OpenProof / AI

Give AI the contract, not your secrets.

OpenProof exposes a public, documentation-first AI surface: compact LLM indexes, an expanded text corpus, the OpenAPI 3.1 contract and a read-only MCP server for search, endpoint lookup and integration guidance.

MCP endpoint OpenProof llms.txt OpenProof llms-full.txt OpenAPI

Canonical machine-readable sources

Resource	Purpose
`/llms.txt`	Compact index for all Genyleap documentation.
`/llms-full.txt`	Expanded Genyleap/OpenProof text corpus for retrieval.
`/openproof/llms.txt`	OpenProof-only navigation and authoritative source order.
`/openproof/llms-full.txt`	Expanded OpenProof deployment and developer reference.
`/openproof/api/openapi.yaml`	Authoritative OpenAPI 3.1 HTTP contract.
`/openproof/handbook`	Human-readable deployment + developer workflow.

Source priority for agents.

Use OpenAPI for endpoint/schema facts, the handbook for workflow, API Guide for protocol examples, Configuration for typed settings, Provider Setup for upstream requirements and Operations for runbooks.

Public documentation MCP

Compatible MCP clients can connect to:

MCPStreamable HTTP

https://docs.genyleap.com/openproof/mcp

The server is intentionally public because it exposes public documentation only. It has no path to production OpenProof secrets, databases, sessions, users or operator files.

Tools

Tool	Purpose
`search_openproof_docs`	Search the public handbook and implementation-aligned documentation.
`get_openproof_guide`	Return a focused guide for install, OAuth/OIDC, providers, operations, security or AI.
`get_openproof_endpoint`	Look up an OpenAPI method/path and return its contract excerpt.
`get_openproof_example`	Return documented integration patterns for cURL, JavaScript/Node, PHP or C++.
`get_openproof_checklist`	Return installation, developer or production checklists.

Read-only by design.

The docs MCP is not an administrative backdoor. To mutate a live deployment, use independently authenticated operator tooling with explicit audit and least privilege.

RAG / indexing guidance

Index the OpenAPI contract separately from prose so method/path/schema facts stay structured.
Chunk the handbook by headings, preserving code blocks with the section that explains them.
Keep version metadata with every chunk; examples here target OpenProof 1.1.0-rc1.
Do not let a model silently reconcile conflicting docs. Surface discrepancies and prefer current implementation-aligned sources.
Store real deployment values — client secrets, database URLs, tokens and private keys — outside the retrieval corpus.

Safe coding-assistant prompt

promptexample

Use only the OpenProof public documentation and OpenAPI contract.

Issuer: https://auth.example.com
Client type: browser
Redirect URI: https://app.example.com/oauth/callback
Scopes: openid profile offline_access

Implement Authorization Code + PKCE S256.
Validate state, returned issuer and ID-token signature/claims.
Do not hard-code secrets or log tokens.
Do not invent undocumented endpoints.

Security boundary for agents

Do not put the following into public LLM prompts, RAG corpora or the documentation MCP:

provider/API client secrets;
confidential OAuth client secrets;
PostgreSQL URLs/passwords;
signing/encryption/private keys;
access or refresh tokens;
session cookies;
verification secrets, TOTP seeds or recovery codes;
live user/session state or private logs.

For infrastructure automation, use a separate authenticated operator MCP/service. Documentation access and production control should remain different trust boundaries.