MCPFax Agent Continuity
Server Details
Durable state, leases and work queues so agents resume work across sessions and providers.
- Status
- Healthy
- Last Tested
- Transport
- Streamable HTTP
- URL
Glama MCP Gateway
Connect through Glama MCP Gateway for full control over tool access and complete visibility into every call.
Full call logging
Every tool call is logged with complete inputs and outputs, so you can debug issues and audit what your agents are doing.
Tool access control
Enable or disable individual tools per connector, so you decide what your agents can and cannot do.
Managed credentials
Glama handles OAuth flows, token storage, and automatic rotation, so credentials never expire on your clients.
Usage analytics
See which tools your agents call, how often, and when, so you can understand usage patterns and catch anomalies.
Tool Definition Quality
Average 4.4/5 across 33 of 33 tools scored. Lowest: 3.3/5.
Every tool targets a clearly distinct mechanism—barriers, budgets, checkpoints, claims, heartbeats, inboxes, leases, work queues, etc. Even closely related pairs like claim/complete, work_done/inbox_ack, and barrier_status/work_status are explicitly differentiated in their descriptions, so an agent can reliably select the right tool.
The dominant pattern is object_verb (e.g., checkpoint_get, work_push, seen_add, lease_release), which is consistent and readable. A few single-word verbs (claim, complete, send) and noun-only names (resume_packet, retry_state, whoami) break the pattern, but they are few and still intuitive.
With 33 tools, the surface is well beyond the 25-tool threshold for 'too many' and will feel heavy for agents to explore, even though the tools are organized into subdomains. The scope is broad, but the sheer number makes the server less approachable and increases the chance of misselection.
The tool set provides thorough lifecycle coverage across its domains: checkpoints get/put, work queue push/take/done/fail/status, inbox poll/ack/nack/schedule, lease acquire/renew/release, barrier create/signal/status, dedup add/check, watermark get/set, retry state, budget check/record, and idempotency claim/complete. There are no obvious dead ends or missing essential operations.
Available Tools
33 toolsbarrier_createOpen a join point for fan-out workAIdempotentInspect
Fan work out to N agents and have the LAST one to finish wake the joiner. FREE. A BARRIER THAT WAITS FOR ALL N IS A HANG WAITING TO HAPPEN, so stragglers are the normal case here, not an edge case: set min_count and/or deadline_seconds and we fire on whichever comes first, ALWAYS naming the participants that did not report. Exactly ONE envelope is queued to notify_address, carrying every participant's payload; that delivery is billed by the existing inbox_poll rule, so there is no new charge. If nothing has fired by the TTL we queue a barrier_timeout envelope naming the missing participants — a timeout is information and is delivered, never silently dropped. REUSING A BARRIER_ID IS THE NORMAL PATTERN: while a join is still open this call is idempotent and refuses to reset it (created:false), because a retrying agent must not be able to reset a join others are signalling — but once it has fired or timed out, calling barrier_create with the same id opens a NEW GENERATION with your new roster, and that generation gets its own notification. FREE — this tool never charges. Authenticate with Authorization: Bearer , or pass agent_key as an argument if your host cannot set headers. Equivalent HTTP route: POST /v1/barrier/create.
| Name | Required | Description | Default |
|---|---|---|---|
| agent_key | No | Your agent_secret, if your MCP host cannot set the Authorization header. Prefer the header. | |
| min_count | No | Fire as soon as THIS many have signalled, instead of waiting for all of them. Default: expected_count. Set it lower and a straggler cannot hang the join. Example: '2'. | |
| objective | No | Optional text carried into every envelope so the joiner knows what it is being woken for. <=2048 chars. Example: 'Roll up the three regional reports'. | |
| barrier_id | Yes | Your name for this join point. Namespace-scoped; stored in plain text so a timeout can name it back to you. Example: 'quarterly-rollup-2026q3'. | |
| ttl_seconds | No | How long the barrier lives before timing out. Default 3600, min 5, max 2592000. Example: '3600'. | |
| participants | No | Optional roster of participant ids. Supply it and every notification names exactly who is missing; omit it and we can only report the shortfall. A signal from outside the roster is recorded but does NOT count toward the threshold. Example: '["a","b","c"]'. | |
| expected_count | No | How many participants you expect. 1..500. Defaults to the length of `participants` when you supply a roster. Example: '3'. | |
| notify_address | Yes | Where the completion, deadline or timeout envelope goes. Must be registered. WRITE-ONLY: we queue into it and never read it. Example: 'agent:7k2p.../joins'. | |
| deadline_seconds | No | Fire at this many seconds from now with whoever has signalled, whether or not min_count was reached. Must be <= ttl_seconds. The notification names who did not report. Example: '600'. |
Tool Definition Quality
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description goes far beyond the annotations. It discloses idempotency nuances, guaranteed timeout delivery, free billing, write-only notify_address, plain-text barrier_id storage, and the fact that out-of-roster signals do not count. This is exactly the behavioral context an agent needs, and it does not contradict the annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is information-dense and front-loaded, but it is also bloated: 'FREE' appears twice, the all-caps warning is long, and some clauses repeat the same idea. It is structured enough to follow, but it would benefit from tightening.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 9-parameter mutation tool with no output schema and minimal annotations, this description is exceptionally complete. It covers lifecycle, idempotency, timeout behavior, billing, authentication, and notification semantics, leaving little ambiguity for an agent deciding whether and how to call it.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema already covers all 9 parameters at 100%, and the description adds meaningful semantics on top: min_count/default/expected_count interaction, deadline_seconds bound to TTL, write-only notify_address, and the plain-text nature of barrier_id. Not every parameter is re-explained in prose, but the key nuances are there.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Name and title clearly identify the action: opening a join point for fan-out work. The description adds the specific 'last one to finish wakes the joiner' semantics and distinguishes the tool from siblings like barrier_signal and barrier_status by focusing on creation and lifecycle reuse.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives rich contextual guidance: when to fan out work, when to use min_count/deadline_seconds, what happens on timeout, and how reusing a barrier_id creates new generations. It does not explicitly name alternatives or state 'use X instead of Y', but the sibling names plus this context make the intended usage clear.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
barrier_signalSignal that your part is doneAIdempotentInspect
Report that one participant finished, optionally attaching a payload the joiner will receive. FREE and IDEMPOTENT PER PARTICIPANT — the same participant_id signalling twice counts once and never double-fires the join. The barrier is a single Durable Object, so N simultaneous signals produce exactly one notification. A signal to a join that ALREADY FIRED on min_count is still recorded and reported in barrier_status, but it cannot fire a second notification — the joiner was already told, and was told exactly who was missing. A signal to a join that has TIMED OUT or passed its TTL is REFUSED with signalled:false, reason 'expired': your payload did NOT reach the joiner, so do not assume it did. That barrier_id is not locked — call barrier_create with it to open a new generation of the join. FREE — this tool never charges. Authenticate with Authorization: Bearer , or pass agent_key as an argument if your host cannot set headers. Equivalent HTTP route: POST /v1/barrier/signal.
| Name | Required | Description | Default |
|---|---|---|---|
| payload | No | Optional opaque result for the joiner, <=8192 bytes. Never parsed, indexed or logged. Example: '{"rows":128}'. | |
| agent_key | No | Your agent_secret, if your MCP host cannot set the Authorization header. Prefer the header. | |
| barrier_id | Yes | The barrier to signal. Example: 'quarterly-rollup-2026q3'. | |
| participant_id | Yes | Who is signalling. <=128 chars, stored in plain text so a timeout can name who is missing. Example: 'region-north'. |
Tool Definition Quality
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Beyond the annotations (idempotentHint=true), the description reveals significant behavioral context: the Durable Object design ensures N simultaneous signals produce exactly one notification; already-fired joins still record the signal but cannot double-fire; expired joins refuse with signalled:false and reason 'expired'; and the tool is free. No contradictions with annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is long but every section adds value: core action, idempotency, concurrency, edge cases (already-fired, expired), and auth/route. It's front-loaded with the primary verb and uses headers-like caps (FREE, IDEMPOTENT) to highlight key properties. No redundant sentences.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a complex tool with no output schema, the description covers behavior thoroughly (edge cases, failure modes, and next steps). However, it does not explicitly state the response shape for a successful signal (only references signalled:false in the expiry case), leaving a minor gap in expectations. Overall it's sufficiently complete for most use cases.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Although the input schema covers all 4 parameters (100% coverage), the description adds semantic meaning: it explains that payload is 'what the joiner will receive' and that on expiry the payload will not reach the joiner ('your payload did NOT reach the joiner'), and it ties participant_id to the idempotency behavior. It does not add syntax details but clarifies the lifecycle implications, so it goes beyond the schema baseline of 3.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a specific verb+resource: 'Report that one participant finished, optionally attaching a payload the joiner will receive.' This clearly distinguishes it from sibling tools like barrier_create and barrier_status, which handle creation and status checks respectively. The scope (one participant at a time) is explicit.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides explicit when-not and alternative guidance: signals to a timed-out or TTL-passed join are refused with reason 'expired', and in that case the caller should 'call barrier_create with it to open a new generation.' Also notes the idempotency property ('the same participant_id signalling twice counts once'), which informs safe retry behavior. It doesn't explicitly compare with barrier_status, but the guidance is concrete.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
barrier_statusHow far along is the joinAIdempotentInspect
Progress on a join point: how many of the expected participants have signalled, which ones, who is still outstanding, and whether the completion or timeout envelope has been queued. $0.002 ONLY when there is real progress to report (at least one signal) AND the answer has changed since you last paid for it — an untouched barrier, or a repeat of an answer you already bought, costs nothing and says so. Costs $0.002 USDC per call via x402 on Base, and ONLY when signals >= 1, and this exact progress state has not been billed before; otherwise the same call returns the full answer and settles nothing. Authenticate with Authorization: Bearer , or pass agent_key as an argument if your host cannot set headers. Equivalent HTTP route: POST /v1/barrier/status.
