From 874d8772ad467aae035241949c8add500c2852ec Mon Sep 17 00:00:00 2001 From: chrisjleal <184772742+chrisjleal@users.noreply.github.com> Date: Sat, 24 Oct 2026 18:56:47 -0500 Subject: [PATCH 1/6] The changelog describes a plugin, not a bundle that no longer exists The submission artifact is protocol/mcp/chatgpt-app.json, generated from the served surface. The reader-facing entry said bundle. --- CHANGELOG.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 9b71a01..2ac650d 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -15,7 +15,7 @@ Product release notes: [docs.proofable.me/changelog](https://docs.proofable.me/c ### Changed -- **Dedicated ChatGPT plugin endpoint.** The ChatGPT bundle connects to `https://mcp.proofable.me/mcp/openai`, which serves the eight read and guided-verification tools with the same OAuth sign-in; `proofable_verify_or_guide` returns the hosted link whenever a verification step is needed. Cursor, Claude Code, Codex, and every other client keep the full tool list on `/mcp`. +- **Dedicated ChatGPT plugin endpoint.** The ChatGPT plugin connects to `https://mcp.proofable.me/mcp/openai`, which serves the eight read and guided-verification tools with the same OAuth sign-in; `proofable_verify_or_guide` returns the hosted link whenever a verification step is needed. Cursor, Claude Code, Codex, and every other client keep the full tool list on `/mcp`. ## [0.1.7] - 2026-10-10 From 1c7330748e732bb4feeaf6e79442e240b7061b7e Mon Sep 17 00:00:00 2001 From: chrisjleal <184772742+chrisjleal@users.noreply.github.com> Date: Sat, 24 Oct 2026 20:52:30 -0500 Subject: [PATCH 2/6] The published card carries the trust layer: 12 tools, no vault Regenerated from the protocol registry after the platform runtime left the hosted surface. The card no longer advertises secrets, jobs, the browser, connected apps or web search, and it now matches what a connection is actually offered. --- server.json | 12 ------------ 1 file changed, 12 deletions(-) diff --git a/server.json b/server.json index 63f1eca..07b7fef 100644 --- a/server.json +++ b/server.json @@ -85,18 +85,6 @@ { "name": "proofable_agent_mount", "description": "Load the agent identity, permissions, skills, and context into this project." - }, - { - "name": "proofable_secret_create", - "description": "Encrypt and save one secret in the Vault for the signed-in profile. Saving the same alias again replaces and revokes its prior value. Returns metadata only; the stored value is never returned." - }, - { - "name": "proofable_secret_list", - "description": "List saved secret names, types, and update times without exposing their values." - }, - { - "name": "proofable_secret_revoke", - "description": "Revoke a saved secret so it can no longer be used." } ], "license": "Apache-2.0", From 2a172c620d1c500baafa82f84d1bcd6435be6a26 Mon Sep 17 00:00:00 2001 From: chrisjleal <184772742+chrisjleal@users.noreply.github.com> Date: Sat, 24 Oct 2026 20:54:18 -0500 Subject: [PATCH 3/6] The changelog says what a connection carries A breaking change for anyone already calling a runtime tool from a client: it now answers platform_only. Say so where a reader looks, in terms of what they get. --- CHANGELOG.md | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 2ac650d..5f93d93 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -15,7 +15,9 @@ Product release notes: [docs.proofable.me/changelog](https://docs.proofable.me/c ### Changed -- **Dedicated ChatGPT plugin endpoint.** The ChatGPT plugin connects to `https://mcp.proofable.me/mcp/openai`, which serves the eight read and guided-verification tools with the same OAuth sign-in; `proofable_verify_or_guide` returns the hosted link whenever a verification step is needed. Cursor, Claude Code, Codex, and every other client keep the full tool list on `/mcp`. +- **The hosted surface carries the trust layer.** `https://mcp.proofable.me/mcp` serves the proof and permission tools — prove something once, reuse the proof, hold an agent to a permission you can revoke — and no longer serves work that runs on the Proofable platform: background and scheduled jobs, the hosted browser, connected apps, a saved provider key, remote MCP servers, web search and page fetch, or the encrypted vault. Those run in Proofable itself, where the run holds its own permission and a human approves side effects; a call to one from a connection answers `platform_only`. Saving or revoking a key happens on your profile, so a credential is never passed through a client. `tools/list` and the published card both stop at the trust layer. + +- **Dedicated ChatGPT plugin endpoint.