Skip to main content
Glama

CorroborateMe

integration_upsert

Destructive

Store or replace an encrypted integration secret for a provider such as Google or Apple. Use this before login-link social sign-in needs that provider's credentials. Requires a company API key (aa_...) or an MCP OAuth access token and an active plan. Returns id and prefix (first four and last four characters of the secret). The full secret is not returned. The value is encrypted at rest. A later upsert with the same provider and the same label replaces that stored secret. A different label inserts another row. Each successful call consumes integration quota, including a repeat with the same secret. A missing subscription returns an error result with status 402 (subscription_required). Exhausted quota returns status 429 (quota_exceeded). Use integration_list to see which providers are already stored.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
labelNoOptional label. When omitted, the stored label is an empty string. The same provider and label replaces the existing secret. A different label stores another secret.
secretYesProvider secret to encrypt and store. Later reads return only a prefix, not this value.
providerYesIntegration provider id, such as Google or Apple. Together with label, this selects the row to insert or replace.

Schema Changelog

Changes observed during successful MCP inspections.

  1. First observed

TDQS

A4.6/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Despite annotations already covering safety (readOnlyHint=false, destructiveHint=true), the description adds substantial non-obvious behavior: encryption at rest, only id and prefix returned, replace-vs-insert semantics keyed on provider+label, per-call quota consumption even on repeats, and specific 402/429 error statuses. Nothing here contradicts the annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Sentences are short and the primary purpose, precondition, and failure modes are front-loaded. The label replace/insert rule is repeated from the schema, adding mild redundancy, but overall the text is dense and earns most of its length.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema, the description carries the return-value burden and does so well (id and prefix, not the full secret). Combined with quota, error codes, and the sibling pointer, an agent has everything needed to call this mutation correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so provider, label, and secret are already fully documented in the schema, including the label replace/insert rule. The description restates the same label semantics and adds no syntax or format detail beyond the structured fields, so the baseline of 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The first sentence states a specific verb set (store or replace), the resource (encrypted integration secret), and the scope (per provider such as Google or Apple). This is clearly distinguishable from siblings like integration_list and create_login_link.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It gives an explicit precondition ('Use this before login-link social sign-in needs that provider's credentials') and routes the agent to the sibling integration_list to discover which providers already exist. Quota and subscription error paths are also flagged, so the agent knows when the call will fail.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Try in Browser

Glama MCP Gateway

Add one secure layer between your agents and this server.