Skip to main content
Glama

Set Outside Expectations (daily re-check)

set_expectations

Record what a domain should show from outside and check it now — HSTS or another header present, DMARC enforcing, an issue key no longer reported, an HTTP or TLS grade at or above a level, a certificate with enough days left, a DNS record present, absent or containing a value, HTTPS answering. DechoNet reads the domain fresh (not from cache) with its public dns / ssl / http / email tools, from its own servers and the Seoul observation point, and then re-checks the set every day. Each result is pass, fail or unknown; unknown (a tool or part of it did not answer) is never a pass. Without an API key the set is anonymous: no alerts, kept 30 days after its last check, reachable by id and status page. With an API key (Authorization: Bearer dn_…) the set belongs to that key's account, and a set that held and stops holding is reported in the account's daily mail. Not read-only (it stores the set); public checks only, so any domain is accepted. Typical use: after changing DNS, TLS, headers or mail settings, to state the intended result and be told if it is ever reverted. Returns the set id, status page, per-check results with where to fix what does not hold (for the platform the site runs on), and signed observation receipts.

Input Schema

NameRequiredDescriptionDefault
labelNoOptional short name for the set (shown on its page and in the mail)
domainYesDomain the checks are about (e.g. 'example.com'); scheme and path are stripped
expectYesChecks, 1-20

Output Schema

NameRequiredDescriptionDefault
idNoExpectation set id (stored sets)
urlNoStatus page of the set: last results and recent checks
ownerNo'account' (alerts by the API key account's daily mail) or 'anonymous' (no alerts)
stateYes'pass' (every check holds) | 'fail' (at least one does not) | 'unknown' (some could not be read — not a pass)
domainYes
storedYesWhether DechoNet keeps re-checking this set daily
resultsYes
receiptsNoSigned observation receipts behind this result, one per lookup: when, from where and under which rules version DechoNet observed it. Each url shows the record and checks its Ed25519 signature.
checkedAtNo
expiresAtNoAnonymous sets: removed after this unless checked again

Schema Changelog

Changes observed during successful MCP inspections.

  1. Changed1 schema field changed
    • addedOutput schema / properties / results / items / properties / fix
      Added value: +{
      +  "description": "Where to fix a check that does not hold, for the platform the site runs on (Cloudflare, Vercel, Netlify, nginx, Apache) or its DNS host",
      +  "properties": {
      +    "doc": {
      +      "type": "string"
      +    },
      +    "note": {
      +      "type": "string"
      +    },
      +    "platform": {
      +      "type": [
      +        "string",
      +        "null"
      +      ]
      +    },
      +    "snippet": {
      +      "type": "string"
      +    },
      +    "where": {
      +      "type": "string"
      +    }
      +  },
      +  "required": [
      +    "where"
      +  ],
      +  "type": "object"
      +}
  2. Added

TDQS

A4.1/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Goes well past the annotations: it discloses the daily re-check cadence, that unknown is never treated as a pass, the anonymous-vs-API-key split (no alerts and 30-day retention vs account ownership and daily mail on regression), the Bearer token requirement, and that results come from DechoNet's own servers plus a Seoul observation point. It also confirms the write nature ('Not read-only (it stores the set)'), consistent with readOnlyHint=false and destructiveHint=false.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded with the core action and check kinds, then layered auth/retention/return details. It is a dense single paragraph and borderline long, with some restatement ('Not read-only (it stores the set)' echoes annotations, and the check list duplicates the schema), but nearly every sentence carries information an agent needs.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with a nested expect array, auth-dependent behavior and a daily background job, the description covers the missing pieces: who owns the set, what happens without a key, retention, alert channel, observation sources, and unknown-vs-fail semantics. An output schema exists, yet it still briefly frames what comes back (set id, status page, per-check results, receipts), which is more than required.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100% and the nested item schema already documents each check kind, its required fields and the op/value/type enums, so the baseline is 3. The prose list of check examples largely restates that enum rather than adding new parameter meaning (e.g. no guidance on how op interacts with value for dns_record 'contains,' or on the 1-20 maxItems).

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The opening clause gives a specific verb+resource pair — record an outside expectation set for a domain and check it now — plus the concrete check kinds (HSTS, DMARC, issue_absent, grade, cert days, DNS record) and the daily re-check behavior. It is unmistakably distinct from one-shot tools like ssl_check or http_security. It never names verify_expectations, the sibling most likely to be confused with it, so sibling differentiation is only implicit.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives a clear triggering scenario: 'after changing DNS, TLS, headers or mail settings, to state the intended result and be told if it is ever reverted,' plus the scoping rule 'public checks only, so any domain is accepted.' It does not state when to prefer verify_expectations (re-check an existing set) over creating a new one, which is the one alternative an agent actually needs.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Try in Browser

Glama MCP Gateway

Add one secure layer between your agents and this server.

Resources