** The ChatGPT plugin connects to `https://mcp.proofable.me/mcp/openai`, which serves the eight read and guided-verification tools with the same OAuth sign-in; `proofable_verify_or_guide` returns the hosted link whenever a verification step is needed. Cursor, Claude Code, Codex, and every other client see the trust-layer tool list on `/mcp`. ## [0.1.7] - 2026-10-10 From d643b48ae7524a7d235d10295629c3cf5783ba6d Mon Sep 17 00:00:00 2001 From: chrisjleal <184772742+chrisjleal@users.noreply.github.com> Date: Sat, 24 Oct 2026 21:05:39 -0500 Subject: [PATCH 4/6] The skill and the listing stop teaching the vault The bundled skill told an agent to store secrets with proofable_secret_create and to never paste tokens into chat in consecutive lines, and the README listed the vault as a connection capability. Saving a key is a profile action in Proofable; the connection surface carries no tool that accepts a credential. --- README.md | 1 - .../proofable-mcp/skills/proofable-trust-workflow/SKILL.md | 4 ++-- skills/proofable-trust-workflow/SKILL.md | 4 ++-- 3 files changed, 4 insertions(+), 5 deletions(-) diff --git a/README.md b/README.md index d3eb71d..09b6971 100644 --- a/README.md +++ b/README.md @@ -70,7 +70,6 @@ Install one Proofable connection per client. A marketplace plugin and a manual e | Find and read proofs | `proofable_proofs_get` | | Update proof metadata or add feedback | `proofable_proofs_update` | | Check, create, and load agent permissions | `proofable_agent_link`, `proofable_agent_create`, `proofable_agent_mount` | -| Save, list, and revoke encrypted secrets | `proofable_secret_create`, `proofable_secret_list`, `proofable_secret_revoke` | Call `proofable_context` once after connecting. Proofable then reuses current proofs before starting another verification and returns **Passed**, **Action needed**, or **Blocked**. diff --git a/plugins/proofable-mcp/skills/proofable-trust-workflow/SKILL.md b/plugins/proofable-mcp/skills/proofable-trust-workflow/SKILL.md index d67f1cf..10f76a8 100644 --- a/plugins/proofable-mcp/skills/proofable-trust-workflow/SKILL.md +++ b/plugins/proofable-mcp/skills/proofable-trust-workflow/SKILL.md @@ -28,7 +28,7 @@ Use this before an assistant runs sensitive tools or takes another verification- 3. **Trust before action:** use **`proofable_verify_or_guide`** directly. It reuses qualifying proofs or returns the next secure step. Use **`proofable_proofs_check`** only for an explicit yes/no eligibility, gate, or access question; never use it for memory, context, or content retrieval. When signed in, ownership checks continue with **`proofable_verify`**. For another signer, prepare with **`proofable_verify_prepare`** and submit with **`proofable_verify_submit`**. Share a browser link only when a tool returns one. 4. **Agent:** **`proofable_agent_link`**. If missing, **`proofable_agent_create`** (a dedicated account needs a key you create and hold; pass only its public address). Then **`proofable_agent_mount`**. 5. **Proofs and context:** use the `proofable_context` context index first, then **`proofable_proofs_get`** with a known proof ID and `include=content` for an exact body. -6. **Vault:** **`proofable_secret_list`** / **`proofable_secret_create`** / **`proofable_secret_revoke`**. +6. **Saved keys:** a credential belongs on the profile in Proofable, never in a conversation and never through a tool. Do not offer to store one from here. 7. Reuse existing proofs via **`proofable_verify_or_guide`** before creating new ones. When signed in, `proofable_context` returns the current profile context; re-call it only after a profile change. 