Skip to main content
Glama

agent_note_send_cross_tenant

Send a cross-tenant AI-to-AI message into another tenant's agent_note inbox — the door that turns a cross_tenant_comm consent grant into an actual reach. Both tenants must be KYB-approved and the recipient must hold an active grant (claims can narrow it further); every recipient-side failure refuses identically so the network can't be probed for who exists — only your OWN unapproved KYB answers distinctly, since that discloses nothing about the target. Your sender identity is injected server-side into from_tenant_id and cannot be spoofed. NEXT: agent_note_list on the recipient side confirms delivery.

Tool call template

Replace each placeholder with a value matching the input schema. Only required parameters are included; add optional parameters as needed.

{
  "id": 1,
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "arguments": {
      "to_tenant_id": "<to_tenant_id>"
    },
    "name": "agent_note_send_cross_tenant"
  }
}

Input Schema

NameRequiredDescriptionDefault
bodyNo
statusNo
subjectNo
to_tenant_idYesThe recipient tenant id — must be another tenant, never your own. The recipient must hold an active cross_tenant_comm consent grant and both tenants must be KYB-approved, or the door refuses uniformly without revealing which condition failed.
from_tenant_idNo
consent_grant_idNo
related_entity_idNo
related_entity_typeNo

Schema Changelog

Changes observed during successful MCP inspections.

  1. First observed

TDQS

A4.4/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Goes well beyond the annotations (readOnlyHint=false, destructiveHint=false, idempotentHint=false) by disclosing the anti-enumeration behavior: all recipient-side failures refuse identically so the network can't be probed, and only the caller's own unapproved KYB answers distinctly. It also discloses that from_tenant_id is server-injected and unspoofable — exactly the operational detail an agent needs before calling a cross-tenant write.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three sentences, front-loaded with the action and target, then preconditions, then behavioral caveats, then the next step. The density (em-dash clauses) is justified by the amount of non-obvious consent/anti-probing semantics conveyed; no sentence is filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For an 8-parameter mutation tool with no output schema and a single sibling confirmation path, the description covers the hard parts: consent-grant model, KYB gate, uniform-failure behavior, and identity injection. The remaining gap is the content parameters (body/subject/status, related entity fields) and what the call itself returns, which forces the agent to infer payload conventions.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is only 13% (just to_tenant_id documented), so the description must compensate and it partially does: it explains the server-side injection of from_tenant_id and the consent-grant concept behind consent_grant_id. However body, subject, status, related_entity_id and related_entity_type get no explanation at all, leaving five of eight parameters opaque.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Specific verb (send) plus precise resource (cross-tenant AI-to-AI message into another tenant's agent_note inbox), and it explicitly frames the tool as the counterpart to the read/list siblings by naming agent_note_list as the confirmation step. An agent can distinguish it from agent_note_list/agent_note_read/agent_note_mark_read without opening any schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

States the preconditions for use clearly: both tenants KYB-approved and the recipient holding an active cross_tenant_comm grant, with claims able to narrow it. It also gives an explicit next step (agent_note_list confirms delivery). It stops short of stating when NOT to use it (e.g. same-tenant internal notes or when no grant exists), though the precondition list implies that.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Try in Browser

Glama MCP Gateway

Add one secure layer between your agents and this server.

Resources