Proof CLI (unofficial)

io.github.tsarleweyPublished by GitHub account tsarleweyv0.4.1Updated Nov 8, 2026

Notarize, e-sign, and verify identity with the Proof API. Unofficial; not affiliated with Proof.

The publisher's own server: Proof Holdings

VerifiedSTDIODesktop onlyDeveloper ToolsSecurity & MonitoringBusiness & Commerce

Overview

AI-generated overview

Unofficial MCP server that exposes the Proof API so an assistant can create and manage notarization, e-signature and identity-verification transactions.

What you can do
  • List, create, update, activate, cancel and delete business transactions, and add, fetch or delete their documents
  • Manage webhooks, notaries, templates, cost centers, referrals and integrations
  • Work with real-estate and mortgage transactions, documents, webhooks and address verification
  • Administer SCIM users and schemas per organization
  • Read OCSF security event logs, and issue, sign with or revoke certificates
  • Generate verifiable-credential authorization URLs for end-user browser redirects
When to use it
Use it when you want an assistant to drive Proof notarization or e-signature workflows from chat: drafting and activating signing transactions, attaching documents, checking status, or managing notaries and webhooks. It is also useful for reading Proof security logs and certificates.
Requirements
Runs locally as a stdio process, typically via the published container image or the proof binary on your PATH. Needs a Proof account with API usage and a PROOF_API_KEY (or OAuth client credentials configured through the CLI). PROOF_API_ENDPOINT can point at the sandbox instead of production.
Before you install
The API key grants access to real notarization, signing and identity-verification data, and many tools are marked destructive: they create, activate, cancel or delete transactions, documents, users, webhooks and certificates. Start with the read-only mode and the sandbox endpoint while testing. This is an alpha, unofficial project not affiliated with Proof. Signing and certificate operations act on real documents and keys.

Installation

In SourceWeft

  1. Open Proof CLI (unofficial) in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

Proof CLI

An unofficial command-line interface for interacting with the Proof API. The Proof CLI provides access to Business, Real Estate, and SCIM APIs through a unified interface.

This is an alpha product and should be treated as such. It is not an official product from Proof.

Installation

Prebuilt binary

bash
# macOS / Linux: downloads the latest release for your OS and CPU into the current directorycurl -sL "https://github.com/tsarlewey/proof-cli/releases/latest/download/proof_$(uname -s | tr A-Z a-z)_$(uname -m | sed 's/x86_64/amd64/;s/aarch64/arm64/').tar.gz" | tar xz proof./proof version

Windows zips and checksums are on the Releases page.

Install via Go

bash
go install github.com/tsarlewey/proof-cli@latest

From Source

bash
git clone https://github.com/tsarlewey/proof-cli.gitcd proof-cligo build -o proof./proof --help

Use with AI agents

Claude Code plugin (bundles a usage skill and the MCP server; needs proof on your PATH):

/plugin marketplace add tsarlewey/proof-cli/plugin install proof@proof

MCP server for any MCP client. proof mcp exposes every API command as a tool over stdio, annotated read-only or destructive:

bash
claude mcp add proof -- proof mcp               # Claude Codeclaude mcp add proof -- proof mcp --read-only   # only tools that don't change anything

For other clients, run the command proof mcp. It reads credentials the same way as the CLI (PROOF_API_KEY or proof config).

Docker, with nothing installed locally. The image runs proof mcp and is listed in the MCP Registry as io.github.tsarlewey/proof-cli:

bash
docker run -i --rm -e PROOF_API_KEY -e PROOF_API_ENDPOINT=https://api.fairfax.proof.com ghcr.io/tsarlewey/proof-cli

Arguments after the image name go to proof mcp, e.g. --read-only. PROOF_API_ENDPOINT overrides the configured endpoint in any mode; leave it unset for production.

Agents using the shell can follow skills/proof/SKILL.md. Output is JSON (--pretty=false for compact), and API errors exit 1 with the response body on stderr. Point at the sandbox while testing: proof config set-endpoint https://api.fairfax.proof.com.

