Reclaim Protocol — Verification Letters

Working Security A

io.github.reclaimprotocol/verification-lettersv1.2.0 GitHub verified

Request user-authorized account verification, share verification links, and verify Reclaim PDFs.

Security

Watch Source Website

Registry entry

Open in the registry

{
  "_meta": {
    "io.modelcontextprotocol.registry/official": {
      "status": "active",
      "isLatest": true,
      "updatedAt": "2026-11-10T17:33:52.755996Z",
      "publishedAt": "2026-11-10T17:33:52.755996Z",
      "statusChangedAt": "2026-11-10T17:33:52.755996Z"
    }
  },
  "server": {
    "name": "io.github.reclaimprotocol/verification-letters",
    "icons": [
      {
        "src": "https://avatars.githubusercontent.com/u/130321117?s=400&v=4",
        "sizes": [
          "400x400"
        ],
        "mimeType": "image/png"
      }
    ],
    "title": "Reclaim Protocol — Verification Letters",
    "$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json",
    "remotes": [
      {
        "url": "https://letters.reclaimprotocol.org/mcp",
        "type": "streamable-http"
      }
    ],
    "version": "1.2.0",
    "repository": {
      "url": "https://github.com/reclaimprotocol/developer-tools",
      "source": "github"
    },
    "websiteUrl": "https://letters.reclaimprotocol.org/agents",
    "description": "Request user-authorized account verification, share verification links, and verify Reclaim PDFs."
  }
}

Maintain this server? Claim it

Try it

Call this server's tools from your browser. Nothing to install.

https://letters.reclaimprotocol.org/mcp

Requests go through mcptry because browsers can't call most MCP servers directly. Header values are sent to the server for that request only and are never stored or logged.

Tool list from our last check. Connect live to refresh it.

cancel_letter Destructive

Cancel unfinished verification. A completed letter remains available.

tokenstring, required

Private task token returned by create_letter. Never include it in the PDF or an email.

letterIdstring, required

The server marks this tool as destructive. Running it may delete or overwrite data on the server or in any account you connected with your headers.

I understand, run it anyway

Try it

Call this server's tools from your browser. Nothing to install.

https://letters.reclaimprotocol.org/mcp

Requests go through mcptry because browsers can't call most MCP servers directly. Header values are sent to the server for that request only and are never stored or logged.

Tool list from our last check. Connect live to refresh it.

cancel_letter Destructive

Cancel unfinished verification. A completed letter remains available.

tokenstring, required

Private task token returned by create_letter. Never include it in the PDF or an email.

letterIdstring, required

The server marks this tool as destructive. Running it may delete or overwrite data on the server or in any account you connected with your headers.

I understand, run it anyway

Tools (7)

cancel_letter

Cancel unfinished verification. A completed letter remains available.

destructive

Argument	Type	Description
token*	string	Private task token returned by create_letter. Never include it in the PDF or an email.
letterId*	string

Input schema (JSON)

{
  "type": "object",
  "$schema": "http://json-schema.org/draft-07/schema#",
  "required": [
    "letterId",
    "token"
  ],
  "properties": {
    "token": {
      "type": "string",
      "pattern": "^[a-f0-9]{64}$",
      "description": "Private task token returned by create_letter. Never include it in the PDF or an email."
    },
    "letterId": {
      "type": "string",
      "format": "uuid",
      "pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$"
    }
  }
}

create_letter

Prepare a verified reference letter. Returns a private task token and a handoff link; the user must approve the request and sign in. Downloads are free.

Argument	Type	Description
params*	array
prompt	string	Describe what data to extract and the exact parameter name to store each value under. Use the parameter names exactly as entered. Include any navigation steps. For example: Open Account > Profile, extract the account holder's full name, and store it under fullName.
loginUrl*	string
idempotencyKey	string	Private random retry key. Reuse only for the identical request.

Input schema (JSON)

{
  "type": "object",
  "$schema": "http://json-schema.org/draft-07/schema#",
  "required": [
    "loginUrl",
    "params"
  ],
  "properties": {
    "params": {
      "type": "array",
      "items": {
        "type": "object",
        "required": [
          "name"
        ],
        "properties": {
          "name": {
            "type": "string",
            "pattern": "^[A-Za-z][A-Za-z0-9]{0,63}$",
            "maxLength": 64,
            "minLength": 1,
            "description": "Start with a letter; use up to 64 letters or numbers. No spaces or special characters allowed. Use camelCase like \"fullName\" or \"residentialAddress\". Preserve this exact name in the extraction instructions."
          },
          "isOptional": {
            "type": "boolean",
            "default": false
          }
        }
      },
      "maxItems": 32,
      "minItems": 1
    },
    "prompt": {
      "type": "string",
      "default": "",
      "maxLength": 10000,
      "description": "Describe what data to extract and the exact parameter name to store each value under. Use the parameter names exactly as entered. Include any navigation steps. For example: Open Account > Profile, extract the account holder's full name, and store it under fullName."
    },
    "loginUrl": {
      "type": "string",
      "maxLength": 2048
    },
    "idempotencyKey": {
      "type": "string",
      "maxLength": 128,
      "minLength": 32,
      "description": "Private random retry key. Reuse only for the identical request."
    }
  }
}

create_verification_link

Create a reusable shareable verification link with immutable fields, optional/required settings, and extraction instructions. Provide loginUrl when known; otherwise omit it so each recipient supplies their own. Optionally set callbackUrl to receive the generated PDF automatically after recipient consent; its domain is shown prominently before approval. Recipients cannot edit the verification data or callback. Expires in seven days; each recipient receives a separate private verification. Returns shareableUrl and expiresAt. Does not start verification or grant access to recipients’ task tokens.

