FlowState Hosted

manage_variables

Destructive

Non-secret project settings: hosts, ports, endpoints, config. create, list (read), update (undo with manage_history), delete (undo restores it; with approvals on it waits for the user; refused for HTTP app keys and remote apps). Secrets are refused; is_secret only labels a value and does not hide it, so never store passwords, tokens or keys. Requires project. Returns variable rows.

Tool call template

Replace each placeholder with a value matching the input schema. Only required parameters are included; add optional parameters as needed.

{
  "id": 1,
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "arguments": {
      "action": "<action>",
      "project": "<project>"
    },
    "name": "manage_variables"
  }
}

Input Schema

Name	Required	Description
`name`	No	create: name, unique per project and category (required). update: a new name.
`model`	No	Model name if known. Never guess.
`value`	No	create / update: the setting as text. Never a secret.
`action`	Yes	The operation; see the tool description.
`project`	Yes	Project name or id. Required.
`category`	No	create / update: the group, default custom. list: filter.
`is_secret`	No	create / update: label as sensitive. It is still returned by list.
`description`	No	create / update: what it is for.
`variable_id`	No	update / delete: the variable's id (required).

Schema Changelog

Changes observed during successful MCP inspections.

First observedNov 7, 2026

TDQS

A4.4/5.0

Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond the annotations (destructiveHint=true, idempotentHint=false), the description discloses that deletes are undoable and may block on user approval, that updates are reversible through manage_history, and that certain key types are refused outright. The explicit warning that is_secret is only a label and does not hide the value is behavioral context an agent cannot get from annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The scope statement is front-loaded and every clause carries information, with per-action behavior packed into parentheticals. It is dense but not padded; a slight readability cost from the stacked parenthetical clauses keeps it off a 5.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a nine-parameter CRUD tool with a destructive annotation, the description covers refusals, undo semantics, approval gating, secret handling, the required project, and the return shape ('Returns variable rows'). Nothing an agent needs in order to call it safely is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already documents all nine parameters including enum meanings and per-action requirements. The description only adds emphasis on the secrets constraint for value/is_secret, which is a marginal increment over the schema text that already says the value is still returned by list.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description names the resource precisely (non-secret project settings: hosts, ports, endpoints, config) and enumerates the four supported verbs (create, list, update, delete). It also separates itself from the sibling manage_history by naming it as the undo path, so an agent can distinguish this tool without opening a schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It gives concrete when-to-use context: list is flagged as read, update is described as undoable via manage_history, and delete is described as undoable/approval-gated. It also states hard exclusions (HTTP app keys, remote apps, secrets), though it never routes the agent to a sibling for those refused cases.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

All FlowState Hosted tools Inspect

Try in Browser

One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

Glama MCP Gateway

Add one secure layer between your agents and this server.

Resources

Need Help?