Cromanion

cromanion_open_claim

Start here, and you need nothing to do it — no API key, no human. This call takes no credential and creates NOTHING: no account, no key, no charge. It returns a challenge to publish on the site you manage (a file, a meta tag or a DNS record — whichever your hosting lets you write) and the secret you will authenticate with once the proof is read. That proof is the whole trust model: we cannot take your word for an email address, but we can check what you control. Store the secret; it is shown once. Refuses if the address already has an account, because controlling a site does not prove controlling a mailbox.

Input Schema

TableJSON Schema

Name	Required	Description
`agent`	No	Optional: what you call yourself, for support and audit.
`email`	Yes	Your human's email. It becomes the account's login.
`siteUrl`	Yes	The public URL of the site to optimize, e.g. https://example.com.

Output Schema

TableJSON Schema

Name	Required	Description
`ok`	Yes
`domain`	Yes	The domain we resolved from your siteUrl, and the one the proof must appear on.
`proofs`	Yes	The three ways to prove control, each with the exact URL and the exact string. Publish any ONE, then call cromanion_verify_claim.
`secret`	Yes	Shown ONCE. Store it now — we keep only its hash, so a lost secret means a new claim.
`claimId`	Yes	This claim's id, for your own logs.
`challenge`	Yes	The random string to publish. It proves this claim and no other.
`expiresAt`	Yes	ISO timestamp. Redeemable until then; after that, open another.
`verifyUrl`	No	The HTTP equivalent of cromanion_verify_claim, if you would rather curl it.

Schema Changelog

Changes observed during successful MCP inspections. Dates show when Glama detected each change.

Changed1 schema field changedSep 6, 2026

changedOutput schema / (root)

Previous value: -nullNew value: +{
+  "properties": {
+    "challenge": {
+      "description": "The random string to publish. It proves this claim and no other.",
+      "type": "string"
+    },
+    "claimId": {
+      "description": "This claim's id, for your own logs.",
+      "type": "string"
+    },
+    "domain": {
+      "description": "The domain we resolved from your siteUrl, and the one the proof must appear on.",
+      "type": "string"
+    },
+    "expiresAt": {
+      "description": "ISO timestamp. Redeemable until then; after that, open another.",
+      "type": "string"
+    },
+    "ok": {
+      "type": "boolean"
+    },
+    "proofs": {
+      "description": "The three ways to prove control, each with the exact URL and the exact string. Publish any ONE, then call cromanion_verify_claim.",
+      "type": "object"
+    },
+    "secret": {
+      "description": "Shown ONCE. Store it now — we keep only its hash, so a lost secret means a new claim.",
+      "type": "string"
+    },
+    "verifyUrl": {
+      "description": "The HTTP equivalent of cromanion_verify_claim, if you would rather curl it.",
+      "type": "string"
+    }
+  },
+  "required": [
+    "ok",
+    "claimId",
+    "secret",
+    "challenge",
+    "domain",
+    "expiresAt",
+    "proofs"
+  ],
+  "type": "object"
+}

First observedSep 6, 2026

TDQS

A4.4/5.0

Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description goes well beyond annotations: it states no credential is needed, no account/key/charge is created, the secret is shown only once, and the call refuses for already-registered addresses. It also explains the trust model behind the challenge, giving the agent accurate expectations about side effects and auth. No contradiction with readOnlyHint=false exists because 'creates NOTHING' is qualified as no account, key, or charge.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is front-loaded with 'Start here' and nearly every sentence adds behavioral or usage value, but it is slightly verbose: 'no API key, no human' and 'takes no credential' are redundant, and the trust-model sentence is explanatory rather than invocation-critical. Still well-structured for a security-sensitive flow.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the output schema exists and the input schema is fully covered, the description provides everything else an agent needs: prerequisites, side-effect profile, what the returned challenge/secret are for, the one-time display warning, and the already-has-account refusal condition. Nothing important is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the input schema already documents email, siteUrl, and agent. The description only loosely reinforces that email is the login and siteUrl is the site the user controls, adding no new syntax, constraints, or format details beyond the schema. Baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with 'Start here' and clearly identifies the tool as the entry point for a Cromanion signup: it returns a challenge and a one-time secret for proving site control. It also distinguishes itself from later verification steps by describing the challenge-then-proof flow, so an agent can tell it apart from siblings like cromanion_verify_claim.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

'Start here' gives explicit when-to-use context, and the description states there is no API key or human needed and that the call refuses if the email already has an account. It does not name sibling alternatives explicitly, but the entry-point positioning and failure condition provide clear usage guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

All Cromanion tools Inspect

Try in Browser

RayrunBuild, deploy, and operate MCP servers without becoming an infrastructure team.ray.runAd

Glama MCP Gateway

Add one secure layer between your agents and this server.

TDQS

A4/5.0

Disambiguation5/5

Each tool maps to a distinct resource or action—state reads (config, pending, grants, site_status), mutations (set_*, add_goal, decide), and lifecycle steps (open_claim, verify_claim, claim_domain) are clearly separated by detailed descriptions. Even similar-sounding tools like install_check vs site_status are explicitly differentiated.

Naming Consistency3/5

All tools share the cromanion_ prefix and snake_case, but the action-object pattern is inconsistent: many are verb_noun (set_mode, verify_claim), while others are bare nouns or verbs (config, pending, crawl, decide, surfaces). This mixed convention is readable but not predictable.

Tool Count3/5

24 tools is at the high end; the server covers a broad domain and each tool has a distinct job, but the set feels heavy with many narrow configuration endpoints (set_brand, set_voice, surfaces, exclusions). It is not bloated enough to be chaotic, but it is borderline.

Completeness4/5

The surface covers the full lifecycle from claim/verify/install through goal definition, rules, decisions, measurement, and lead delivery. Minor gaps exist—no account/site deletion, no broader integration management—but agents can accomplish core workflows without dead ends.

Resources

Need Help?