[{"slug":"ZV-2026-0148","server_name":"mcp.kamy.dev","severity":"breaking","title":"mcp.kamy.dev: Tool generate_integration_code was removed.","summary":"[breaking] Tool generate_integration_code was removed. [breaking] Tool get_api_key_instructions was removed. [breaking] Tool get_usage was removed. [breaking] Tool install_sdk was removed. [safe] Tool bulk_signature_requests was added. [safe] Tool create_template was added. [safe] Tool get_envelope was added. [safe] Tool get_signature_request was added. [safe] Tool get_signature_template was added. [safe] Tool get_started was added. [safe] Tool get_template_version was added. [safe] Tool get_upload was added. [safe] Tool list_signature_templates was added. [safe] Tool list_template_versions was added. [safe] Tool preview_field_placement was added. [safe] Tool publish_template was added. [safe] Tool remind_signature was added. [safe] Tool rollback_template was added. [safe] Tool trace_record_batch was added. [safe] Tool update_template was added. [risky] Description of get_account changed (48% word delta). [safe] Description of render_pdf changed (2% word delta). [safe] Description of verify_attestation changed (23% word delta). [risky] Description of verify_pdf_signature changed (76% word delta).","changes":[{"kind":"tool_removed","tool":"generate_integration_code","detail":"Tool `generate_integration_code` was removed.","severity":"breaking"},{"kind":"tool_removed","tool":"get_api_key_instructions","detail":"Tool `get_api_key_instructions` was removed.","severity":"breaking"},{"kind":"tool_removed","tool":"get_usage","detail":"Tool `get_usage` was removed.","severity":"breaking"},{"kind":"tool_removed","tool":"install_sdk","detail":"Tool `install_sdk` was removed.","severity":"breaking"},{"kind":"tool_added","tool":"bulk_signature_requests","detail":"Tool `bulk_signature_requests` was added.","severity":"safe"},{"kind":"tool_added","tool":"create_template","detail":"Tool `create_template` was added.","severity":"safe"},{"kind":"tool_added","tool":"get_envelope","detail":"Tool `get_envelope` was added.","severity":"safe"},{"kind":"tool_added","tool":"get_signature_request","detail":"Tool `get_signature_request` was added.","severity":"safe"},{"kind":"tool_added","tool":"get_signature_template","detail":"Tool `get_signature_template` was added.","severity":"safe"},{"kind":"tool_added","tool":"get_started","detail":"Tool `get_started` was added.","severity":"safe"},{"kind":"tool_added","tool":"get_template_version","detail":"Tool `get_template_version` was added.","severity":"safe"},{"kind":"tool_added","tool":"get_upload","detail":"Tool `get_upload` was added.","severity":"safe"},{"kind":"tool_added","tool":"list_signature_templates","detail":"Tool `list_signature_templates` was added.","severity":"safe"},{"kind":"tool_added","tool":"list_template_versions","detail":"Tool `list_template_versions` was added.","severity":"safe"},{"kind":"tool_added","tool":"preview_field_placement","detail":"Tool `preview_field_placement` was added.","severity":"safe"},{"kind":"tool_added","tool":"publish_template","detail":"Tool `publish_template` was added.","severity":"safe"},{"kind":"tool_added","tool":"remind_signature","detail":"Tool `remind_signature` was added.","severity":"safe"},{"kind":"tool_added","tool":"rollback_template","detail":"Tool `rollback_template` was added.","severity":"safe"},{"kind":"tool_added","tool":"trace_record_batch","detail":"Tool `trace_record_batch` was added.","severity":"safe"},{"kind":"tool_added","tool":"update_template","detail":"Tool `update_template` was added.","severity":"safe"},{"kind":"description_changed","tool":"get_account","after":"Read everything about the authenticated Kamy account in one call: profile, plan and plan status, the plan's limits (renders per month, API keys, seats, custom templates, overage pricing, priority queue), month-to-date render usage, and whether documents rendered on this plan carry Kamy's own watermark. This is the only tool that answers any of those questions — there is no separate quota tool. Call it before render_batch, create_schedule, or any long series of renders: usage.renders.remaining is how many the API will still accept, and every render tool fails with 402 QUOTA_EXCEEDED once it hits zero, a failure nothing can recover from within the same calendar month. quota and remaining are null on unmetered plans, which means unlimited, not zero. Also check watermarkPolicy.appliedToRenders before generating something the user intends to send on: it is true on the free plan and cannot be turned off per render. Read-only, spends nothing, and works with any valid API key regardless of its scopes.","before":"Read everything about the authenticated Kamy account in one call: profile, plan and plan status, the plan's limits (renders per month, API keys, seats, custom templates, overage