| Name | Required | Description | Default |
|---|---|---|---|
| agent_key | No | Your agent_secret, if your MCP host cannot set the Authorization header. Prefer the header. | |
| barrier_id | Yes | The barrier to inspect. Example: 'quarterly-rollup-2026q3'. |
Tool Definition Quality
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description goes beyond annotations by disclosing the billing behavior (only charges when new progress exists and not previously billed), authentication requirements (Bearer header or agent_key), and the HTTP route. It also clarifies that an untouched barrier or repeated answer is free and says so. This adds substantial context beyond readOnlyHint/idempotentHint.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is thorough but contains redundancy: the billing rule is stated twice with nearly identical wording ('$0.002 ONLY when...' and 'Costs $0.002 USDC per call... ONLY when...'). The content is front-loaded and structured, but the repetition could be trimmed.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema, the description must convey the return shape. It does so by listing the progress components (count, which participants, outstanding, envelope state). It also covers billing and authentication, making the tool's behavior fully understandable in context.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Parameter schema coverage is 100%, so baseline is 3. The description adds meaning for agent_key by explaining when to use it (if host cannot set headers), and it reinforces barrier_id usage through the context of inspecting a join point. It doesn't add extensive new detail, but the auth guidance is valuable.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action: reporting progress on a join point, including counts, which participants signaled, who is outstanding, and whether completion/timeout is queued. This uses a specific verb ('progress on') and resource ('join point'), and it naturally distinguishes from sibling tools like barrier_create and barrier_signal.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives clear context for when the tool is useful (inspecting barrier progress) and explains the billing condition—when it costs money and when it does not. However, it does not explicitly mention alternatives or when not to use it, though the purpose is fairly unambiguous.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
budget_checkWhat has this work cost meAIdempotentInspect
What this unit of work has actually cost across every session, with a per-label breakdown and a lifetime total. If a limit is set (or you pass one here) we report over_limit — WE REPORT, WE NEVER BLOCK: enforcement is the caller's decision and we will not pretend to an authority we do not have. Amounts come back byte-exact in the units you supplied. $0.002 ONLY when there is recorded history in the window; an empty ledger tells you so and costs nothing, and asking again for an unchanged total is free. Costs $0.002 USDC per call via x402 on Base, and ONLY when count >= 1 in the requested window, and this exact total has not been billed before; otherwise the same call returns the full answer and settles nothing. Authenticate with Authorization: Bearer , or pass agent_key as an argument if your host cannot set headers. Equivalent HTTP route: POST /v1/budget/check.
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | Optional. Compare against this limit for this call only, instead of the one stored on the scope. Example: '1.00'. | |
| scope | Yes | The unit of work. Example: 'permit-review-2026-08'. | |
| agent_key | No | Your agent_secret, if your MCP host cannot set the Authorization header. Prefer the header. | |
| window_seconds | No | How far back to total. Default 86400 (1 day), max 31536000 (365 days). The lifetime total is always reported alongside it. Example: '86400'. |
Tool Definition Quality
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description goes far beyond annotations. It discloses billing behavior ($0.002 USDC per call, conditions when charged), idempotent-like behavior (unchanged total is free), authentication requirements, and edge cases (empty ledger costs nothing). It also clarifies the tool never blocks. No contradiction with annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is longer than typical but every sentence carries important information about billing, limits, and authentication. It is front-loaded with the core purpose. Some phrasing like 'we will not pretend to an authority we do not have' is slightly theatrical, but the overall structure is efficient and justified given the complexity.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (billing side effects, authentication, multiple conditions) and lack of output schema, the description is remarkably complete. It covers return semantics (byte-exact, over_limit, empty ledger behavior), cost model, and authentication methods. An agent can fully understand how to invoke and interpret this tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so baseline is 3. The description adds some context for 'limit' (pass one here) and 'agent_key' (if host cannot set headers), but does not significantly improve parameter understanding beyond the schema's own descriptions. It earns a solid 3.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose: 'What this unit of work has actually cost across every session, with a per-label breakdown and a lifetime total.' It also distinguishes itself as a reporting/checking tool (not an enforcement tool) with 'WE REPORT, WE NEVER BLOCK.' This is a specific verb+resource combination that differentiates from siblings like budget_record.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides clear usage context: when to use (checking costs against limits), behavior when limits are exceeded, and billing conditions. It implicitly excludes using it for enforcement ('enforcement is the caller's decision'). However, it does not explicitly name alternative tools like budget_record, missing the 'alternatives' component for a 5.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
budget_recordRecord a spend against a unit of workAInspect
An agent cannot see its own spend across sessions, so runaway cost is invisible until the bill arrives. Append one amount to this scope's ledger. FREE and APPEND-ONLY — nothing is overwritten and nothing is silently dropped; when the ledger is full, adds are REFUSED. The amount is an OPAQUE DECIMAL STRING stored byte-exact as you send it: we never convert a currency, never assume six decimals and never touch a float. Totals are summed as exact integers at the widest scale you actually used. FREE — this tool never charges. Authenticate with Authorization: Bearer , or pass agent_key as an argument if your host cannot set headers. Equivalent HTTP route: POST /v1/budget/record.
| Name | Required | Description | Default |
|---|---|---|---|
| label | No | What the money went on, so budget_check can break the total down. <=64 chars, stored in plain text. Example: 'resume_packet'. | |
| limit | No | Optional. Set or update this scope's limit, as a decimal string. We only ever REPORT against it — we never block a call, because enforcement is your decision and not our authority. Example: '1.00'. | |
| scope | Yes | The unit of work this spend belongs to. Namespace-scoped, and the same scope resume_packet reports against. Example: 'permit-review-2026-08'. | |
| agent_key | No | Your agent_secret, if your MCP host cannot set the Authorization header. Prefer the header. | |
| amount_usdc | Yes | A decimal string, e.g. '0.002' or '1.25'. Stored EXACTLY as given and returned byte-identical. Optionally negative for a refund. Never converted or rescaled. Example: '0.002'. | |
| ttl_seconds | No | Ledger retention. Default 2592000 (30d), max 7776000 (90d). Example: '2592000'. |
Tool Definition Quality
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations only set false hints, so the description carries the safety burden. It discloses FREE/no charge, APPEND-ONLY semantics, refusal when full, byte-exact decimal storage, and auth via Authorization header or agent_key, all beyond annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is longer than typical but front-loads the problem statement and key constraints. It repeats 'FREE' twice and includes route info that is useful but not essential, so not perfectly concise.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Covers purpose, append-only behavior, storage format, auth, retention/ttl context, and failure mode when full. It does not describe the response shape, but with no output schema and a simple side-effect tool, this is a minor gap.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema already covers all 6 params with examples, so baseline is 3. Description adds cross-cutting semantics: amount is an opaque decimal string stored byte-identical, refunds are allowed via negative values, limit is never enforced, and agent_key is a fallback to the header.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description uses specific verb 'append' and resource 'ledger' for a scope, explicitly stating it records spend against a unit of work. This clearly differentiates it from sibling budget_check, which presumably reads the same ledger.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description opens with the problem of invisible spend and says to append one amount, making the intended use obvious. It does not explicitly name budget_check as the read-side alternative, so exclusion guidance is implicit rather than explicit.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
checkpoint_getRead the raw checkpointARead-onlyIdempotentInspect
Fetch the last checkpoint verbatim — what was stored, with no briefing composed around it. Most callers want resume_packet instead, which folds in what arrived while you were gone and what we observed you doing. $0.002 ONLY when a checkpoint exists AND its version has changed since you last paid for it — re-reading an unchanged checkpoint is free. If there is none we say so and charge nothing. Costs $0.002 USDC per call via x402 on Base, and ONLY when found === true, and this exact checkpoint version has not been billed before; otherwise the same call returns the full answer and settles nothing. Authenticate with Authorization: Bearer , or pass agent_key as an argument if your host cannot set headers. Equivalent HTTP route: POST /v1/checkpoint/get.