Getting Started

1. Configuration

Before using the CLI, you need to configure your API key:

bash
# Set your API keyproof config set-api-key YOUR_API_KEY
# Or set via environment variableexport PROOF_API_KEY=YOUR_API_KEY
# Verify your configurationproof config get

In order to get an API Key, you'll need an account with API Usage. You can get that here - https://www.proof.com/pricing#business

After your account is created and upgrade use https://dev.proof.com/docs/api-keys to setup your key.

OAuth 2.0 Authentication

The CLI supports OAuth 2.0 client credentials flow for secure API authentication:

bash
# Configure OAuth credentialsproof config set-oauth <client-id> <client-secret> [--scope="read write"]
# Test OAuth authenticationproof config test-oauth
# Disable OAuth (fallback to API key)proof config disable-oauth

OAuth tokens are automatically refreshed before expiration (5-minute buffer).

2. Basic Usage

The CLI is organized into three main API groups:

  • business - Business API operations (transactions, documents, webhooks, notaries, etc.)
  • real-estate - Real Estate/Mortgage API operations
  • scim - SCIM API operations for user management
bash
# Get help for any commandproof --helpproof business --helpproof real-estate --helpproof scim --help

API Reference

Business API

The Business API provides comprehensive transaction and document management capabilities.

Transactions
bash
# List all transactionsproof business transactions list
# List with filteringproof business transactions list --limit 10 --status completed
# Get a specific transactionproof business transactions get <transaction-id>
# Create a new transactionproof business transactions create \  --email "[email protected]" \  --first-name "John" \  --last-name "Doe" \  --document "/path/to/document.pdf" \  --name "Contract Signing" \  --draft
# Multiple documents, scheduled notary meeting, and a redirectproof business transactions create \  --email "[email protected]" \  --document "/path/to/deed.pdf" \  --document "/path/to/rider.pdf" \  --notary-meeting-time "2026-09-02T15:30:00Z" \  --allowed-notary-states "CA,NY" \  --notary-note "Verify the property address" \  --payer sender \  --idv-use-case ACCOUNT_RECOVERY \  --recipient-details-config "name=locked" \  --redirect-url "https://example.com/done"
# Multiple signers, from a JSON file holding an array of signer objects# (max 10, each needs at least an email). --email stays the primary signer.proof business transactions create \  --email "[email protected]" \  --document "/path/to/document.pdf" \  --signers-file ./signers.json
# Replace a draft transaction (PUT) -- anything you omit reverts to defaultproof business transactions update <transaction-id> \  --name "Contract Signing (revised)" \  --expiry "2026-09-08T10:00:00Z"
# Change individual fields and leave the rest alone (PATCH)proof business transactions patch <transaction-id> --expiry "2026-09-15T10:00:00Z"
# Reorder documents already attached to a draftproof business transactions patch <transaction-id> \  --document-order "doc_abc123=1" \  --document-order "doc_def456=2"
# See the full parameter setproof business transactions create --help
# Activate a draft transactionproof business transactions activate <transaction-id>
# Delete a transactionproof business transactions delete <transaction-id>
# Cancel a transactionproof business transactions cancel <transaction-id>
Documents
bash
# Add a document to a transactionproof business documents add <transaction-id> /path/to/document.pdf \  --filename "Contract.pdf" \  --requirement "esign" \  --esign-required
# Apply a specific template instead of automatic matchingproof business documents add <transaction-id> /path/to/document.pdf --template-id <template-id>
# Get a documentproof business documents get <transaction-id> <document-id>
# Get document as hosted URL (after completion)proof business documents get <transaction-id> <document-id> --encoding uri
# Delete a documentproof business documents delete <document-id>
Webhooks
bash
# List webhooks (v2)proof business webhooks list
# Get webhook detailsproof business webhooks get-v2 <webhook-id>
# Create a webhookproof business webhooks create \  --url "https://example.com/webhook" \  --name "Transaction Updates" \  --events "transaction.created,transaction.completed"
# Update a webhookproof business webhooks update <webhook-id> \  --url "https://new-url.com/webhook"
# Delete a webhookproof business webhooks delete <webhook-id>
# Get webhook eventsproof business webhooks events <webhook-id>
# List available event subscriptionsproof business webhooks subscriptions
Notaries
bash
# List notariesproof business notaries list
# List notaries by stateproof business notaries list --state CA
# Get notary detailsproof business notaries get <notary-id>
# Create a notaryproof business notaries create \  --email "[email protected]" \  --first-name "Jane" \  --last-name "Smith" \  --state "CA"
# Delete a notaryproof business notaries delete <notary-id>
Templates
bash
# List document templatesproof business templates list
# List with paginationproof business templates list --limit 50 --offset 100
Cost Centers
bash
# List cost centers, then attribute a transaction with --cost-center-idproof business cost-centers listproof business transactions create --email [email protected] --cost-center-id <id>
Referrals
bash
# Create a referral campaignproof business referrals create \  --name "Partner Referrals" \  --cover-payment \  --redirect-url "https://example.com/signup"
# Generate a referral codeproof business referrals generate-code <campaign-id> \  --expires-at "2024-12-31T23:59:59Z"
Integrations
bash
# Create an Adobe integrationproof business integrations create \  --name "ADOBE" \  --org-id "your-org-id" \  --account-id "adobe-account-id" \  --environment "production"
# Create a DocuTech integrationproof business integrations create \  --name "DOCUTECH" \  --org-id "your-org-id"

