Super Artifacts

Call an API with a stored secret you cannot read

super_secret_use

Make one HTTPS request with a pii: secret value from a content collection entry. The platform puts the value into one header and calls the one host a person approved; you get status, headers and body, scrubbed of it. You never see it, in input or result; a response echoing it is withheld whole (secret_echoed). A first request for a field and host answers approval_required with approvalUrl: give the person that link, then repeat the request once they approve. Grants expire, cap uses and can be revoked; every use is logged. The person types the secret into its dashboard entry; super_entries writes one only if they insist on pasting it.

Tool call template

Replace each placeholder with a value matching the input schema. Only required parameters are included; add optional parameters as needed.

{
  "id": 1,
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "arguments": {
      "collection": "<collection>",
      "entry": "<entry>",
      "field": "<field>",
      "method": "<method>",
      "url": "<url>"
    },
    "name": "super_secret_use"
  }
}

Input Schema

Name	Required	Description
`url`	Yes	https only; its host must be the approved one. Redirects are returned, never followed.
`body`	No	≤64 KiB.
`entry`	Yes	The entry id.
`field`	Yes	The `pii: secret` field whose value is sent.
`header`	No	Where the value goes; asked for when no grant exists. The approved grant’s header wins.
`method`	Yes
`headers`	No	Sent as given, except host, authorization, cookie, proxy-* and the grant’s own header.
`collection`	Yes	Content collection key (a content model), not a gallery label.

Schema Changelog

Changes observed during successful MCP inspections.

AddedOct 29, 2026

TDQS

A4.5/5.0

Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations only declare openWorldHint and destructiveHint=false; the description adds the substantive behavior: the secret is never visible in input or result, a response echoing it is withheld whole with `secret_echoed`, grants expire, cap uses, are revocable, and every use is logged. These are the security traits an agent must know before calling.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Six dense sentences, front-loaded with what the call does and how the secret is handled, then the approval flow, then grant lifecycle. Every sentence carries operational information; nothing is filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For an 8-parameter security-sensitive tool with no output schema, the description covers return shape (status, headers, body scrubbed), approval flow, grant lifecycle, and secret origin. An agent has enough to call it correctly on first and repeat attempts.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 88%, so the schema already documents url, body, entry, field, header, and headers. The description reinforces the host-approval constraint and header-wins precedence but adds little parameter-level detail beyond the schema. Baseline 3 is correct here.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource: 'Make one HTTPS request with a `pii: secret` value from a content collection entry.' It also scopes the tool implicitly against super_entries ('writes one only if they insist on pasting it'), so an agent can tell the use path apart from the storage path.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives a concrete first-use procedure: a request returns `approval_required` with `approvalUrl`, the agent hands that link to the person, then repeats the request after approval. It does not name an alternative API-call tool (there appears to be none among siblings), so the when-to-use picture is clear but exclusions are implicit.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

All Super Artifacts tools Inspect

Try in Browser

Claude Code, inside the Godot 4 editorFlockbay puts an AI agent in the real Godot 4 editor: it writes GDScript, runs your game and fixes what breaks. Free, or bring your own Claude Code or Codex.flockbay.comAd

Glama MCP Gateway

Add one secure layer between your agents and this server.

Resources

Need Help?