Argument	Type	Description
params*	array
prompt	string	Describe what data to extract and the exact parameter name to store each value under. Use the parameter names exactly as entered. Include navigation steps.
loginUrl	string	Official sign-in URL when known. Omit if unknown; the recipient supplies it.
callbackUrl	string	Public HTTPS endpoint to receive the raw PDF via POST (Content-Type: application/pdf). The recipient approves this destination before signing in. Return 2xx to accept; retries use the letter ID as Idempotency-Key.
idempotencyKey	string	Private random retry key. Reuse only for the identical request.

Input schema (JSON)

{
  "type": "object",
  "$schema": "http://json-schema.org/draft-07/schema#",
  "required": [
    "params"
  ],
  "properties": {
    "params": {
      "type": "array",
      "items": {
        "type": "object",
        "required": [
          "name"
        ],
        "properties": {
          "name": {
            "type": "string",
            "pattern": "^[A-Za-z][A-Za-z0-9]{0,63}$",
            "maxLength": 64,
            "minLength": 1,
            "description": "Exact extraction parameter name. No spaces or special characters allowed. Use camelCase like \"fullName\" or \"residentialAddress\"."
          },
          "isOptional": {
            "type": "boolean",
            "default": false
          }
        }
      },
      "maxItems": 32,
      "minItems": 1
    },
    "prompt": {
      "type": "string",
      "default": "",
      "maxLength": 10000,
      "description": "Describe what data to extract and the exact parameter name to store each value under. Use the parameter names exactly as entered. Include navigation steps."
    },
    "loginUrl": {
      "type": "string",
      "maxLength": 2048,
      "description": "Official sign-in URL when known. Omit if unknown; the recipient supplies it."
    },
    "callbackUrl": {
      "type": "string",
      "maxLength": 2048,
      "description": "Public HTTPS endpoint to receive the raw PDF via POST (Content-Type: application/pdf). The recipient approves this destination before signing in. Return 2xx to accept; retries use the letter ID as Idempotency-Key."
    },
    "idempotencyKey": {
      "type": "string",
      "maxLength": 128,
      "minLength": 32,
      "description": "Private random retry key. Reuse only for the identical request."
    }
  }
}

get_letter_download

Get a private download link, valid for 5 minutes, when the letter is ready. Downloads are free. Download the PDF with HTTP; do not put PDF bytes in model context.

read-only

Argument	Type	Description
token*	string	Private task token returned by create_letter. Never include it in the PDF or an email.
letterId*	string

Input schema (JSON)

{
  "type": "object",
  "$schema": "http://json-schema.org/draft-07/schema#",
  "required": [
    "letterId",
    "token"
  ],
  "properties": {
    "token": {
      "type": "string",
      "pattern": "^[a-f0-9]{64}$",
      "description": "Private task token returned by create_letter. Never include it in the PDF or an email."
    },
    "letterId": {
      "type": "string",
      "format": "uuid",
      "pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$"
    }
  }
}

get_letter_status

Check verification progress and PDF readiness. Poll no more often than pollAfterSeconds.

read-only

Argument	Type	Description
token*	string	Private task token returned by create_letter. Never include it in the PDF or an email.
letterId*	string

Input schema (JSON)

{
  "type": "object",
  "$schema": "http://json-schema.org/draft-07/schema#",
  "required": [
    "letterId",
    "token"
  ],
  "properties": {
    "token": {
      "type": "string",
      "pattern": "^[a-f0-9]{64}$",
      "description": "Private task token returned by create_letter. Never include it in the PDF or an email."
    },
    "letterId": {
      "type": "string",
      "format": "uuid",
      "pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$"
    }
  }
}

get_pdf_verification

Read the verified values, source URLs, capture times and issuer status for an uploaded PDF. Independently assess whether the source website is trustworthy.

read-only

Argument	Type	Description
token*	string
verificationId*	string

Input schema (JSON)

{
  "type": "object",
  "$schema": "http://json-schema.org/draft-07/schema#",
  "required": [
    "verificationId",
    "token"
  ],
  "properties": {
    "token": {
      "type": "string",
      "pattern": "^[a-f0-9]{64}$"
    },
    "verificationId": {
      "type": "string",
      "format": "uuid",
      "pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$"
    }
  }
}

prepare_pdf_verification

Get an upload URL, upload-only token, and browser handoff for an original Reclaim PDF up to 10 MB. POST application/pdf with Bearer uploadToken, then read the result. Free; uploads are not saved.

No arguments.

Input schema (JSON)

{
  "type": "object",
  "$schema": "http://json-schema.org/draft-07/schema#",
  "properties": {}
}

Reclaim Protocol — Verification Letters

Registry entry

Try it

cancel_letter Destructive

Reclaim Protocol — Verification Letters

Registry entry

Try it

cancel_letter Destructive

Install

Tools (7)

Security checkA97/100