Skip to main content
Glama

Send verification

send_verification
Destructive

Send a one-time verification code (OTP) to a phone number by text, or to an email address with channel "email". TextKit generates the code, handles expiry (10 min) and attempt limits (5), and blocks SMS-pumping and email-bombing abuse.

Input Schema

NameRequiredDescriptionDefault
fromNoOptional, channel `sms` only: send from a number you own instead of the TextKit pool
emailNoThe address to email the code to (channel `email`). Disposable addresses are refused.
phoneNoThe number to text the code to (channel `sms`). `to` works too.
channelNoHow the code goes out. `sms` needs `phone`; `email` needs `email`.sms
user_ipNoOptional. Your end user's IP address, as your server saw it. With it, one person requesting codes for many numbers or addresses is limited (20 an hour per IP on your account, texts and emails together); without it there is no per-IP limit, since requests come from your server.
app_nameNoYour product name, shown in the message
customer_idNoOptional: attribute the verification to one of your customers
idempotency_keyNoOptional. Retries are already safe: the same call with the same inputs within 10 minutes is done once and answers with the first result. Pass your own key to dedupe across a longer gap, or a new one to repeat an identical call on purpose.

Schema Changelog

Changes observed during successful MCP inspections.

  1. First observed

TDQS

A3.6/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare destructiveHint=true, idempotentHint=false and openWorldHint=true, and the description adds real value beyond them: it discloses that TextKit generates the code, that expiry is 10 minutes, that attempt limits are 5, and that SMS-pumping/email-bombing abuse is blocked. What's missing is any statement of what the call returns (a verification id?) and whether rate limits or costs apply per send.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single dense sentence that front-loads the action and the two channels before the lifecycle details. Efficient, though the clause list about expiry/limits/abuse is packed tightly enough to be slightly hard to scan.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For an 8-parameter, zero-required, mutating tool with no output schema, the description covers the send lifecycle well but omits the return shape — critically, whether a verification id/handle comes back for a later check_verification call. That omission is the main completeness gap.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already explains phone/email/channel/from/user_ip/idempotency_key in detail; the description only restates the channel mapping. Baseline 3 is appropriate — it adds little meaning the schema does not already carry.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource — sending a one-time verification code (OTP) — plus the two delivery channels (SMS text or email). The OTP framing implicitly separates it from the generic send_message sibling, but no sibling is named explicitly, so an agent must infer the boundary with check_verification/fallback_verification.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage is only implied: 'to a phone number by text, or to an email address with channel "email"' hints at channel selection, but there is no explicit when-to-use, when-not-to-use, or pointer to the natural follow-up (check_verification) for validating the code.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Try in Browser

Glama MCP Gateway

Add one secure layer between your agents and this server.

Resources