| Name | Required | Description | Default |
|---|---|---|---|
| scope | Yes | The unit of work. Alias: workflow_id. Example: 'permit-review-2026-08'. | |
| agent_key | No | Your agent_secret, if your MCP host cannot set the Authorization header. Prefer the header. |
Tool Definition Quality
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description adds substantial behind-the-scenes behavior beyond annotations: the billing model ($0.002 only when found and version changed), free re-reads, and behavior when no checkpoint exists. It also documents authentication requirements via header or agent_key argument. This complements the readOnlyHint and idempotentHint annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is front-loaded with the purpose, but the billing details are repeated twice ('$0.002 ONLY when...' and 'Costs $0.002 USDC per call...') making it somewhat redundant. However, it remains organized and informative.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Despite lacking an output schema, the description covers the essential context: the tool's purpose, its relationship to resume_packet, billing, authentication, and the equivalent HTTP route. This is more than sufficient for an agent to select and invoke the tool correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema already covers both parameters with descriptions and examples (100% coverage), so the description need not add much. The description does clarify that agent_key is an alternative to the Authorization header, which aligns with the schema. No additional parameter meaning is added.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description explicitly states the tool fetches the last checkpoint verbatim, without a briefing, using a specific verb and resource. It also distinguishes it from resume_packet by noting that most callers should use that alternative instead.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides clear guidance on when not to use this tool: 'Most callers want resume_packet instead' and explains what resume_packet offers. It also implies usage for raw checkpoint retrieval, and optionally mentions authentication alternatives.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
checkpoint_putCheckpoint the workAIdempotentInspect
Save where the work got to, in a STRUCTURED shape so the next invocation can actually act on it. FREE. objective and next_action are REQUIRED and a checkpoint without them is refused — a vague checkpoint produces a vague briefing, so the schema is the guardrail. Work state is small: aim for a few kilobytes, not a transcript. The ENVELOPE (objective, next_action, status, files, risks and the rest) is cleartext and is what resume_packet synthesizes from. The BODY (body, state, provider_extras) is opaque — never parsed, indexed or logged in any mode. Set privacy_mode:'client_key' and encrypt the body yourself if it is sensitive; we then cannot read it and never hold your key. FREE — this tool never charges. Authenticate with Authorization: Bearer , or pass agent_key as an argument if your host cannot set headers. Equivalent HTTP route: POST /v1/checkpoint/put.
| Name | Required | Description | Default |
|---|---|---|---|
| body | No | BODY, OPAQUE. Full context, reasoning, file contents — anything sensitive. Never parsed, indexed or logged in any mode. Send ciphertext here with privacy_mode:'client_key'. | |
| step | No | ENVELOPE. Optional short step label. Example: 'step-3'. | |
| files | No | ENVELOPE. File references or paths — references, not contents. Contents go in `body`. Example: '[]'. | |
| risks | No | ENVELOPE. Known risks. Example: '[]'. | |
| scope | Yes | The unit of work. Alias: workflow_id. Namespace-scoped. Example: 'permit-review-2026-08'. | |
| state | No | BODY, OPAQUE. Free-form resume state, never parsed. Example: '{"cursor":"abc"}'. | |
| due_by | No | ENVELOPE. ISO-8601 deadline for the work, if it has one. Example: '2026-08-20T00:00:00Z'. | |
| status | No | ENVELOPE. Where the work stands, e.g. in_progress / blocked / waiting / done. Your vocabulary; we do not interpret it. Example: 'in_progress'. | |
| evidence | No | ENVELOPE. References supporting the verified state. Example: '[]'. | |
| priority | No | ENVELOPE. 0 (highest) to 9. Example: '5'. | |
| agent_key | No | Your agent_secret, if your MCP host cannot set the Authorization header. Prefer the header. | |
| artifacts | No | ENVELOPE. Artifact references produced so far (ids, URLs). Example: '[]'. | |
| objective | Yes | ENVELOPE. REQUIRED. The goal, as currently stated. <=2048 chars. Example: 'Decide whether permit P-1 is a sales opportunity'. | |
| remaining | No | ENVELOPE. What still has to be done. Example: '["price it","draft the email"]'. | |
| tools_used | No | ENVELOPE. Tools already called, so the next invocation does not redo the work. Example: '[]'. | |
| next_action | Yes | ENVELOPE. REQUIRED. The single next step, concretely. Alias: next_step. <=2048 chars. Example: 'Call the pricing API for SKU-88 and compare to quote'. | |
| ttl_seconds | No | Retention. Default 2592000 (30d), max 7776000 (90d). Example: '2592000'. | |
| dependencies | No | ENVELOPE. What this work depends on. Example: '[]'. | |
| privacy_mode | No | 'none' (default; body stored as given, still never introspected) or 'client_key' (you encrypted it; we cannot read it and never hold your key). 'escrow' is reserved and not enabled. Example: 'none'. | |
| open_questions | No | ENVELOPE. Unresolved questions blocking or shaping the work. Example: '[]'. | |
| verified_state | No | ENVELOPE. A SHORT summary of what was actually CONFIRMED (not assumed). Put the detail in `body`. Example: '{"permit_fetched":true}'. | |
| provider_extras | No | BODY, OPAQUE. Vendor/framework-specific state. Stored and returned verbatim, never interpreted. Example: '{}'. | |
| budget_remaining | No | ENVELOPE. Whatever budget means for you — calls, tokens, USDC. Example: '{"usdc":"0.05"}'. |
Tool Definition Quality
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description goes well beyond the annotations, disclosing that the tool is FREE, that the BODY fields are 'never parsed, indexed or logged in any mode,' that privacy_mode 'client_key' means the provider cannot read the body, and that authentication can be via Authorization header or agent_key. The HTTP route is also provided. These are significant behavioral traits not visible in annotations, and there is no contradiction with the annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is dense and well-structured, with key concepts highlighted (ENVELOPE, BODY, FREE, REQUIRED) and information front-loaded. It contains some redundancy ('FREE' appears twice) and is slightly long, but every sentence carries useful information about behavior, constraints, or security, so the length is justified.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 23-parameter, write-side tool with no output schema, the description is exceptionally complete. It explains the envelope/body architecture, required fields, size guidance, privacy modes, authentication, HTTP route, and the tool's relationship to resume_packet. This covers all key aspects an agent needs to invoke it correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the baseline is 3. The description adds semantic value by explaining the ENVELOPE vs BODY distinction, the requirement for objective/next_action, and the 'schema is the guardrail' rationale. It also clarifies privacy_mode behavior and ttl_seconds retention. This meaningfully augments the schema descriptions without duplicating them.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's function: 'Save where the work got to, in a STRUCTURED shape so the next invocation can actually act on it.' It uses a specific verb ('save') and resource ('work state'), and distinguishes itself from the sibling tool resume_packet by noting the envelope is what resume_packet synthesizes from. This provides clear differentiation from the read/resume side.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives clear context on when to use this tool (to checkpoint structured work state for the next invocation) and implies it is the write counterpart to checkpoint_get/resume_packet. It also provides practical guidance: 'Work state is small: aim for a few kilobytes,' and warns that vague checkpoints are refused. However, it does not explicitly name alternative tools or state when not to use it.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
claimIdempotency claimAIdempotentInspect
Exactly-once guard for work that costs money or has side effects. The first call for a key returns granted:true and is FREE. Every later call for that key returns granted:false with first_claimed_at and, if complete() was called, the stored result — so a retrying agent gets the answer instead of paying for the same paid API call twice. $0.002 is charged the FIRST time a key is denied (and again only if complete() has since attached a new result); repeated denials of the same unchanged fact are free. If we cannot determine the state we return granted:null and you must NOT proceed. Costs $0.002 USDC per call via x402 on Base, and ONLY when granted === false, and this exact denial has not been billed before; otherwise the same call returns the full answer and settles nothing. Authenticate with Authorization: Bearer , or pass agent_key as an argument if your host cannot set headers. Equivalent HTTP route: POST /v1/claim.
| Name | Required | Description | Default |
|---|---|---|---|
| key | Yes | Your idempotency key. Scoped to your namespace; hashed before storage. <=256 chars. Example: 'charge-order-8814'. | |
| scope | No | Optional unit of work this belongs to. Recording it lets resume_packet tell a later invocation you already made this claim. Example: 'permit-review-2026-08'. | |
| agent_key | No | Your agent_secret, if your MCP host cannot set the Authorization header. Prefer the header. | |
| ttl_seconds | No | How long the claim is remembered. Default 86400, max 2592000. Example: '86400'. |
Tool Definition Quality
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description richly discloses behavior beyond annotations: billing conditions ($0.002 charged only on first denial per key, free subsequent denials), the granted:null uncertainty case, and authentication requirements (Bearer header or agent_key argument). Annotations only say idempotentHint=true and readOnlyHint=false, leaving the safety and cost details entirely to the description, which handles them thoroughly.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is long but dense, front-loading the core purpose and then expanding on costs, state semantics, and auth. There is some redundancy in the cost explanation ('repeated denials... free' vs. 'the same call returns the full answer and settles nothing'), but overall each section earns its place given the tool's complexity.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
There is no output schema, so the description carries the full burden of explaining return values. It covers granted:true/false/null, first_claimed_at, stored result from complete(), cost details, and auth. For a billing-sensitive tool with side effects, this is complete enough for an agent to invoke correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the baseline is 3. The description adds meaningful context by explaining the agent_key parameter as an alternative to the Authorization header, and mentions key scoping and hashing. This goes slightly beyond what the schema already states, providing practical usage nuance.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with 'Exactly-once guard for work that costs money or has side effects', which clearly states the tool's purpose and scope. It further distinguishes itself by explaining the granted:true/false/null states, making it clear this is an idempotency claim tool, not a generic read or write. This differentiates it from siblings like seen_check or lease.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly states when to use: 'for work that costs money or has side effects' and for retrying agents to avoid paying twice. It also warns against proceeding when granted:null. However, it does not explicitly name alternative tools or say when not to use it, though the context strongly implies its niche.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
completeAttach a result to a claimAIdempotentInspect
Attach the outcome to an idempotency CLAIM you hold — NOT for finishing a mailbox task (use inbox_ack) or a queue item (use work_done). A later duplicate attempt then receives your stored result from claim() instead of redoing the work. FREE — this is a write, and we never bill for storing. If the claim has expired or you never held one, we REFUSE with recorded:false, reason 'no_active_claim' rather than storing a result nothing will ever read; re-claim the key first. The result is an opaque blob: we never parse, index or log it. FREE — this tool never charges. Authenticate with Authorization: Bearer , or pass agent_key as an argument if your host cannot set headers. Equivalent HTTP route: POST /v1/complete.
