Skip to main content
Glama

Revoke access

revoke_access
Destructive

Revokes one of the user's API tokens (apiTokenId) or disconnects a connected app (appClientId), as listed in the account. Whatever used it stops working at once, including this connection if it is the one in use. Needs confirm: true; without it the result is a preview. New tokens are only created by the user, in Settings.

Input Schema

NameRequiredDescriptionDefault
confirmNotrue performs the action. Without it (or with any value other than the boolean true) nothing changes and the result is a preview of the effects.
apiTokenIdNo
appClientIdNo

Schema Changelog

Changes observed during successful MCP inspections.

  1. Changed1 schema field changed
    • changedInput schema / properties / confirm / description
      Previous value: -"Set to true only after the user has seen the preview and explicitly agreed. Without it nothing changes and you get a preview."New value: +"true performs the action. Without it (or with any value other than the boolean true) nothing changes and the result is a preview of the effects."
  2. Added

TDQS

A4.3/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Goes well beyond the destructiveHint annotation: it discloses immediate effect ('stops working at once'), the self-destruction risk ('including this connection if it is the one in use'), and that omitting confirm yields a preview rather than a mutation. These are exactly the behavioral traits an agent needs before an irreversible action.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loads the action and its two targets, then layers the destructive consequence, the confirm gate, and the token-creation note. Every sentence carries weight, though the confirm behavior is restated from the schema description.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Without an output schema or rich annotations, the description carries the burden well by covering effects, the preview/confirm mechanism, and the self-revocation caveat. The main omission is the relationship/format of the two ID parameters.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is only 33% (only confirm is documented), so the description must compensate. It does clarify that apiTokenId targets an API token and appClientId targets a connected app, but it gives no format, sourcing, or mutual-exclusivity guidance for these two IDs, leaving the gap only partly closed.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb (revokes/disconnects) and the exact resources involved (API token via apiTokenId, connected app via appClientId). No sibling tool overlaps with credential/app revocation, so it is clearly distinguishable.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explains the two revocation modes and the confirm:true requirement, and the closing line that new tokens are only created in Settings steers the agent away from misusing this for creation. It does not explicitly name an alternative tool, but no sibling competes for this job.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Try in Browser

Glama MCP Gateway

Add one secure layer between your agents and this server.

Resources