Cooper Email

List connected apps

cooper_list_oauth_grants

Read-onlyIdempotent

Use this when you need to see which OAuth apps currently hold access to this account, for example before revoking one. Read-only; requires auth. No inputs. Returns {object:"list", data:[{object:"oauth_grant", id, client_id, client_name, redirect_hosts, scope, resource, connected_at, last_refreshed_at, active_tokens}]}. One row per client that still has a usable token. An expired access token is included while its refresh token can still be used. client_name is empty when the client row is gone. redirect_hosts are hostnames only. Token hashes, refresh hashes, and client secrets are not returned. Newest last_refreshed_at first. An inbox-scoped key receives 403 permission_denied. A key without key_read receives 403 permission_denied. Fails with unauthorized.

Tool call template

This tool declares no required parameters. Add optional parameters from the input schema as needed.

{
  "id": 1,
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "arguments": {},
    "name": "cooper_list_oauth_grants"
  }
}

Input Schema

Name	Required	Description	Default
No arguments

Output Schema

Name	Required	Description	Default
`data`	No	Items on this page, in the order the tool description gives.
`object`	No	Object type name, such as list, message, or thread.

Schema Changelog

Changes observed during successful MCP inspections.

Changed1 schema field changedNov 3, 2026

changedOutput schema / (root)

Previous value: -nullNew value: +{
+  "additionalProperties": true,
+  "description": "Connected OAuth apps.",
+  "properties": {
+    "data": {
+      "description": "Items on this page, in the order the tool description gives.",
+      "items": {
+        "properties": {
+          "client_id": {
+            "description": "OAuth client id of the connected app."
+          },
+          "created_at": {
+            "description": "ISO-8601 time the object was created."
+          },
+          "id": {
+            "description": "Stable id of the returned object. Pass it to the matching get, update, or delete tool."
+          },
+          "object": {
+            "description": "Object type name, such as list, message, or thread."
+          }
+        },
+        "type": "object"
+      }
+    },
+    "object": {
+      "description": "Object type name, such as list, message, or thread."
+    }
+  },
+  "type": "object"
+}

AddedOct 14, 2026

TDQS

A4.6/5.0

Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond the annotations (readOnly/idempotent/non-destructive), it discloses auth requirement, two distinct 403 permission_denied paths (inbox-scoped key, missing key_read), and an unauthorized failure mode. It also documents inclusion rules (expired access tokens kept while the refresh token is usable), empty client_name when the client row is gone, hostname-only redirect_hosts, exclusion of token/refresh hashes and secrets, and sort order.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The usage line is front-loaded and every behavioral sentence carries distinct information (edge cases, exclusions, ordering, error codes). The inline JSON return-shape literal is the one redundant element, since a full output schema already exists, and it is the densest part of the text.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a no-input read tool with an output schema and annotations, the description leaves nothing an agent needs unanswered: when to call it, what it returns, which rows are included, what is redacted, ordering, and the exact failure conditions. The duplicated return-shape detail is redundant rather than missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool takes no parameters and the description states 'No inputs' explicitly, so there is nothing to disambiguate. A zero-parameter tool lands at the baseline of 4; nothing further could be added.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource ('see which OAuth apps currently hold access to this account') and scopes it to a single account. It is immediately distinguishable from the mutation sibling cooper_revoke_oauth_grant, which it references as the follow-up action.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It gives an explicit use case ('for example before revoking one'), which routes the agent to this tool as the read step preceding cooper_revoke_oauth_grant. There is no explicit when-not guidance, but for a zero-input read-only listing tool the applicable context is fully covered.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

All Cooper Email tools Inspect

Try in Browser

One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

Glama MCP Gateway

Add one secure layer between your agents and this server.