| Name | Required | Description | Default |
|---|---|---|---|
| key | Yes | The same key you claimed. Example: 'charge-order-8814'. | |
| result | Yes | Opaque result blob, <=32768 bytes serialized. Example: '{"tx":"0x.."}'. | |
| status | No | Optional: 'ok' or 'failed'. Default 'ok'. Recorded verbatim, not interpreted. Example: 'ok'. | |
| agent_key | No | Your agent_secret, if your MCP host cannot set the Authorization header. Prefer the header. |
Tool Definition Quality
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Beyond the annotations (idempotentHint=true), the description discloses that this is a write operation, never billed, and how failures are handled (recorded:false, reason 'no_active_claim'). It also states the result is an opaque blob never parsed/indexed/logged, and explains authentication methods. No contradiction with annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is well-structured with purpose first, then exclusions, idempotency behavior, failure semantics, and auth. It is slightly redundant by mentioning 'FREE' twice and could be tightened, but every sentence otherwise carries essential information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Despite lacking an output schema, the description explains the failure mode (recorded:false with reason), the idempotency guarantee, the opaque result handling, and authentication options. It covers all relevant operational aspects an agent needs to decide and invoke correctly, making it complete for this tool's complexity.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema already has 100% description coverage for all parameters. The description adds valuable context about key reuse ('same key you claimed'), the opaque nature of the result, and clarifies status defaults not fully explicit in the schema. This goes beyond the schema, so a small uplift from baseline is warranted.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb and resource ('Attach the outcome to an idempotency CLAIM') and immediately distinguishes this tool from siblings by naming inbox_ack and work_done as alternatives for other task types. This leaves no ambiguity about what the tool does.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly states when to use the tool (when you hold an idempotency claim) and when NOT to use it, pointing to alternatives. It also covers edge cases like expired claims and re-claiming, providing clear decision-making guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
heartbeatDead-man switchAIdempotentInspect
AN AGENT CANNOT DETECT ITS OWN DEATH — from the inside, 'I stopped' and 'I am about to do the next step' are the same thing. Only something outside the process can tell them apart. Each call records a beat and arms a durable alarm for expect_within_seconds. Beat again in time and the alarm simply re-arms. Miss it and the expiry actions run EXACTLY ONCE: release_leases (the same release path a live agent uses), queue_alert (one envelope into a mailbox address you nominate), mark_failed (so resume_packet reports the death as an OBSERVED fact, not a self-report). FREE — it is a write. The alert is billed only when it is collected, by the existing inbox_poll first-delivery rule; there is no second charge. FREE — this tool never charges. Authenticate with Authorization: Bearer , or pass agent_key as an argument if your host cannot set headers. Equivalent HTTP route: POST /v1/heartbeat.
| Name | Required | Description | Default |
|---|---|---|---|
| scope | Yes | The unit of work whose liveness this tracks. Namespace-scoped, and the scope resume_packet will report the death against. Example: 'permit-review-2026-08'. | |
| disarm | No | Stop the switch instead of beating. Use this when the work finishes, or a completed job raises a false alarm. Default false. Example: 'false'. | |
| agent_id | No | Optional label for the beating instance, carried in the alert so a human can tell which worker died. <=64 chars. Example: 'worker-3'. | |
| agent_key | No | Your agent_secret, if your MCP host cannot set the Authorization header. Prefer the header. | |
| on_expiry | No | Which actions run if the next beat is late: any of 'release_leases', 'queue_alert', 'mark_failed'. Default ['mark_failed']. They always run in the order release_leases, mark_failed, queue_alert so the alert can report what was released. NOTE that release_leases can only reach leases taken with a `scope` — it reports its own blind spot rather than returning a silent empty list. Example: '["release_leases","queue_alert"]'. | |
| notify_address | No | REQUIRED with 'queue_alert'. A registered address, 'agent:<id>' or 'agent:<id>/<box>'. WRITE-ONLY: we queue an envelope into it and never read it, exactly like send(). Example: 'agent:7k2p.../alerts'. | |
| expect_within_seconds | Yes | Beat again within this many seconds or the switch fires. Min 2, max 2592000 (30 days). Example: '300'. |
Tool Definition Quality
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description discloses many behavioral traits beyond annotations: expiry actions run exactly once, actions run in a specific order, billing details (beat is free, alert billed only on collection), and the release_leases blind spot. It also mentions auth methods and the write-only nature of notify_address. These details add significant context the annotations do not provide.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is long but well-structured: it starts with the core concept, then mechanics, then parameter details. It front-loads the purpose and provides necessary caveats. Slight redundancy in billing statements ('FREE — it is a write' repeated as 'FREE — this tool never charges') could be trimmed, but overall it stays informative.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (7 params, no output schema, annotations present), this description is exceptionally complete. It covers purpose, usage, all parameter semantics, auth methods, billing behavior, and edge cases like the release_leases blind spot. The agent has everything needed to select and invoke the tool correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Although schema coverage is 100%, the description adds meaning beyond the schema: it explains the relationship between scope and resume_packet, the use case for disarm, the ordering and defaults of on_expiry, and the constraint that notify_address is required with queue_alert. This enrichment helps the agent use parameters correctly.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool records a beat and arms a durable alarm for expect_within_seconds, using a specific verb (beat) and resource (dead-man switch). It distinguishes itself from siblings like lease_renew and work_done by focusing on external liveness detection, and explicitly references the release_leases and mark_failed paths as alternatives.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It explains when to call: periodically to signal liveness, and disarm when work finishes. It describes when on_expiry actions run and notes the blind spot of release_leases, providing clear context. However, it does not explicitly list exclusions or alternative tools for scenarios like simple completion, though the intent is clear.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
inbox_ackMark a task doneADestructiveIdempotentInspect
Acknowledge a task you finished. FREE and idempotent — acking twice is not an error. If the task was a repeating schedule, the next occurrence is queued now. An optional opaque result is stored on the tombstone so a later duplicate can see what happened. If your visibility timeout already lapsed and the envelope was redelivered, the ack still succeeds and removes it — this queue has no fence token, so ack cannot tell your late ack from the current holder's. Ack promptly, or raise visibility_timeout_seconds on inbox_poll; if you need refuse-on-lost-ownership, that is work_take/work_done, which is fenced. An unknown task_id returns acked:false, reason 'unknown_task' — it may have been dead-lettered, or its tombstone may have expired. FREE — this tool never charges. Authenticate with Authorization: Bearer , or pass agent_key as an argument if your host cannot set headers. Equivalent HTTP route: POST /v1/inbox/ack.
| Name | Required | Description | Default |
|---|---|---|---|
| result | No | Optional opaque outcome blob. Example: '{"ok":true}'. | |
| status | No | 'done' or 'failed'. Default 'done'. Recorded, not interpreted. Example: 'done'. | |
| task_id | Yes | The task_id from inbox_poll. Example: 'tsk_...'. | |
| agent_key | No | Your agent_secret, if your MCP host cannot set the Authorization header. Prefer the header. |
Tool Definition Quality
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description richly discloses behaviors beyond the annotations: idempotent double-ack, repeated-schedule queueing, tombstone result storage, redelivery handling without fence tokens, unknown-task returns, and FREE/no-charge. These add substantial context not present in the annotations, and there is no contradiction.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Though the description is long, every clause contributes critical operational detail. It front-loads the main action and then systematically covers idempotency, scheduling, redelivery, fencing, unknown tasks, cost, and authentication—no filler or repetition.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description addresses all significant edge cases an agent would need: double-ack, repeated schedules, redelivery without fence tokens, unknown task_id, costing, and auth. Given the absence of an output schema, it also discloses the unknown-task return. This is a model of completeness.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema already describes all 4 parameters with 100% coverage, so the baseline is 3. The description adds extra value by explaining that the result object is stored on the tombstone, the status field is recorded but not interpreted, and agent_key is an alternative to the Authorization header, elevating it above the schema alone.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with 'Acknowledge a task you finished,' which clearly states the verb and resource. It distinguishes the tool from siblings by explicitly naming work_take/work_done as the fenced alternative and referencing inbox_poll for timeout adjustments, making the purpose unmistakable.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides explicit usage guidance: 'Ack promptly, or raise visibility_timeout_seconds on inbox_poll' and 'if you need refuse-on-lost-ownership, that is work_take/work_done, which is fenced.' This directly tells the agent when to use this tool versus alternatives, satisfying the highest bar.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
inbox_nackGive a task backAIdempotentInspect
Explicitly return a claimed task to the queue instead of waiting for its visibility timeout, optionally deferring it. FREE. Redelivery of the same task_id is always free, so handing work back costs nothing. FREE — this tool never charges. Authenticate with Authorization: Bearer , or pass agent_key as an argument if your host cannot set headers. Equivalent HTTP route: POST /v1/inbox/nack.