pricing, priority queue), month-to-date render usage, and whether documents rendered on this plan carry Kamy's own watermark. Use this to decide what the account is allowed to do before attempting it — in particular watermarkPolicy.appliedToRenders, which is true on the free plan and cannot be turned off per render, so tell the user before generating something they intend to send on. Reach for get_usage instead when all you need is remaining quota. Read-only; works with any valid API key regardless of its scopes.","detail":"Description of `get_account` changed (48% word delta).","severity":"risky","descriptionDelta":0.48484848484848486},{"kind":"description_changed","tool":"render_pdf","after":"Render a PDF from a Kamy template and data, and wait for it. This is the default document tool: it blocks until the file exists and hands back { id, url, bytes, durationMs, templateId, createdAt } in one call, where url is a signed download link valid for one hour and id is the render id every later tool takes. Reach for render_async instead when waiting is not acceptable, and render_batch when several documents are wanted at once. Call get_template_schema first if you are unsure what fields the template expects. Counts one render against the monthly quota — get_account tells you what is left before this fails with 402. Requires a Kamy API key with the `render` scope; without a key, returns dashboard setup instructions.","before":"Render a PDF from a Kamy template and data, and wait for it. This is the default document tool: it blocks until the file exists and hands back { id, url, bytes, durationMs, templateId, createdAt } in one call, where url is a signed download link valid for one hour and id is the render id every later tool takes. Reach for render_async instead when waiting is not acceptable, and render_batch when several documents are wanted at once. Call get_template_schema first if you are unsure what fields the template expects. Counts one render against the monthly quota — get_usage tells you what is left before this fails with 402. Requires a Kamy API key with the `render` scope; without a key, returns dashboard setup instructions.","detail":"Description of `render_pdf` changed (2% word delta).","severity":"safe","descriptionDelta":0.023809523809523836},{"kind":"description_changed","tool":"verify_attestation","after":"Ask Kamy whether a SHA-256 digest has an attestation on record — the tool that actually returns a verdict. Takes a digest, not a file: if what you hold is a PDF, run verify_pdf_signature over the bytes first and pass the sha256 it gives you. A match returns { verified: true, artifact_type, recorded_at, signature, public_key }. A false result means no attestation exists for those exact bytes, which happens both when content was altered after attestation and when it was simply never attested; it does not by itself identify tampering or a culprit. Public surface — like the extract_document verify URL, no API key is required, so a recipient can confirm an artifact independently of whoever sent it.","before":"Check whether a SHA-256 digest has a Kamy attestation on record. Public surface — like the extract_document verify URL, no API key is required, so a recipient can confirm an artifact independently of whoever sent it. Hash the bytes you are holding and pass the digest: a match returns { verified: true, artifact_type, recorded_at, signature, public_key }. A false result means no attestation exists for those exact bytes — which happens both when content was altered after attestation and when it was simply never attested; it does not by itself identify tampering or a culprit.","detail":"Description of `verify_attestation` changed (23% word delta).","severity":"safe","descriptionDelta":0.2282608695652174},{"kind":"description_changed","tool":"verify_pdf_signature","after":"Turn PDF bytes you are holding into their SHA-256 digest and the matching kamy.dev/verify/{sha256} page URL. Purely local: the MCP Worker hashes the base64 in memory, makes no Kamy API call, stores nothing and forwards nothing, so it works with no key and never leaves a trace. Note it returns no verdict — it does not tell you whether the document is genuine, signed, or on record anywhere. It is the first half of a check: take the sha256 it returns and pass it to verify_attestation for the actual yes/no, or hand a person the verify_url to open. Use this whenever you have the file itself; use verify_attestation directly when someone has already given you a digest.","before":"Compute the kamy.dev/verify URL for a PDF without making a Kamy API call. Pass the PDF as base64; the MCP Worker hashes it in-memory and does not store or forward it.","detail":"Description of `verify_pdf_signature` changed (76% word delta).","severity":"risky","descriptionDelta":0.7608695652173914}],"published_at":"2026-08-18T08:20:35.125Z"}]