AnalyticsProof

Identify the calling key

whoami

Read-onlyIdempotent

Identify the calling key (permission: read)

Return the calling key's identity, discriminated by kind. A project key: its projectId, permission, keyId and expiresAt. An org key: its orgId, orgName, permission, keyId, expiresAt and the org's projects (id + name, ordered by name); both carry the plan (tier, tierStatus, trialEndsAt) per project. Works on any plan, also for a project key of a project below Starter, so an agent can read the plan. ANY valid key works (read is the lowest permission), so a CI job can verify its credentials and discover its permission before making other calls. An agent connection (OAuth access token): kind user, its userId and the connection (keyId, client); it has no permission of its own — list the projects and the permission on each with GET /projects.

Tool call template

This tool declares no required parameters. Add optional parameters from the input schema as needed.

{
  "id": 1,
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "arguments": {},
    "name": "whoami"
  }
}

Input Schema

Name	Required	Description	Default
No arguments

Schema Changelog

Changes observed during successful MCP inspections.

First observedNov 4, 2026

TDQS

A4.6/5.0

Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint, idempotentHint, and destructiveHint=false, so the safety profile is covered; the description adds behavior beyond that. It discloses that the call works on any plan, including projects below Starter, that every valid key succeeds, and that agent connections carry no permission of their own. It also spells out the returned fields per key kind in the absence of an output schema.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The purpose and permission are front-loaded in the opening line, and each subsequent sentence covers a distinct key kind or use case. It is dense, with nested parentheticals enumerating return fields, but almost nothing is redundant for a tool with no output schema to carry the return contract.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no parameters and no output schema, the description must carry the entire contract, and it does: it enumerates the response shape for each key kind and explains the no-permission OAuth case with a next step. Nothing an agent needs in order to call it and interpret the result is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool takes zero parameters, so there is no parameter meaning to add and the baseline of 4 applies. The description does not need to compensate for any schema gaps, and schema coverage is reported at 100%.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The first line names a specific verb and resource ('Identify the calling key') and immediately scopes it with the permission it requires. The body distinguishes the exact shapes returned for a project key, an org key, and an OAuth agent connection, which separates it cleanly from nearby siblings like list_api_keys and list_projects.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It gives a concrete usage scenario: any valid key works because read is the lowest permission, so a CI job can verify credentials and discover its permission before making other calls. The agent-connection case is routed onward ('list the projects and the permission on each with GET /projects'). It stops short of explicitly excluding sibling alternatives such as list_api_keys, keeping this at a 4.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

All AnalyticsProof tools Inspect

Try in Browser

One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

Glama MCP Gateway

Add one secure layer between your agents and this server.

Resources

Need Help?