Real Estate API

The Real Estate API specializes in mortgage and real estate transaction management.

Transactions
bash
# List real estate transactionsproof real-estate transactions list
# List with filteringproof real-estate transactions list --status "in_progress" --limit 20
# Get transaction detailsproof real-estate transactions get <transaction-id>
# Create a transactionproof real-estate transactions create \  --type "purchase" \  --file-number "RE-2024-001" \  --loan-number "LN-2024-001"
# Place an order for a transactionproof real-estate transactions place-order <transaction-id>
# Cancel a transactionproof real-estate transactions cancel <transaction-id>
Templates
bash
# List templatesproof real-estate templates list
Cost Centers
bash
proof real-estate cost-centers listproof real-estate transactions create --cost-center-id <id>
Documents
bash
# List documentsproof real-estate documents list <transaction-id>
# Get document detailsproof real-estate documents get <document-id>
# Upload a documentproof real-estate documents upload <transaction-id> /path/to/document.pdf \  --type "purchase_agreement" \  --external-id "PA-001"
Webhooks
bash
# List real estate webhooksproof real-estate webhooks list
# Create a webhookproof real-estate webhooks create "https://example.com/re-webhook" \  --subscriptions "transaction.created,document.uploaded"
Address Verification
bash
# Verify an addressproof real-estate verify-address \  --line1 "123 Main St" \  --city "San Francisco" \  --state "CA" \  --postal-code "94102"

SCIM API

The SCIM API provides standardized user management capabilities.

Users
bash
# List users in an organizationproof scim users list <organization-id>
# List with paginationproof scim users list <organization-id> --start-index 1 --count 25
# Get user detailsproof scim users get <organization-id> <user-id>
# Create a userproof scim users create <organization-id> \  --username "[email protected]" \  --given-name "John" \  --family-name "Doe" \  --email "[email protected]" \  --active
# Update a user (full replacement)proof scim users update <organization-id> <user-id> \  --username "[email protected]" \  --given-name "Jane"
# Patch a user (partial update); --operation is repeatable, format op:path[:value]proof scim users patch <organization-id> <user-id> \  --operation 'replace:active:false'
# Delete a userproof scim users delete <organization-id> <user-id>
Schemas
bash
# Get user schemaproof scim schemas user <organization-id>
# Get service provider configurationproof scim schemas service-provider-config <organization-id>
# Get resource typesproof scim schemas resource-types <organization-id>