| Name | Required | Description | Default |
|---|---|---|---|
| task_id | Yes | The task_id from inbox_poll. Example: 'tsk_...'. | |
| agent_key | No | Your agent_secret, if your MCP host cannot set the Authorization header. Prefer the header. | |
| delay_seconds | No | Defer this many seconds before it is visible again. Default 0. Example: '600'. |
Tool Definition Quality
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Adds meaningful behavioral context beyond annotations by emphasizing that the operation is free, redelivery of the same task_id is free, and specifying authentication methods (Bearer header or agent_key argument). It also gives the equivalent HTTP route. These details are not present in the annotations, which only indicate idempotency and non-read-only, so the description enriches the agent's understanding without contradicting the annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is fairly concise and front-loaded with the core purpose, but it repeats 'FREE' three times in two consecutive statements, which is redundant and undermines conciseness. The structure otherwise flows from purpose to cost to authentication to route, but the repetition wastes space.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's simplicity (3 params, no output schema), the description covers the essential aspects: purpose, optional deferral, cost behavior, authentication, and equivalent HTTP route. It does not describe error handling or response output, but with no output schema, return value details are not required. It is complete enough for an agent to select and invoke this tool correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has 100% coverage with detailed per-parameter descriptions, so the baseline is 3. The tool description reiterates some param info (e.g., agent_key as a header alternative, delay_seconds for deferral) but does not add substantial new meaning beyond the schema descriptions. It effectively mirrors the schema rather than extending it.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Clearly states it 'explicitly return a claimed task to the queue instead of waiting for its visibility timeout, optionally deferring it.' The verb 'return' specifies the action on the resource, and it distinguishes from sibling tools like inbox_ack by framing it as a way to hand work back rather than completing or acknowledging it.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides a clear context: use when you want to return a claimed task instead of waiting for its timeout. Also mentions the optional delay for deferring. However, it does not explicitly name alternative tools or state when not to use it, so it falls short of the 'explicit when/when-not/alternatives' standard.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
inbox_pollWhat is due for meAInspect
Collect the next due task envelope from your mailbox. One envelope per call. The item is claimed with a visibility timeout: ack it when done, or it returns to the queue for another attempt, so work is never lost if this invocation dies. $0.002 charged the FIRST time a given task_id is delivered; every redelivery of that same task is FREE. Nothing due? We say so and charge nothing. Costs $0.002 USDC per call via x402 on Base, and ONLY when an envelope was delivered for the first time (redelivery is free); otherwise the same call returns the full answer and settles nothing. Authenticate with Authorization: Bearer , or pass agent_key as an argument if your host cannot set headers. Equivalent HTTP route: POST /v1/inbox/poll.
| Name | Required | Description | Default |
|---|---|---|---|
| box | No | Sub-mailbox to read, default 'inbox'. Example: 'inbox'. | |
| agent_key | No | Your agent_secret, if your MCP host cannot set the Authorization header. Prefer the header. | |
| visibility_timeout_seconds | No | How long the item stays claimed. Default 300, min 5, max 86400. Example: '300'. |
Tool Definition Quality
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations are minimal (all hints false), so the description carries the full burden of behavioral disclosure. It discloses the visibility timeout mechanism, redelivery behavior, cost structure (charged first delivery only), free redeliveries, zero charge when nothing is due, authentication methods, and the equivalent HTTP route. This goes far beyond what annotations provide.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is moderately long but every sentence earns its place; it covers purpose, behavior, cost, authentication, and routing without redundancy. The first sentence states the core function clearly, and subsequent sentences add necessary operational detail. It is well-structured and front-loaded with the most important information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with no output schema, the description fully covers the call's behavior: what happens on success (delivered envelope), what happens on empty queue (explicit message and no charge), cost implications, authentication requirements, parameter purposes, and the relationship to ack/nack. Given the tool's complexity (polling, timeout, redelivery, billing), this is a complete and self-contained description.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema already documents all three parameters with 100% coverage, so the baseline is 3. The description adds meaningful context: it explains when to use agent_key (if headers cannot be set), elaborates on visibility_timeout semantics (claimed item returns if not acked), and clarifies the mailbox concept. This provides real value beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a specific verb and resource: "Collect the next due task envelope from your mailbox." It clearly specifies the action (poll for the next due task), the resource (mailbox/envelope), and the key constraint (one envelope per call). This distinguishes it from siblings like inbox_ack and inbox_nack, which handle acknowledgment, and work_take/claim, which are alternative work-retrieval mechanisms.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage context: you poll to claim an envelope, then ack it when done, with a visibility timeout that returns it to the queue if not acked. It also states when nothing is due ("We say so and charge nothing"). However, it does not explicitly contrast with alternative tools like work_take or claim, nor does it say 'use this instead of X'. The guidance is clear but not exhaustive.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
inbox_scheduleLeave a note for your future selfAInspect
Leave work for your own next invocation — the same as send() addressed to yourself. FREE. No callback URL is required or accepted: agents are not web services and mostly have no endpoint, so the model is a future inbox, not a webhook. Whenever your next invocation starts, inbox_poll finds this waiting. FREE — this tool never charges. Authenticate with Authorization: Bearer , or pass agent_key as an argument if your host cannot set headers. Equivalent HTTP route: POST /v1/inbox/schedule.
| Name | Required | Description | Default |
|---|---|---|---|
| box | No | Sub-mailbox name, default 'inbox'. Example: 'inbox'. | |
| scope | No | Optional unit of work this task belongs to, so resume_packet groups it. Example: 'permit-review-2026-08'. | |
| due_at | No | ISO-8601 due time. Example: '2026-08-13T09:00:00Z'. | |
| context | No | Opaque payload. Never parsed or logged. Example: '{"permit_id":"P-1"}'. | |
| history | No | Prior reasoning or tool output. Example: '[]'. | |
| priority | No | 0 (highest) to 9. Default 5. Among DUE items, delivery order is priority first, then oldest due time. Example: '5'. | |
| agent_key | No | Your agent_secret, if your MCP host cannot set the Authorization header. Prefer the header. | |
| objective | Yes | What future-you should achieve, <=2048 chars. Example: 'Re-check the permit status'. | |
| dedupe_key | No | Optional duplicate suppression key. Example: 'permit-P-1'. | |
| in_seconds | No | Alternative to due_at: seconds from now. Example: '3600'. | |
| attachments | No | Opaque refs or blobs. Example: '[]'. | |
| repeat_count | No | Further occurrences to queue. Default 0, max 1000. Example: '7'. | |
| every_seconds | No | Optional repeat interval (>=60). Example: '86400'. | |
| max_deliveries | No | Attempts before dead-lettering. Default 5, max 50. Example: '5'. | |
| provider_extras | No | Vendor/framework-specific state. Carried verbatim, never interpreted. Example: '{}'. |
Tool Definition Quality
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations only indicate non-readonly and non-idempotent behavior, so the description carries the disclosure burden. It adds valuable context: the tool is FREE, requires authentication via Authorization header or agent_key, and maps to an HTTP route. It also clarifies that agents are not web services and that the message becomes available to inbox_poll on the next invocation.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is well-structured: it opens with the core purpose, then clarifies delivery semantics, pricing, authentication, and the HTTP equivalent. The main redundancy is the repeated 'FREE' emphasis, but overall every sentence earns its place without bloating.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (15 parameters, no output schema), the description covers the essential operational context: purpose, relationship to send and inbox_poll, authentication methods, and how the message will be received. It does not detail return values or complex parameter interactions, but those are largely self-documented in the schema.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
All 15 parameters have schema descriptions (100% coverage), so the baseline is 3. The description adds marginal value by mentioning agent_key as an auth alternative and objective as the task content, but does not deeply elaborate on parameter semantics beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose: 'Leave work for your own next invocation' — a specific verb (leave/schedule) and resource (future inbox). It distinguishes itself from siblings by noting it is 'the same as send() addressed to yourself' and that inbox_poll will retrieve the scheduled item.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives clear context for when to use: to leave work for your own future invocation, and names send() as the comparable alternative. It also clarifies that no callback URL is required or accepted, implying webhook usage is not appropriate. It does not explicitly state when not to use, but the guidance is sufficient.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
job_cancelTell every worker on a job to stopADestructiveIdempotentInspect
There is otherwise NO WAY TO TELL FIVE RUNNING AGENTS TO STOP — they finish and bill you for work you no longer want. This sets a durable stop flag on the job. FREE and idempotent. work_take on a cancelled job hands out nothing (and charges nothing), and should_continue answers 'no'. We do not kill anything: workers cooperate by checking, which is the only honest thing a service outside your process can offer. FREE — this tool never charges. Authenticate with Authorization: Bearer , or pass agent_key as an argument if your host cannot set headers. Equivalent HTTP route: POST /v1/job/cancel.
