Skip to main content
Glama
Sign In

SRIFT

by app.srift
OverviewDiscussionsAdmin

Start SRIFT Session

srift_start_session

Create a new SRIFT secure session. Returns the 7-character session ID and a shareable URL. The host approves all future joins. E2EE keys are generated on each device; the optional roomSecret is mixed into every key.

Tool call template

This tool declares no required parameters. Add optional parameters from the input schema as needed.

{
  "id": 1,
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "arguments": {},
    "name": "srift_start_session"
  }
}

Input Schema

NameRequiredDescriptionDefault
roomSecretNoOptional shared secret mixed into every key. Never sent to the server; a member who joins with a different secret cannot read chat or files.
sessionNameNoHuman-readable session name (optional, e.g. "Project Collab")

Output Schema

NameRequiredDescriptionDefault
urlNoDirect browser join URL to share with peers
roleNoUser role in session (host)
sessionIdYes7-character unique session room code

Schema Changelog

Changes observed during successful MCP inspections.

  1. Changed1 schema field changed
    • changedInput schema / properties / roomSecret / description
      Previous value: -"Optional shared secret mixed into key derivation. Never sent to server. Without it the key is derivable from the session ID (which the server sees); set it to make the key participant-only."New value: +"Optional shared secret mixed into every key. Never sent to the server; a member who joins with a different secret cannot read chat or files."
  2. Changed1 schema field changed
    • changedInput schema / properties / roomSecret / description
      Previous value: -"Optional shared secret for extra-strong E2EE key derivation. Never sent to server."New value: +"Optional shared secret mixed into key derivation. Never sent to server. Without it the key is derivable from the session ID (which the server sees); set it to make the key participant-only."
  3. Changed2 schema fields changed
    • changedInput schema / properties / sessionName / description
      Previous value: -"Human-readable session name (optional)"New value: +"Human-readable session name (optional, e.g. \"Project Collab\")"
    • changedOutput schema / (root)
      Previous value: -nullNew value: +{
+  "properties": {
+    "role": {
+      "description": "User role in session (host)",
+      "type": "string"
+    },
+    "sessionId": {
+      "description": "7-character unique session room code",
+      "type": "string"
+    },
+    "url": {
+      "description": "Direct browser join URL to share with peers",
+      "type": "string"
+    }
+  },
+  "required": [
+    "sessionId"
+  ],
+  "type": "object"
+}
  4. First observed

TDQS

A4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already cover the safety profile (non-read-only, non-idempotent, non-destructive, open-world), so the bar is lower, and the description still adds real context: the 7-character session ID plus shareable URL returned, host-gated joins, and per-device E2EE key generation with the secret mixed in. It stops short of covering lifecycle limits (expiry, session caps) or rate limits.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three tight sentences, front-loaded with the core action, then the return values, then the security model. Every sentence carries information an agent needs and none is filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a two-optional-parameter creation tool with a rich output schema and annotations covering safety, the description is nearly complete: it explains the returned ID/URL, join approval, and key derivation. Minor gaps remain around session lifetime and whether omitting roomSecret weakens security guarantees.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so both parameters are already documented in detail, including that roomSecret is never sent to the server. The description only restates that roomSecret is optional and mixed into keys, adding essentially no meaning beyond the schema; baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('Create a new SRIFT secure session') and identifies the actor's role ('the host approves all future joins'), which cleanly separates it from siblings like srift_join_session and srift_approve_join. An agent can identify the tool's role as the session-creation entry point without opening the schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies the usage context by describing the host/join-approval model, which tells an agent this is the tool that bootstraps a session before others join. However, it never explicitly states when to use this versus srift_join_session or what prerequisites (e.g., host identity) must hold, so guidance remains inferential.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

All SRIFT toolsInspect
Try in Browser
One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

Glama MCP Gateway

Add one secure layer between your agents and this server.

Resources