Security Events API

Read the organization's OCSF-formatted security event log.

bash
# List recent security eventsproof logs list
# Page through resultsproof logs list --limit 100proof logs list --cursor <next_cursor-from-previous-response>
# Filterproof logs list --since 2026-01-01T00:00:00Zproof logs list --class-uid 1001 --severity-id 3

Certificates API

Issue, use, and revoke organization certificates.

bash
# List certificatesproof certificates list --limit 25 --offset 0
# Get one certificateproof certificates get <certificate-id>
# Issue a certificate with a Proof-generated keyproof certificates create \  --common-name "Acme Signing Authority" \  --profile organization_authenticity_al2
# Issue a certificate from your own CSRproof certificates create-from-csr --csr "$(cat request.pem)"
# Sign base64-encoded SHA256 digests (--digest is repeatable, max 25)proof certificates sign <certificate-id> --digest "BOGQnhPlcpXqM7fAH6tvFPI4QOXsIyXMiBKtFpblmjU="
# Revokeproof certificates revoke <certificate-id> --reason "key compromise"

Verifiable Credentials API

Requests a Verifiable Credential presentation from an End-User. This endpoint is a browser redirect, not a server-to-server call — the CLI prints the URL for you to send the End-User to, and does not follow it.

bash
# Fragment mode: the vp_token comes back on your redirect URIproof credentials authorize-url \  --client-id <oauth-client-id> \  --response-mode fragment \  --redirect-uri https://app.example.com/callback \  --scope "openid" \  --login-hint [email protected] \  --nonce "$(openssl rand -hex 16)" \  --state "$(openssl rand -hex 8)"
# direct_post mode: Proof POSTs the vp_token to your response URIproof credentials authorize-url \  --client-id <oauth-client-id> \  --response-mode direct_post \  --response-uri https://app.example.com/vp \  --scope "openid" \  --login-hint [email protected] \  --nonce "$(openssl rand -hex 16)"

--redirect-uri is required in fragment mode and rejected in direct_post mode; --response-uri is the reverse. Both URIs must be registered on your OAuth Application.

Examples

The CLI includes example commands that demonstrate common workflows:

bash
# List all available examplesproof example --help
# Business API examplesproof example business-transactions     # List business transactionsproof example business-notary          # Create a notary
# Real Estate API examplesproof example real-estate-transactions  # List real estate transactionsproof example verify-address           # Verify an address
# SCIM API examplesproof example scim-users <org-id>       # List SCIM usersproof example scim-schema <org-id>      # Get SCIM user schema

Configuration

The CLI stores configuration in ~/.proof-cli/:

  • config.json - Main configuration file
  • api_key - API key (permissions 0600)

Configuration options:

  • endpoint - API endpoint URL
  • timeout - Request timeout in seconds
bash
# View current configurationproof config get
# Set API endpointproof config set-endpoint "https://api.proof.com"
# Set request timeoutproof config set-timeout 30
# Set API keyproof config set-api-key "your-api-key"

Global Flags

All commands support these global flags:

  • --pretty - Pretty print JSON output (default: true)
  • --verbose - Show additional debug output
  • --help - Show help information

Environment Variables

  • PROOF_API_KEY - API key for authentication
  • PROOF_ENDPOINT - Override default API endpoint
  • PROOF_TIMEOUT - Request timeout in seconds

Error Handling

The CLI provides detailed error messages and uses standard exit codes:

  • 0 - Success
  • 1 - General error (API error, invalid arguments, etc.)