| Name | Required | Description | Default |
|---|---|---|---|
| job_id | Yes | The job to cancel. This is the same identifier as a work queue's queue_id, so cancelling a queue stops its workers. Alias: queue_id. Example: 'permit-batch-2026-08'. | |
| reason | No | Optional short reason, <=512 chars, returned to every worker that asks. Example: 'customer withdrew the request'. | |
| agent_key | No | Your agent_secret, if your MCP host cannot set the Authorization header. Prefer the header. |
Tool Definition Quality
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Beyond idempotent/destructive hints, description explains the cooperative stop mechanism (no kill), durability of flag, effect on work_take and should_continue, billing implications, and authentication methods. This is substantial context not available in annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Description is dense with useful info but slightly repetitive (FREE mentioned twice) and has a few long sentences. It is front-loaded with the main purpose and includes necessary caveats, so it earns a strong score.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple cancel tool with no output schema, the description covers purpose, side effects, related tools, auth, and HTTP route. No gaps remain for invocation decisions.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema covers all 3 params, but description adds semantics: job_id aliases queue_id, reason is returned to workers, and agent_key is an alternative to the Authorization header. This adds value beyond schema field descriptions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Title and description clearly state the tool cancels/stops a job by setting a durable stop flag, distinguishing it from individual task tools like work_fail or complete. The verb 'cancel' and resource 'job' are specific, and the description emphasizes its unique role among running agents.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides clear context: use when you want to stop running agents, mentioning that there is no other way. It doesn't explicitly list alternatives or when-not-to-use, but references related behaviors of work_take and should_continue, giving enough guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
leaseAcquire a mutual-exclusion leaseAIdempotentInspect
Mutual exclusion so two instances of the same agent do not both process one item. Returns acquired:true with a fence token (FREE), or acquired:false naming the current holder and when the lease expires. ACQUIRED:FALSE MEANS YOU DO NOT HOLD THE LOCK — you must NOT proceed, and must not treat the refusal as advisory: stop work on that resource, wait retry_after_seconds, or do something else. acquired:null means we could not determine the state, which is also not permission to proceed. YOU ARE GIVEN TWO NUMBERS AND THEY DO DIFFERENT JOBS. fence is a CREDENTIAL: a large integer drawn fresh and independently for every acquisition, so it is never 1, never a step from the fence you held last time, and not computable from any number of fences you have ever been given. Treat it as a secret — it is the one thing that tells you apart from another instance using your holder label. generation is the ORDER: a counter that strictly increases on every fresh acquisition and never resets, not on expiry and not on release. It is not a secret, it is the number to compare and the number to hand to an external store that must reject stale writers. A revived holder from an earlier generation therefore cannot renew or release a lease someone else now holds — not because its number is smaller, but because it does not have the new one. RE-ACQUIRING A LEASE YOU HOLD IS A RENEWAL ONLY IF YOU PRESENT ITS fence — a holder LABEL is not proof, because two instances of the same agent are exactly the callers most likely to share one, and we will not hand the same lock to both. A live lease requested under its own label without the fence is REFUSED with acquired:false, same_holder_label:true and held_by, never silently renewed. A renewal keeps your fence and stays free. $0.002 is charged the first time you are refused by a given holder; being refused again by the SAME holder is free. Costs $0.002 USDC per call via x402 on Base, and ONLY when acquired === false, and this refusal by this holder has not been billed before; otherwise the same call returns the full answer and settles nothing. Authenticate with Authorization: Bearer , or pass agent_key as an argument if your host cannot set headers. Equivalent HTTP route: POST /v1/lease.
| Name | Required | Description | Default |
|---|---|---|---|
| key | Yes | Resource being locked. Namespace-scoped, hashed before storage. Example: 'queue/orders'. | |
| fence | No | Optional: the fence token you were given for this key. Supply it to RENEW the lease you already hold. Omit it and a live lease is refused rather than renewed, because a holder label alone cannot tell you apart from another instance using the same one. It is a CREDENTIAL, not a counter: each acquisition draws an independent large integer, so it is never 1, never the last one plus one, and cannot be computed from any fence you have held before. The value below is a shape, not a value that will work. Example: '3170294857216913'. | |
| scope | No | Optional unit of work, so resume_packet can report the leases you still hold. IT IS ALSO WHAT MAKES THIS LEASE RECOVERABLE: a dead-man switch releases only leases recorded against a scope, so a lease taken without one is invisible to it and a dead holder's lock will block the work for the lease's full TTL. Pass it on every lease you want a switch to be able to give back. Example: 'permit-review-2026-08'. | |
| holder | Yes | Who is asking — an instance id you choose. Required, and it MUST BE UNIQUE PER LIVE INSTANCE: two concurrently running copies that send the same holder are two different callers, and only one of them can hold the lock. Use a per-process value (a uuid, a pod name), not a role name every replica shares. Example: 'worker-3-6f2a91'. | |
| agent_key | No | Your agent_secret, if your MCP host cannot set the Authorization header. Prefer the header. | |
| ttl_seconds | No | Lease lifetime. Default 60, max 3600. Example: '60'. |
Tool Definition Quality
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Beyond the annotations (readOnlyHint:false, idempotentHint:true, destructiveHint:false), the description adds crucial behavioral context: the fence is a credential, generation is an order counter, refusal is billed per holder, and the tool authenticates via Bearer header or agent_key. It also warns that acquired:null is not permission to proceed, which is not captured in any annotation.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is long, but it front-loads the most critical warning ('ACQUIRED:FALSE MEANS YOU DO NOT HOLD THE LOCK') and every sentence carries significant information. There is slight repetition around not proceeding on refusal, but given the safety-critical nature, the extra length is justified.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool has no output schema, so the description carries the full burden of explaining return values; it does so thoroughly, covering acquired states, fence/generation, same_holder_label, held_by, and retry_after_seconds. It also addresses authentication, billing, edge cases (null state), and interaction with external stores.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Although schema coverage is 100%, the description adds substantial meaning beyond the schema. It explains why holder must be unique per live instance, what scope does for recoverability, how fence functions as a credential for renewal, and how agent_key relates to Authorization. Each parameter's purpose and usage are greatly enriched.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with 'Mutual exclusion so two instances of the same agent do not both process one item', stating the exact purpose and resource. It explicitly describes the return states (acquired:true, acquired:false, acquired:null), distinguishing this lease-acquisition tool from sibling tools like lease_renew and lease_release.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It clearly explains when to use it (mutual exclusion) and what to do when acquired:false ('you must NOT proceed', 'wait retry_after_seconds'). It does not explicitly name alternatives like lease_renew or lease_release for renewal/release, but it does explain that renewal requires the fence, which implies the lease_renew tool.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
lease_releaseRelease a leaseADestructiveIdempotentInspect
Release a lease you hold so the next worker can take it immediately instead of waiting for the TTL. FREE. If you no longer hold it we REFUSE rather than free someone else's lock: a stale fence returns released:false, reason 'not_holder', naming the current holder — treat that as having lost the lock and stop work. An already-expired lease returns released:false, reason 'expired'. Neither is an error you can retry away; both mean the lock is not yours. A successful release also corrects the scope ledger, so resume_packet stops briefing a later agent that it still holds a lock it gave back. FREE — this tool never charges. Authenticate with Authorization: Bearer , or pass agent_key as an argument if your host cannot set headers. Equivalent HTTP route: POST /v1/lease/release.
| Name | Required | Description | Default |
|---|---|---|---|
| key | Yes | The leased key. Example: 'queue/orders'. | |
| fence | Yes | The fence token from lease(). Required, and checked exactly: a stale one is refused, never honoured. Each acquisition's token is an independent draw, so the one you were given for an earlier generation of this key does not become the current one by adding to it. The example below is a shape, not a usable value. Example: '3170294857216913'. | |
| holder | Yes | The holder id that owns the lease. Example: 'worker-3-6f2a91'. | |
| agent_key | No | Your agent_secret, if your MCP host cannot set the Authorization header. Prefer the header. |
Tool Definition Quality
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Beyond the annotations (destructive, idempotent), the description discloses refusal reasons ('released:false, reason not_holder'), that it names the current holder, that failed releases are not retryable, and that successful release corrects the scope ledger. It also states the tool is free and explains authentication options, adding substantial behavioral context.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is longer than the minimum, but every sentence adds value: purpose, failure modes, side effects, cost, and auth. It is front-loaded with the main action and efficiently packs necessary details, though it could be slightly trimmed without losing critical information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Despite having no output schema, the description covers the tool comprehensively: success behavior, failure reasons, treatment of stale/expired leases, side effects on the scope ledger, cost, authentication methods, and HTTP route. This is complete for an agent to use the tool correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the baseline is 3. The description reinforces the fence semantics ('stale one is refused') and mentions agent_key as a fallback, but it does not add significant new parameter meaning beyond what the schema already documents.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb and resource: 'Release a lease you hold so the next worker can take it immediately instead of waiting for the TTL.' It clearly distinguishes this from sibling tools like lease (acquire) and lease_renew (extend) by focusing on the release action and its immediate effect.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It explains when to use the tool (when you hold a lease and want to hand it off), and gives explicit guidance on what happens in stale/expired cases ('Neither is an error you can retry away'). However, it does not explicitly mention alternatives like lease_renew for extending a lease, so it is not a full when/when-not comparison.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
lease_renewExtend a lease you holdAIdempotentInspect
Extend a lease you still hold, using the fence token you were given. FREE. Fails (renewed:false) if the lease expired or was taken by someone else — treat that as having lost the lock and stop work. A renewal keeps both of your numbers: the same fence and the same generation, because it is the same acquisition. A successful renewal also corrects the scope ledger, so resume_packet and the dead-man switch see the real new expiry rather than the one recorded when you first acquired it. FREE — this tool never charges. Authenticate with Authorization: Bearer , or pass agent_key as an argument if your host cannot set headers. Equivalent HTTP route: POST /v1/lease/renew.
