withHuman

This connector has been deprecated

This is a duplicate of the actual entry deprecating this in favor of the original.

Set gateway scope oauth client

set_gateway_scope_oauth_client

DestructiveIdempotent

Store the OAuth client every member signs in with on a member-held oauth scope, for an authorization server that offers no dynamic client registration. The secret is sealed and never returned. Replacing the client keeps members' tokens, though a token issued to the old client may need its member to reconnect.

Tool call template

Replace each placeholder with a value matching the input schema. Only required parameters are included; add optional parameters as needed.

{
  "id": 1,
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "arguments": {
      "server_slug": "<server_slug>",
      "scope": "<scope>",
      "client_id": "<client_id>"
    },
    "name": "set_gateway_scope_oauth_client"
  }
}

Input Schema

Name	Required	Description
`scope`	Yes	A member-held scope whose auth_mode is oauth.
`client_id`	Yes	The OAuth client id registered with the downstream server's authorization server.
`server_slug`	Yes	The server's slug, from list_gateway_servers.
`client_secret`	No	The client secret, for a confidential client.

Schema Changelog

Changes observed during successful MCP inspections.

First observedOct 15, 2026

TDQS

A4.3/5.0

Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare destructiveHint=true and idempotentHint=true. The description adds non-obvious behavior: the secret is sealed and never returned, and replacing the client preserves members' tokens while possibly requiring reconnection for tokens issued to the old client.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three sentences, front-loaded with the purpose and followed by the most important behavioral caveats. Every sentence adds useful information without repetition.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given full schema coverage, destructive/idempotent annotations, and no output schema, the description supplies the key missing context: secret handling and token reconnection behavior. No essential invocation details appear to be missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so all four parameters are already documented in the schema. The description does not add syntax, format, or conditional meaning beyond the schema's parameter descriptions.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource: storing the OAuth client used by members on a member-held OAuth scope. The added condition about authorization servers without dynamic client registration makes the purpose distinguishable from generic scope configuration tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives clear contextual guidance: use this for an authorization server that offers no dynamic client registration. It does not name alternatives such as set_gateway_scope_headers or disconnect_gateway_scope, so it falls short of explicit when-not guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

All withHuman tools Inspect

Try in Browser

One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

Glama MCP Gateway

Add one secure layer between your agents and this server.

Resources

Need Help?