8. Summarize as **Proofable**. @@ -46,7 +46,7 @@ Proofable: Blocked. A required trust condition was not satisfied. Next: Do not c - Proofs stay off the chain unless the user asks for a blockchain record. Do not prompt for a wallet otherwise. - Use proof IDs only from tool responses. Prefer “proof ID” / “portable proof” in user text. -- Store secrets only via **`proofable_secret_create`**. Confirm stored name + proof ID. Never paste tokens into chat. +- Never ask for a credential and never accept one. A key is saved on the profile in Proofable, where a run uses it without the value reaching a model or an app. This connection carries no tool that stores a secret; a call to one answers `platform_only`. - Use live verifier IDs from **`proofable_context`** / **`proofable_verifiers_catalog`**. Do not hardcode a second catalog. ## Setup and mount diff --git a/skills/proofable-trust-workflow/SKILL.md b/skills/proofable-trust-workflow/SKILL.md index d67f1cf..10f76a8 100644 --- a/skills/proofable-trust-workflow/SKILL.md +++ b/skills/proofable-trust-workflow/SKILL.md @@ -28,7 +28,7 @@ Use this before an assistant runs sensitive tools or takes another verification- 3. **Trust before action:** use **`proofable_verify_or_guide`** directly. It reuses qualifying proofs or returns the next secure step. Use **`proofable_proofs_check`** only for an explicit yes/no eligibility, gate, or access question; never use it for memory, context, or content retrieval. When signed in, ownership checks continue with **`proofable_verify`**. For another signer, prepare with **`proofable_verify_prepare`** and submit with **`proofable_verify_submit`**. Share a browser link only when a tool returns one. 4. **Agent:** **`proofable_agent_link`**. If missing, **`proofable_agent_create`** (a dedicated account needs a key you create and hold; pass only its public address). Then **`proofable_agent_mount`**. 5. **Proofs and context:** use the `proofable_context` context index first, then **`proofable_proofs_get`** with a known proof ID and `include=content` for an exact body. -6. **Vault:** **`proofable_secret_list`** / **`proofable_secret_create`** / **`proofable_secret_revoke`**. +6. **Saved keys:** a credential belongs on the profile in Proofable, never in a conversation and never through a tool. Do not offer to store one from here. 7. Reuse existing proofs via **`proofable_verify_or_guide`** before creating new ones. When signed in, `proofable_context` returns the current profile context; re-call it only after a profile change. 8. Summarize as **Proofable**. @@ -46,7 +46,7 @@ Proofable: Blocked. A required trust condition was not satisfied. Next: Do not c - Proofs stay off the chain unless the user asks for a blockchain record. Do not prompt for a wallet otherwise. - Use proof IDs only from tool responses. Prefer “proof ID” / “portable proof” in user text. -- Store secrets only via **`proofable_secret_create`**. Confirm stored name + proof ID. Never paste tokens into chat. +- Never ask for a credential and never accept one. A key is saved on the profile in Proofable, where a run uses it without the value reaching a model or an app. This connection carries no tool that stores a secret; a call to one answers `platform_only`. - Use live verifier IDs from **`proofable_context`** / **`proofable_verifiers_catalog`**. Do not hardcode a second catalog. ## Setup and mount From a17c691b9bc4e3a093332cda92d9f37f2ae212e0 Mon Sep 17 00:00:00 2001 From: chrisjleal <184772742+chrisjleal@users.noreply.github.com> Date: Sat, 24 Oct 2026 21:26:36 -0500 Subject: [PATCH 5/6] Public copy: the changelog entry loses its em dashes --- CHANGELOG.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 5f93d93..07a5cf7 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -15,7 +15,7 @@ Product release notes: [docs.proofable.me/changelog](https://docs.proofable.me/c ### Changed -- **The hosted surface carries the trust layer.** `https://mcp.proofable.me/mcp` serves the proof and permission tools — prove something once, reuse the proof, hold an agent to a permission you can revoke — and no longer serves work that runs on the Proofable platform: background and scheduled jobs, the hosted browser, connected apps, a saved provider key, remote MCP servers, web search and page fetch, or the encrypted vault. Those run in Proofable itself, where the run holds its own permission and a human approves side effects; a call to one from a connection answers `platform_only`. Saving or revoking a key happens on your profile, so a credential is never passed through a client. `tools/list` and the published card both stop at the trust layer. +- **The hosted surface carries the trust layer.