Skip to main content
Glama

Grant app access

nerdit_grant_app_access
Destructive

Let one person, one Google Workspace domain or one of the owner's groups open a private app at its hosted Nerdit address. kind email admits one address, by Google sign-in or by an emailed sign-in link when the app's sign-in page offers one. kind google_domain admits every account of that Workspace domain: confirm the exact domain with the owner first; public mail providers are refused. kind group lets in everyone in one of the owner's groups; groups are created and changed in the Nerdit console only. Needs the Pro plan and the machine online; an app not shared yet is shared private and locked to its hosted address. Adding the same rule again returns it, and with invite emails the person again. At most 50 rules per app; a group counts as one.

Input Schema

NameRequiredDescriptionDefault
kindYesemail for one address, google_domain for every account of one Workspace domain, group for everyone in one of the owner's groups.
valueYesAn email address, a Workspace domain such as acme.com, or a group id from nerdit_list_access_groups.
inviteNokind email only: also email the person the app's address (no sign-in link inside). Counts toward the owner's daily invitations.
node_idYesIdentifier of the machine, from nerdit_list_nodes.
service_nameYesName of the app on that machine.

Schema Changelog

Changes observed during successful MCP inspections.

  1. First observed

TDQS

A4.3/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare destructiveHint=true, openWorldHint=true, idempotentHint=false; the description adds substantial context the annotations cannot convey: the 50-rule cap, group-count-as-one, that re-adding a rule returns the existing one, that invite emails are re-sent and count toward the owner's daily invitations, and that an unshared app becomes private and locked to its hosted address. The one weakness is it never spells out the destructive/lock side effect in annotation-matching terms, but the coverage is well above average.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

One dense paragraph that front-loads what the tool does and then walks through each kind in order of importance, with no wasted sentences. It is information-heavy but each clause carries a constraint, limit, or side effect.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 5-parameter mutation tool with no output schema, the description covers prerequisites, per-kind semantics, idempotency behavior, rate/quota limits, and side effects. Return values are not described, but the tool's state changes and the re-add behavior are, leaving little an agent needs to call it correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline is 3; the description nonetheless adds meaning beyond the schema, explaining the real-world consequence of each kind, that value for group must come from nerdit_list_access_groups, and that invite only applies to kind email and consumes daily invitation quota.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a precise verb and resource (grant app access) and enumerates the three grantable principals (email, Workspace domain, owner group) with distinct behaviors for each. It also distinguishes group handling by pointing to nerdit_list_access_groups for group ids.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives clear situational guidance: confirm the exact domain with the owner before using google_domain, public mail providers are refused, groups can only be created/changed in the Nerdit console, and the Pro plan plus an online machine are prerequisites. It does not explicitly contrast with sibling nerdit_revoke_app_access or nerdit_list_app_access, which is the only gap.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Try in Browser

Glama MCP Gateway

Add one secure layer between your agents and this server.

Resources