Skip to main content
Glama

request_secret

Read-only

Ask the person for a secret only they have - an API token, a password, a licence key - without the value ever entering this conversation. If the organisation already stores a secret under the name, it answers status 'stored' with its sentinel. Otherwise it answers status 'waiting_for_person' with a link to the organisation's secrets page: give the person the link, ask them to store the secret there under exactly that name, and when they say it is done call request_secret again with the same name to get the sentinel. Never ask for, accept or repeat a secret value in the conversation; for a value nobody needs to know (a database password, a signing key) use create_secret instead. Read-only.

Input Schema

NameRequiredDescriptionDefault
nameYesThe name the secret is stored under, e.g. 'stripe-api-key' (at most 120 characters, one line).
descriptionNoOptional: what the secret is for and where the person finds it, to pass on with the link.

Schema Changelog

Changes observed during successful MCP inspections.

  1. Changed1 schema field changed
    • addedInput schema / additionalProperties
      Added value: +false
  2. Added

TDQS

A4.8/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The readOnlyHint annotation only says nothing is mutated; the description goes far beyond it by disclosing the exact response contract ('status stored' with sentinel vs 'status waiting_for_person' with a link), the safe-handling constraint, and the requirement to re-invoke. It also explicitly aligns with the annotation by ending with 'Read-only.'

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Purpose is front-loaded and the alternative-routing sentence is well placed at the end. It is a single dense paragraph slightly longer than necessary, with mild redundancy between 'without the value ever entering this conversation' and 'Never ask for, accept or repeat a secret value', which costs it a point.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With only 2 fully documented params and a single readOnly annotation, the description covers what an agent needs: the purpose, the two possible outcomes, the follow-up action, and the safety rule. The absence of an output schema is compensated by the explicit status/sentinel/link return description.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% and the schema already explains `name` and `description`. The description still adds operational meaning: the name is the exact lookup key on retry ('call request_secret again with the same name'), and `description` is passed on to the person with the link. That is beyond-schema value, though brief.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('Ask the person for a secret only they have') and immediately gives concrete examples (API token, password, licence key) plus the defining constraint that the value never enters the conversation. It is clearly separable from siblings like create_secret, get_secrets, list_secrets and rotate_secret.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives explicit when-to-use (a person holds the value), explicit when-not-to-use and the alternative ('for a value nobody needs to know ... use create_secret instead'), plus the two-phase call sequence including the instruction to call again with the same name after the person stores it.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Try in Browser

Glama MCP Gateway

Add one secure layer between your agents and this server.

Resources