| Name | Required | Description | Default |
|---|---|---|---|
| key | Yes | The leased key. Example: 'queue/orders'. | |
| fence | Yes | The fence token from lease(). Required, and only the caller lease() handed it to has it — it is drawn independently for each acquisition, so it cannot be derived from an earlier one and the example below is a shape, not a usable value. Example: '3170294857216913'. | |
| holder | Yes | The same holder id you acquired with. Example: 'worker-3-6f2a91'. | |
| agent_key | No | Your agent_secret, if your MCP host cannot set the Authorization header. Prefer the header. | |
| ttl_seconds | No | New lifetime from now. Default 60, max 3600. Example: '60'. |
Tool Definition Quality
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description adds substantial behavioral context beyond the annotations: failure mode (renewed:false if lease expired/taken), preservation of fence and generation, side-effect on the scope ledger ('corrects the scope ledger, so resume_packet and the dead-man switch see the real new expiry'), cost (FREE), authentication method, and equivalent HTTP route. These are not present in the annotations and significantly help an agent understand side effects and failure handling.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is mostly efficient and front-loaded with the core purpose. Minor redundancy occurs with 'FREE' appearing twice and the sentence 'FREE — this tool never charges.' being repeated. However, given the complexity of the tool's behavior, each other sentence earns its place. The slight redundancy keeps it from a 5.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema, the description does well by mentioning the failure field (renewed:false), the side-effect on the ledger, and authentication. It does not describe the success response structure (e.g., new expiry value), but the description provides enough for an agent to understand the behavior and expected result. Slightly incomplete regarding return details.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the baseline is 3. The description adds extra meaning by clarifying the fence token is from lease() and unique per acquisition ('it is drawn independently for each acquisition, so it cannot be derived from an earlier one'), and that holder must be the same as originally used. It also explains the agent_key param context (when headers cannot be set). These additions go slightly beyond the schema descriptions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's function: 'Extend a lease you still hold, using the fence token you were given.' It uses a specific verb (extend) and resource (lease), and distinguishes itself from sibling tools like lease_release (ending a lease) and lease (acquiring a lease). No ambiguity about what this tool does.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives clear context for when to use the tool: when you hold a lease and want to extend it. It also provides failure semantics ('Fails (renewed:false) if the lease expired or was taken by someone else — treat that as having lost the lock and stop work.'), which implicitly guides when not to proceed. It does not explicitly name alternatives, but the conditional and the 'same acquisition' wording make the use case clear.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
registerRegister an agent namespace and mailboxAInspect
Create a durable identity for an agent. Returns an agent_secret (the only credential; store it in the agent's configuration the way you would an API key — an amnesiac agent cannot remember it for you), the public agent address other agents mail work to, and the namespace id. FREE. The secret is never stored here: the namespace id is its salted SHA-256 digest, so a dump of our storage cannot reveal it, and we cannot recover it for you if you lose it. FREE — this tool never charges. Authenticate with Authorization: Bearer , or pass agent_key as an argument if your host cannot set headers. Equivalent HTTP route: POST /v1/register.
| Name | Required | Description | Default |
|---|---|---|---|
| agent_id | No | A label you choose and own, <=64 chars. Never derive it from a provider's session/thread/run id — that would bind your continuation to the platform that issued it. Alias: label. Example: 'pricing-agent'. | |
| agent_secret | No | Optional: bring your own secret (>=32 chars) derived from your own secret manager. Omit to have one generated. |
Tool Definition Quality
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations only say the tool is not read-only and not idempotent, but the description goes far beyond: explains that the secret is never stored (salted SHA-256 digest), cannot be recovered, is the only credential, and is free. Warns that an amnesiac agent cannot remember it. These are valuable behavioral disclosures not inferable from annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is detailed but every sentence conveys critical info (return values, security model, authentication, cost). It is front-loaded with the core verb. Minor redundancy via 'FREE' twice, but still appropriately sized for the complexity.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
No output schema exists, so the description must explain return values, and it does: agent_secret, public agent address, and namespace id. It also covers authentication, persistence semantics, and cost. For a simple registration tool, this is fully self-contained.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema already describes both parameters (100% coverage), but the description adds meaningful semantics: agent_id should never derive from provider session ids, agent_secret is optional with a minimum length, and aliases are noted. This supplements the schema with security-relevant guidance.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a specific verb+resource: 'Create a durable identity for an agent.' It clearly distinguishes itself from siblings (e.g., whoami, send, work_*) by defining the registration role: returns credentials and namespace, not operational messaging or work tasks.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides explicit usage context: when to call (to create identity), how to authenticate afterward, and how to store the returned secret. Does not explicitly contrast with sibling tools, but the purpose is so distinct that exclusions are not necessary. Mentions alternative auth (agent_key as argument) and equivalent HTTP route.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
resume_packetResume the work, not the conversationARead-onlyIdempotentInspect
THE HEADLINE TOOL. Returns a briefing, not an archive: objective, last verified state, what arrived while you were gone, the single next action, files, risks, open questions, tools already used and budget remaining. Composed from your last checkpoint PLUS server-observed facts we hold ourselves — the claims you made, the leases you still hold, the watermarks you set, the mail that arrived since — so the packet is not limited to what an earlier session remembered to write down. Provider-neutral plain JSON: a checkpoint written by one model under one framework is resumable by any other. $0.002 only when there is a real packet to return AND that briefing has changed since you last paid for it — recomposing the same briefing is free. An empty scope tells you so and costs nothing. Costs $0.002 USDC per call via x402 on Base, and ONLY when the packet carries something — a checkpoint, new events since it, or server-observed facts — and this exact briefing has not been billed before; otherwise the same call returns the full answer and settles nothing. Authenticate with Authorization: Bearer , or pass agent_key as an argument if your host cannot set headers. Equivalent HTTP route: POST /v1/resume.
| Name | Required | Description | Default |
|---|---|---|---|
| box | No | Sub-mailbox to count new events from, default 'inbox'. Example: 'inbox'. | |
| scope | Yes | The unit of work to resume — a workflow, project or task id you choose. Namespace-scoped. Example: 'permit-review-2026-08'. | |
| agent_key | No | Your agent_secret, if your MCP host cannot set the Authorization header. Prefer the header. | |
| max_events | No | How many new-event headers to include, 1..50. Default 25. Example: '25'. |
Tool Definition Quality
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Beyond the annotations (readOnly, idempotent, non-destructive), the description discloses substantial behavioral traits: the conditional billing model ('$0.002 only when... briefing has changed... otherwise free'), the use of server-observed facts, authentication requirements (Authorization header or agent_key argument), and the HTTP route. This goes well beyond the structured metadata.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is longer than typical but well-structured, front-loaded with the core purpose ('THE HEADLINE TOOL') and then progressing through contents, composition, provider-neutrality, pricing, authentication, and endpoint. Every sentence carries information, but some details (pricing breakdown) could be condensed without losing meaning.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Despite having no output schema, the description sufficiently documents what the response contains (briefing details, costs, empty scope behavior). It also covers critical operational aspects (billing, auth, server-side facts) that an agent needs to invoke and interpret results correctly. For the tool's complexity, the description is complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so baseline is 3. The description adds extra meaning for key parameters: it explains that an empty scope indicates no packet and costs nothing, and clarifies that agent_key is an alternative when headers cannot be set by the host. This enriches the schema descriptions without repeating them.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's function: 'Returns a briefing, not an archive' and lists the specific contents (objective, last verified state, new events, next action, files, risks, etc.). It distinguishes itself from siblings by explaining it combines last checkpoint with server-observed facts, making it unique among tools like checkpoint_get or inbox_poll.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies when to use it ('THE HEADLINE TOOL', 'Returns a briefing...') and clarifies it is more comprehensive than a raw checkpoint. However, it does not explicitly state when not to use it or name alternative tools for simpler needs (e.g., checkpoint_get for just the raw checkpoint). Clear context but no explicit exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
retry_stateAttempt count and backoff that survives a crashBIdempotentInspect
Durable retry bookkeeping, so backoff survives the session that died. Returns the attempt count, first and last attempt times, and a deterministic suggested backoff. Pass record:true to count this attempt. $0.002 ONLY when we return remembered history from an earlier session (attempts>0 before this call), and only when that attempt count has changed since you last paid for it. The very first call for a key tells you nothing you did not know, so it is free. NOTE that record:true is a WRITE: it counts a new attempt, so it produces a genuinely new answer and is billable again. Use the default record:false to read the history without changing it. Costs $0.002 USDC per call via x402 on Base, and ONLY when attempts_before_call >= 1 (remembered history from an earlier session), and this exact attempt count has not been billed before; otherwise the same call returns the full answer and settles nothing. Authenticate with Authorization: Bearer , or pass agent_key as an argument if your host cannot set headers. Equivalent HTTP route: POST /v1/retry-state.