** `https://mcp.proofable.me/mcp` serves the proof and permission tools (prove something once, reuse the proof, hold an agent to a permission you can revoke), and no longer serves work that runs on the Proofable platform: background and scheduled jobs, the hosted browser, connected apps, a saved provider key, remote MCP servers, web search and page fetch, or the encrypted vault. Those run in Proofable itself, where the run holds its own permission and a human approves side effects; a call to one from a connection answers `platform_only`. Saving or revoking a key happens on your profile, so a credential is never passed through a client. `tools/list` and the published card both stop at the trust layer. - **Dedicated ChatGPT plugin endpoint.** The ChatGPT plugin connects to `https://mcp.proofable.me/mcp/openai`, which serves the eight read and guided-verification tools with the same OAuth sign-in; `proofable_verify_or_guide` returns the hosted link whenever a verification step is needed. Cursor, Claude Code, Codex, and every other client see the trust-layer tool list on `/mcp`. From 882c4c56c9becf8d659d8ac201637735fe5bb3f1 Mon Sep 17 00:00:00 2001 From: chrisjleal <184772742+chrisjleal@users.noreply.github.com> Date: Sat, 24 Oct 2026 21:29:44 -0500 Subject: [PATCH 6/6] The skill stops advertising the vault in the field an agent reads The frontmatter description is what a host shows the model when deciding whether to load the skill; it said 'managing Vault secrets'. The trigger list inside said 'proofs, Vault, or trusted-agent setup'. Both now describe the trust layer: identity, permissions, reusable proofs, and scoping what an agent may do. --- .../proofable-mcp/skills/proofable-trust-workflow/SKILL.md | 4 ++-- skills/proofable-trust-workflow/SKILL.md | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/plugins/proofable-mcp/skills/proofable-trust-workflow/SKILL.md b/plugins/proofable-mcp/skills/proofable-trust-workflow/SKILL.md index 10f76a8..4a3b1e5 100644 --- a/plugins/proofable-mcp/skills/proofable-trust-workflow/SKILL.md +++ b/plugins/proofable-mcp/skills/proofable-trust-workflow/SKILL.md @@ -1,6 +1,6 @@ --- name: proofable-trust-workflow -description: Verifies identity, permissions, and reusable proofs before sensitive assistant actions. Use when confirming authority, loading a trusted agent, managing Vault secrets, or when the user asks for Proofable. +description: Verifies identity, permissions, and reusable proofs before sensitive assistant actions. Use when confirming authority, loading a trusted agent, scoping what it may do, or when the user asks for Proofable. license: Apache-2.0 compatibility: Requires a client that supports remote HTTP MCP servers and hosted OAuth. metadata: @@ -18,7 +18,7 @@ Use this before an assistant runs sensitive tools or takes another verification- ## When to use - Before sensitive tools, spend, publish, secrets, or agent actions -- When the user asks for Proofable, proofs, Vault, or trusted-agent setup +- When the user asks for Proofable, proofs, agent permissions, or trusted-agent setup - When acting as a registered profile agent in a project ## Workflow diff --git a/skills/proofable-trust-workflow/SKILL.md b/skills/proofable-trust-workflow/SKILL.md index 10f76a8..4a3b1e5 100644 --- a/skills/proofable-trust-workflow/SKILL.md +++ b/skills/proofable-trust-workflow/SKILL.md @@ -1,6 +1,6 @@ --- name: proofable-trust-workflow -description: Verifies identity, permissions, and reusable proofs before sensitive assistant actions. Use when confirming authority, loading a trusted agent, managing Vault secrets, or when the user asks for Proofable. +description: Verifies identity, permissions, and reusable proofs before sensitive assistant actions. Use when confirming authority, loading a trusted agent, scoping what it may do, or when the user asks for Proofable. license: Apache-2.0 compatibility: Requires a client that supports remote HTTP MCP servers and hosted OAuth. metadata: @@ -18,7 +18,7 @@ Use this before an assistant runs sensitive tools or takes another verification- ## When to use - Before sensitive tools, spend, publish, secrets, or agent actions -- When the user asks for Proofable, proofs, Vault, or trusted-agent setup +- When the user asks for Proofable, proofs, agent permissions, or trusted-agent setup - When acting as a registered profile agent in a project ## Workflow