Skip to main content
Glama

update_tribute_connection

DestructiveIdempotent

Connect a Tribute account to the application or change the connection. Requires manage_settings. Pass at least one field; they are applied in the order apiKey, notificationsConfirmed, paused. Returns the same view as get_tribute_setup. The API key is stored encrypted and no tool returns it. Three things happen in the owner's Tribute account and no tool can do them: creating the API key, creating a digital product and getting it approved by Tribute, and saving the notification link in Tribute (Dashboard → Settings → API Keys → Webhook URL).

Input Schema

NameRequiredDescriptionDefault
apiKeyNoThe owner's Tribute API key, exactly as they gave it. It is checked against Tribute before it is saved. Connects the account, or replaces the key of a connected one (the old key keeps verifying notifications for 24 hours). One key connects to one application only. Never invent one and never repeat it back.
pausedNotrue stops offering new checkouts; purchases and refunds already made are still processed. false resumes sales.
applicationIdNoApplication (workspace) id. Optional: an application-scoped key (app_...) defaults to its own application, but a personal key (usr_...) has no default and omitting it fails with MCP_APPLICATION_REQUIRED. Call list_applications to get the id.
notificationsConfirmedNoRecords that the owner saved connection.notificationUrl in Tribute. Set it only after the owner says so: nothing checks it, and a wrong "yes" means purchases are paid but never delivered.

Schema Changelog

Changes observed during successful MCP inspections.

  1. Added

TDQS

A4.6/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond readOnlyHint=false/destructiveHint=true/idempotentHint=true, it discloses that the API key is stored encrypted and never returned by any tool, that replacing a key leaves the old key verifying notifications for 24 hours, and that one key binds to one application only. It also warns that nothing validates notificationsConfirmed, which is a real behavioral trap the agent could otherwise fall into.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Purpose and permission are front-loaded, followed by the operational rules, then the out-of-scope warning. It is slightly dense in the final sentence about owner-side Tribute steps, but every clause there is actionable rather than filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For an open-world, destructive, non-read-only mutation with four optional params and no output schema, the definition covers prerequisite permission, ordering, return-shape equivalence (same view as get_tribute_setup), and the irreversible/manual steps that must precede it. Nothing an agent needs to call it correctly appears to be missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so 3 is the baseline, but the description adds cross-parameter meaning the schema does not: the deterministic application order (apiKey, notificationsConfirmed, paused) and the at-least-one-field rule that governs all four optional params. It does not restate parameter details, which is correct given the schema already carries them.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The first sentence states a specific verb and resource: connect a Tribute account or change the connection, plus the permission required (manage_settings). It is clearly distinguishable from read-side siblings such as get_tribute_setup and from list_tribute_* tools, and it even states that the return value matches get_tribute_setup.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It gives concrete usage constraints (must pass at least one field, fields applied in a set order) and explicitly scopes out three actions no tool can do (create key, create/approve product, save webhook in Tribute). It stops short of naming a sibling alternative for reading state, so it is clear context but not full when/when-not routing.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Try in Browser

Glama MCP Gateway

Add one secure layer between your agents and this server.