Skip to main content
Glama

HMAC signature of a message

hmac
Read-onlyIdempotent

Compute an HMAC (keyed hash) of a message with a secret, using SHA-1/256/384/512, returned as hex or Base64. Use to sign webhook payloads or verify a signature instead of guessing. LLMs cannot compute this by hand.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
secretYesThe shared secret key (UTF-8).
messageYesThe message to sign (UTF-8).
encodingNoOutput encoding.hex
algorithmNoHash algorithm.sha-256

Output Schema

TableJSON Schema
NameRequiredDescriptionDefault
encodingYes
algorithmYes
signatureYesThe HMAC in the requested encoding.

TDQS

A4.3/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint and idempotentHint, covering safety. The description adds valuable context with 'LLMs cannot compute this by hand,' explaining why the tool exists and warning the agent not to attempt manual calculation. It also reinforces the keyed-hash behavior (needing a secret), going beyond the annotation-only baseline.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three concise sentences: the first says what it does, the second when to use it, and the third why it is necessary. Every sentence earns its place, with no fluff or repetition. The most critical information is front-loaded.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a utility tool with a full schema, an output schema, and safety annotations, the description is complete. It covers the function, the use case, and the limitation (LLM hand-computation). The absence of return-value details is acceptable since an output schema exists. No gaps remain for the agent to invoke it correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, with each parameter (secret, message, encoding, algorithm) already fully described. The tool description does not add any meaning beyond the schema—it merely restates algorithm and encoding options. Baseline 3 applies when the schema carries the load.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb 'Compute' and names the exact resource: 'an HMAC (keyed hash) of a message with a secret'. It lists supported algorithms (SHA-1/256/384/512) and output formats (hex/Base64), immediately distinguishing it from the sibling 'hash' tool by emphasizing the keyed nature and its signing/verification use case.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly states when to use the tool: 'Use to sign webhook payloads or verify a signature instead of guessing.' This gives clear context for invocation. However, it does not explicitly name an alternative tool (e.g., 'use hash for unkeyed digests'), so it stops short of the highest score.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Try in Browser

Glama MCP Gateway

Add one secure layer between your agents and this server.

TDQS

A4.3/5.0
Disambiguation5/5

Each tool has a clearly distinct purpose: base64 encoding, color conversion, string counting, hashing, image format comparison, JSON formatting, JWT decoding, image optimization, QR code generation, slugification, storage capacity calculation, and UUID generation. No two tools overlap in functionality.

Naming Consistency4/5

Tool names are mostly consistent using lowercase and underscores, but they mix patterns: some are nouns (color, hash, uuid), some verbs (count, slugify), and some verb_noun pairs (jwt_decode, optimize_image). This minor inconsistency is still readable.

Tool Count5/5

With 12 tools, the count is well within the ideal range. Each tool serves a specific and useful utility function, making the set well-scoped for a general-purpose developer toolkit.

Completeness4/5

The tool set covers a broad range of common web development utilities (encoding, colors, hashing, JSON, images, UUIDs). Minor gaps like URL encoding or HTML escaping are missing, but the core functionalities are well-represented.