Proof of Type Input MCP server

Proof of Type Input

A text box that proves a human typed it, not AI.

Add one script tag, and the comments, posts, reviews or articles on your site come with proof that a real person typed them: signed in to Proof of Type, typed letter by letter (no paste, no AI-generated text), and confirmed on their phone with Face ID or a fingerprint. Your server gets the text plus a signed proof token that you, or anyone, can verify.

• Live demo and docs: https://www.proofoftype.com/developers
• API reference: https://www.proofoftype.com/developers/api
• For AI assistants: https://www.proofoftype.com/llms.txt

<script src="https://www.proofoftype.com/sdk/v1.js" async></script>

<form method="post" action="/comments">
  <div data-proofoftype data-name="comment" data-placeholder="Write a comment"></div>
  <button>Post</button>
</form>

When the form is submitted, the person confirms on their phone, then your server receives:

Build it with your AI coding agent (MCP)

Vibe coding a site? Connect the Proof of Type MCP server and ask your agent for "a comment box that proves a human typed it".

claude mcp add --transport http proofoftype https://www.proofoftype.com/mcp

Other clients (Cursor, VS Code, …):

{ "mcpServers": { "proofoftype": { "url": "https://www.proofoftype.com/mcp" } } }

Tools: getquickstart(framework), verifyproof(token, text, origin), explain(topic).

Why

AI-generated text is now free and endless, and AI detectors can only guess from the finished words, so they're wrong both ways. Proof of Type doesn't guess. It proves how the text was made:

1. The person types in our input, key by key. It runs in a secure frame from proofoftype.com, so the host page, extensions or scripts can't fake keystrokes.
2. The typing is timed on our server (it can't be instant or replayed) and scored for human rhythm.
3. The person approves the exact text on their phone in the Proof of Type app, with Face ID or a fingerprint. The phone's hardware vouches for the app (Apple App Attest, Android key attestation). A script can't do this step.

Pasted or generated text never gets a proof.

Verify on your server

Always check the proof before you save the text. Accept it only if it's valid, matches the text, and was made on your site.

const r = await fetch('https://www.proofoftype.com/api/v1/verify', {
  method: 'POST',
  headers: { 'Content-Type': 'application/json' },
  body: JSON.stringify({
    token: req.body.comment_proof,
    text: req.body.comment,              // the exact text
    origin: 'https://your-site.com',     // your site
    max_age_seconds: 600,                // made in the last 10 minutes
  }),
}).then((res) => res.json());

if (!r.valid || !r.text_matches || !r.origin_matches || !r.fresh) {
  return res.status(400).send('Please type your comment in the box.');
}
// Use each proof once: store r.proof.id with the comment, refuse repeats
// (proof tokens are public — they're in proof links).
// r.proof.author: the Proof of Type username who typed it
// r.proof.link: a link pasted with the text, if any

Prefer a helper? Copy server.mjs into your project (verifyProof({ token, text, origin })).

Or call the API directly (no key needed):

curl -s https://www.proofoftype.com/api/v1/verify \
  -H 'Content-Type: application/json' \
  -d '{"token":"<comment_proof>","text":"<comment>","origin":"https://your-site.com"}'

{ "valid": true, "text_matches": true, "origin_matches": true,
  "proof": { "id": "pot_…", "author": "yogev", "origin": "https://your-site.com",
             "typed_at": "2026-10-11T18:20:31.000Z", "score": 87, "words": 6, "text_sha256": "…" } }

Offline verification

Shortened. The full README is on GitHub.