Cooper Email

Revoke a connected app

cooper_revoke_oauth_grant

DestructiveIdempotent

Use this when an OAuth app should lose access to this account. Requires auth. Destructive. Inputs: client_id (required; the OAuth client id from cooper_list_oauth_grants). Deletes every access and refresh token for that client on this account, and every unused authorization code for that client, in one transaction. The client registration stays, so the app can connect again. Returns {object:"oauth_grant", id, revoked:true, tokens_revoked}. tokens_revoked is how many token rows were removed. Those access tokens then return 401, and their refresh tokens fail at /oauth/token. Other apps and API keys keep working. An unknown client, or a client that belongs to another account, returns 404 oauth_grant_not_found. An inbox-scoped key receives 403 permission_denied. A key without key_write receives 403 permission_denied.

Input Schema

Name	Required	Description	Default
`client_id`	Yes	OAuth client id from cooper_list_oauth_grants. This is the grant id.

Output Schema

Name	Required	Description
`id`	No	Stable id of the returned object. Pass it to the matching get, update, or delete tool.
`object`	No	Object type name, such as list, message, or thread.
`revoked`	No	True when the grant was revoked.
`tokens_revoked`	No	How many token rows were removed.

Schema Changelog

Changes observed during successful MCP inspections.

Changed1 schema field changedNov 3, 2026

changedOutput schema / (root)

Previous value: -nullNew value: +{
+  "additionalProperties": true,
+  "description": "The revoked grant.",
+  "properties": {
+    "id": {
+      "description": "Stable id of the returned object. Pass it to the matching get, update, or delete tool."
+    },
+    "object": {
+      "description": "Object type name, such as list, message, or thread."
+    },
+    "revoked": {
+      "description": "True when the grant was revoked."
+    },
+    "tokens_revoked": {
+      "description": "How many token rows were removed."
+    }
+  },
+  "type": "object"
+}

AddedOct 14, 2026

TDQS

A4.7/5.0

Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already flag destructive and idempotent, but the description goes well beyond: it enumerates exactly what is deleted (all access and refresh tokens plus unused authorization codes, in one transaction), what survives (client registration, other apps, API keys), and the downstream effect (401 on old access tokens, refresh failure at /oauth/token). Error semantics for permission (403 permission_denied for inbox-scoped and key_write-less keys) and 404 cases are disclosed, which is the behavior an agent needs to handle failure.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded purpose, then auth/destructive flags, then input, then effect, then return shape, then errors — a logical call-order structure with no filler sentences. Dense but every clause carries operative information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a single-parameter destructive tool with an output schema, this covers everything: what is destroyed, what is preserved, the return payload including the meaning of tokens_revoked, and the distinct error responses. Nothing an agent needs to invoke or recover from this call is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is already 100% and says client_id comes from cooper_list_oauth_grants, so the baseline is 3. The description adds real semantic value by tying the parameter to failure modes (unknown or other-account client yields 404 oauth_grant_not_found), which tells the agent how to obtain and validate the value before calling.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('OAuth app should lose access to this account', token/code deletion for a client) and distinguishes itself from the close sibling cooper_list_oauth_grants by naming it as the source of client_id, plus clarifies what is NOT removed (the client registration).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives a clear trigger condition ('when an OAuth app should lose access to this account') and tells the agent the grant persists so the app can reconnect, which implicitly frames when not to use it. It stops short of naming any alternative tool for full client deletion, which may not exist in this sibling set.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

All Cooper Email tools Inspect

Try in Browser

One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

Glama MCP Gateway

Add one secure layer between your agents and this server.