTP API
-(`POST /verifications/sessions`, open `verificationUrl`, poll
-`GET /verifications/sessions/{sessionId}`, read the callback) rather than
-`@reclaimprotocol/client`. The only exception is `results.receive` on the
-callback, or when the developer asks for the client package.
-
-The app's frontend renders every state and every failure, never only a
-spinner. Follow "UI states" in `how_it_works({ topic: "integration" })`. The
-callback route responds `error.retryable ? 503 : 200` for a thrown
-`ResultVerificationError`; a result that failed verification gets 2xx.
-
-For local development, call `proxy_callback_events({ port, path })` to forward
-events to the app's callback route on localhost. The local listener works only
-while this MCP server runs. It keeps events in order per session and retries
-a session the app rejects with backoff, so other sessions keep flowing. When
-its status lists `blocked` sessions, read that session's callback route
-response and logs, and fix the app. Production needs a webhook:
-`create_org_callback_subscription` with the deployed app's public URL. Without
-one, session creation returns 409.
-
-Management tools (`list_orgs`, `create_org_callback_subscription`,
-`issue_org_token`) use the developer's sign-in. Session tools
-(`create_verification_session`, `get_verification_session`,
-`list_verification_events`, `list_verification_deliveries`,
-`retry_verification_callback`, `read_callback_events`,
-`proxy_callback_events`) are the production API and use the org key.
-
-**Existing `@reclaimprotocol/js-sdk` projects.** If `package.json` depends on
-`@reclaimprotocol/js-sdk`, ask first:
-
-> This project uses `@reclaimprotocol/js-sdk`. Keep it (I switch this MCP
-> server to legacy devtools mode), or migrate to the Builder HTTP API?
-
-- **Keep:** `set_devtools_mode({ mode: "old" })`, then tell them to restart or
-  reconnect the MCP server. An explicit `USE_OLD_DEVTOOLS` env var overrides
-  it. After the restart, read `get_js_sdk_integration_guide`.
-- **Migrate:** stay in Builder mode and follow topic `integration`.
-
-## Authoring a provider
-
-Provider versions are immutable. Every change creates a new semantic version
-(default: patch bump; larger only when the developer directs). Never use an
-in-place update or archive tool.
-
-**The flow:** `attach_browser` → `start_capture` ⇒ `captureId` → sign in →
-navigation script (`test_user_script` with `keep: true`) → capture through the
-script → `find_requests_containing` → `propose_provider` ⇒ `draftId` →
-`replay_request` → `run_proof` → `create_provider_version_from_capture` →
-`publish_provider_version` (private) or `submit_provider_version_for_review`
-(public). Get the checklist from `how_it_works({ topic: "overview" })`.
-
-- **Data points:** propose only values the claim needs, usually one or two.
-  Never add identity or profile fields. Name each for what it proves.
-- **Browser:** call `attach_browser()` with no arguments. It opens a visible
-  local browser with the persistent Reclaim profile, and falls back to Chrome
-  for Testing itself when no installed browser can be attached. Don't ask
-  which browser or who signs in. Use another `mode` only when that fails too,
-  or when the developer explicitly asks for it (topic `browser`). Tell the
-  developer once, as a side note, that a shareable link can be set up if a
-  volunteer is helping them sign in; don't ask about it or set it up unless
-  they ask.
-- **Public endpoints:** after `replay_request` succeeds, re-run it with
-  `withoutSecrets: true`. If the value still extracts, the endpoint is public
-  and the proof binds to nobody. Find an auth-bound request.
-- **Country:** `run_proof` sends the attestor's request from the developer's
-  own IP country, which is what `{{DYNAMIC_GEO}}` becomes when they verify;
-  `egress` in the result says which country. If a site that serves one
-  country (for example, a US airline) blocks the attestor, retry once with
-  `geoLocation: "US"`. If that verifies, pin it with
-  `update_draft({ geoLocation: "US" })` so the published version goes out
-  from there too.
-- **Drafting limits** (topics `draft`, `params`): never `hash` a value that
-  also appears in the request URL. A param named with `SECRET` may appear in a
-  URL only within a small character budget (2 under `key-update`, 12 under
-  `zk`).
+- Never print, echo, or ask the developer to paste an org key (`rorg_…`) or private key.
+- `issue_org_token` writes the org key to the project's env file (`RECLAIM_ORG_SECRET`) and returns only its last four characters. `issue_credentials` and `import_credentials({ keyFile })` write the proof-owner key there. Use these tools, not shell commands that read secret files.
 
 ## Evidence contract
 
-Tool results are the source of truth. Never say a browser attached, a user
-signed in, a request was captured, a proof passed, or a version was created or
-published unless a tool result says so.
+Tool results are the source of truth. Never say a browser attached, a user signed in, a request was captured, a proof passed, or a version was created or published unless a tool result says so.
 
-Treat every ID, version, URL, and value as opaque: copy it from the latest tool
-result. Never invent or reconstruct one. When state is unclear, call the
-relevant get/list tool or `how_it_works`. State uncertainty plainly.
+Treat every ID, version, URL, and value as opaque: copy it from the latest tool result. Never invent or reconstruct one. When state is unclear, call the relevant get/list tool or `how_it_works`. State uncertainty plainly.
 
-**Guide:** `how_it_works({})` lists topics. Fetch only the one for your next
-step.
+## Guide
 
-**Authentication:** call `get_me`. On 401, `authenticate({})` returns `code`
-and `attachUrl`. Give the developer the URL, then poll `authenticate({ code })`
-until LINKED (topic `auth`).
+`how_it_works({})` lists topics. Fetch only the one for your next step:
 
-**Backend mode:** `get_devtools_mode` reports the active mode.
-`set_devtools_mode` persists a switch to `~/.reclaim/config.json`, effective on
-the next server start. An explicit `USE_OLD_DEVTOOLS` env var wins.
+- `overview`: authoring checklist; `prove`, `publish`, `browser`: the details behind each step.
+- `integration`: app integration, trying a session without an app, existing `@reclaimprotocol/js-sdk` projects.
+- `auth`: sign-in (`get_me`, then `authenticate` on 401) and backend mode.