Development

Building from Source

bash
git clone https://github.com/tsarlewey/proof-cli.gitcd proof-cligo mod downloadgo build -o proof

Makefile Targets

The project provides a Makefile for common development tasks:

bash
make build          # Build the ./proof binarymake install        # Install the CLI via go installmake fmt            # Run go fmtmake vet            # Run go vetmake test           # Run all testsmake test-race      # Run all tests with -racemake coverage       # Run tests with coverage profilemake check          # fmt + vet + build + test-racemake clean          # Remove the built binarymake smoke          # Run shell smoke tests against live APImake smoke-go       # Run Go smoke tests (build-tag smoke)make smoke-write    # Run shell write smoke tests (PROOF_SMOKE_WRITE=1)make smoke-write-go # Run Go write smoke tests (build-tag smoke_write)

SDK Source

The generated Go SDK clients now live in their own repo: github.com/tsarlewey/proof-sdk-go. This CLI imports them as a regular Go module dependency. If you need to regenerate the clients after an upstream OpenAPI spec change, work inside the SDK repo — the generation toolchain (OpenAPI specs, oapi-codegen configs, preprocessing scripts, make regenerate) moved there.

To pick up a new SDK release in this CLI:

bash
go get github.com/tsarlewey/proof-sdk-go@<new-version>go mod tidymake check

Adding or Updating Commands

CLI commands live in cmd/ (one file per API surface) and are built with Cobra. Each command's Run closure calls a method on the generated SDK client via the factory helpers in cmd/root.go (getBusinessClient, getRealEstateClient, getSCIMClient). The factories wrap the SDK client with common.AuthenticatedDoer (from the SDK repo), which injects OAuth bearer tokens or the API key on every request.

Shared helpers in cmd/root.go:

  • initializeForAPICall — lazy client setup, used as PreRun on every API-calling command.
  • PrintResponse / PrintVerbose — response output with optional pretty-printing and colorization.
  • parseDateFlag — parses optional date-flag values, exits with a clear message on parse failure.
  • isSuccess — 2xx status-code check.
  • checkAPIStatus — after every SDK call, exits 1 with the body on stderr if the API returned a non-2xx response.

Errors from SDK calls are funneled through utils.HandleError(err, "action phrase") for transport errors and checkAPIStatus(resp.StatusCode(), resp.Body, "action phrase") for application-level HTTP errors. Both exit 1.

Support

For issues and feature requests, please visit the GitHub repository.

License

Source: README.md at commit 8b5a939

Tools

0
SourceWeft started this package once in an isolated sandbox, without credentials, to list its tools. That failed: the package type cannot run in the sandbox.

Version history

3
  1. v0.4.1LatestNov 8, 2026
  2. v0.4.0Oct 25, 2026
  3. v0.3.1Sep 30, 2026

Score

40% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts

    Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.

  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts

    Declare a license in the repository or the registry entry.

Other Proof integrations

Proof Holdings

holdings.proofOfficial publisher

Proof Holdings MCP server for creating identity verifications, validating proof tokens and checking domain delegations from an AI assistant.

Streamable HTTPWeb executable
Developer Tools180 toolsNov 12, 2026

Proof of Work

Published by GitHub account kivtxs

Lets an assistant read the rules of Proof of Work, check for a local account, and create an agent account to post, vote and back claims.

STDIODesktop only
Communication & Collaboration3 toolsNov 6, 2026

QuietProof

Published by GitHub account frankjie3-create

QuietProof offers free discovery tools for a catalog of deterministic, read-only audits that are paid per call in USDC on Base via x402.

Streamable HTTPWeb executable
Finance4 toolsNov 1, 2026

SCRIPTMASTERLABS — 402Proof

com.scriptmasterlabs

Remote MCP endpoint for creating, verifying and scoring invoices settled with RLUSD on the XRPL ledger, with self-proof of settlements.

Streamable HTTPWeb executable
FinanceNot indexed yetNov 5, 2026

ZKStamp Proof-100

Published by GitHub account ZKStamp

Remote MCP server that writes SHA-256 fingerprints to the BitcoinZ blockchain as shielded, dated proof-of-existence timestamps.

Streamable HTTPWeb executableAuth
Finance3 toolsOct 29, 2026