| Name | Required | Description | Default |
|---|---|---|---|
| key | Yes | What is being retried. Namespace-scoped, hashed before storage. Example: 'sync-vendor-7'. | |
| scope | No | Optional unit of work, so resume_packet can report what is being retried. Example: 'permit-review-2026-08'. | |
| record | No | Count this attempt before answering. Default false. Example: 'true'. | |
| agent_key | No | Your agent_secret, if your MCP host cannot set the Authorization header. Prefer the header. | |
| ttl_seconds | No | Retention. Default 604800 (7d), max 2592000. Example: '604800'. |
Tool Definition Quality
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotation Contradiction: The description states that record:true is a WRITE that counts a new attempt and produces a genuinely new answer, implying repeated calls with the same payload have different effects. This contradicts the annotation idempotentHint=true, which implies repeated identical calls are idempotent. Per the rubrics, any description that contradicts annotations receives a score of 1.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is overly long and repetitive, especially around billing. The $0.002 cost and when it applies is restated multiple times in different forms. While the core intent is front-loaded, the redundancies undermine conciseness and structure.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema, the description lists return values (attempt count, first/last times, suggested backoff) and explains authentication, billing, and the semantic distinction of record. It omits edge-case behavior like missing keys, but overall provides a robust operational picture for an agent.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Input schema coverage is 100%, so parameters are already well documented. The description adds billing semantics and clarifies record behavior, but mostly reiterates what the schema says (e.g., key hashing, record default false). It doesn't materially surpass the schema, so baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly identifies 'retry_state' as durable retry bookkeeping that survives crashes, and enumerates exactly what it returns (attempt count, first/last times, suggested backoff). It is distinct from sibling tools like work_fail or should_continue, which address different workflow concerns.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides explicit guidance: use record:true to count an attempt, record:false to read history without mutation. Also explains authentication options. It doesn't reference sibling tools as alternatives, but the usage context is clear enough for an agent to decide when to call this tool.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
seen_addRemember items you processedAIdempotentInspect
Record items you have already processed. FREE. Items are stored ONLY as salted SHA-256 digests — we can test membership but cannot read, list or reconstruct what you deduped. A set holds up to 10000 entries; when full, adds are refused (never silently forgotten) and you should rotate to a new set name. FREE — this tool never charges. Authenticate with Authorization: Bearer , or pass agent_key as an argument if your host cannot set headers. Equivalent HTTP route: POST /v1/seen/add.
| Name | Required | Description | Default |
|---|---|---|---|
| set | Yes | Set name. Namespace-scoped, hashed before storage. Example: 'processed-ids'. | |
| items | Yes | Up to 100 strings per call, each <=1024 chars. Example: '["id-1","id-2"]'. | |
| scope | No | Optional unit of work, so resume_packet can report which sets you are deduping against. Example: 'permit-review-2026-08'. | |
| agent_key | No | Your agent_secret, if your MCP host cannot set the Authorization header. Prefer the header. | |
| ttl_seconds | No | Sliding set lifetime, refreshed on each add. Default 2592000 (30d), max 31536000. Example: '2592000'. |
Tool Definition Quality
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description substantially exceeds annotations by disclosing that items are stored ONLY as salted SHA-256 digests, cannot be read/listed/reconstructed, sets max at 10,000 entries with refusal on overflow, and that the tool is FREE and requires authentication. These are key behavioral traits not present in annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is compact and front-loaded with the primary purpose, but 'FREE' is repeated twice and the HTTP route is appended, adding minor redundancy. Overall it remains concise and readable.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a write-only dedup tool, the description covers purpose, privacy, set limits, failure behavior, authentication, and cost. While no output schema exists and return values are not explicitly described, this is not critical for an add operation; the description is thorough and enables correct selection and invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Although schema coverage is 100%, the description adds meaningful constraints beyond the schema: set capacity of 10,000 entries and refusal when full, plus the privacy guarantee for items. It complements the schema's parameter descriptions without duplicating them.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with 'Record items you have already processed,' a specific verb+resource that clearly states the tool's function. It distinguishes from siblings like seen_check by focusing on adding/recording rather than checking, and clarifies storage as salted SHA-256 digests.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It explains when to use the tool: to record processed items, and provides explicit guidance on set rotation when full ('adds are refused... you should rotate to a new set name'). It does not explicitly name alternatives like seen_check, but the context implies the complement, and authentication instructions are given.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
seen_checkWhich of these are newARead-onlyIdempotentInspect
Given a batch of items, return only the ones not already in the set — the work you actually still have to do. $0.002 ONLY when we filter at least one item out, because that is the call where we saved you work, AND only when that answer has changed since you last paid for it — asking the same question again while the set has not grown is free. If every item is new we tell you so and charge nothing. Costs $0.002 USDC per call via x402 on Base, and ONLY when filtered_count >= 1, and this exact set of already-seen items has not been billed before; otherwise the same call returns the full answer and settles nothing. Authenticate with Authorization: Bearer , or pass agent_key as an argument if your host cannot set headers. Equivalent HTTP route: POST /v1/seen/check.
| Name | Required | Description | Default |
|---|---|---|---|
| set | Yes | The set name. Example: 'processed-ids'. | |
| items | Yes | Up to 100 strings per call. Example: '["id-1","id-9"]'. | |
| agent_key | No | Your agent_secret, if your MCP host cannot set the Authorization header. Prefer the header. |
Tool Definition Quality
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already indicate read-only, idempotent, and non-destructive behavior. The description adds valuable context: exact billing conditions ('$0.002 ONLY when filtered_count >= 1...'), idempotency (same question free if set unchanged), authentication method, and HTTP route. This goes well beyond the annotations and fully discloses the cost and behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description contains redundant billing explanations (e.g., '$0.002 ONLY when we filter...' and 'Costs $0.002 USDC per call... ONLY when filtered_count >= 1'). While informative, the repetition wastes space. The core purpose is front-loaded, but the duplication and long billing segment make it less concise than it could be.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
There is no output schema, so the description carries the responsibility of explaining return values. It states that the tool returns only the new items and says 'If every item is new we tell you so,' covering the main behavior. It also covers auth, billing, and route. It lacks an exact response shape, but for a simple filtered-list tool, the provided description is sufficiently complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, and the schema already describes each parameter (set, items, agent_key) with examples. The description mentions agent_key in the authentication context and references the set name implicitly ('this exact set of already-seen items'), but it does not add new semantic meaning beyond what the schema provides. Baseline of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's function: 'Given a batch of items, return only the ones not already in the set — the work you actually still have to do.' This is a specific verb (return) plus resource (items not in set), and it distinguishes the check operation from the sibling tool seen_add, which would add items.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides clear context for when to use the tool ('the work you actually still have to do'), implying it's used to filter out already-seen items before processing. It also explains billing conditions that affect usage, such as when calls are free. However, it does not explicitly name alternatives like seen_add.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
sendMail a task envelope to an agentAInspect
Agent-to-agent mail. Queue a rich task envelope addressed to any registered agent so it finds the work waiting whenever it next starts. Nobody waits and nobody polls. FREE. You may SEND to an address but never READ another agent's mailbox — reading requires that agent's secret. The envelope carries objective, context, attachments and history so the receiving invocation can start work without rebuilding state it no longer has. A mailbox holds 1000 pending items, of which ordinary mail may occupy 968; the last 32 are reserved for the recipient's OWN dead-man alerts and barrier notifications, so filling someone's mailbox can never silence their safety notifications. FREE — this tool never charges. Authenticate with Authorization: Bearer , or pass agent_key as an argument if your host cannot set headers. Equivalent HTTP route: POST /v1/mail/send.
| Name | Required | Description | Default |
|---|---|---|---|
| to | Yes | Destination address, 'agent:<id>' or 'agent:<id>/<box>'. Must be registered. Example: 'agent:7k2p.../pricing'. | |
| scope | No | Optional unit of work this task belongs to, so the recipient's resume_packet groups it. Example: 'permit-review-2026-08'. | |
| due_at | No | ISO-8601 time it becomes visible. Default: immediately. Example: '2026-08-13T09:00:00Z'. | |
| context | No | Opaque payload the receiver needs. Never parsed or logged. Example: '{"permit_id":"P-1"}'. | |
| history | No | Prior reasoning or tool output from earlier episodes. Example: '[]'. | |
| priority | No | 0 (highest) to 9. Default 5. Among the items that are DUE, delivery order is priority first, then oldest due time. So a stream of higher-priority items can delay a lower-priority one indefinitely — that is deliberate: it is what lets a dead-man alert (priority 1) reach an agent ahead of a backlog of ordinary mail (default 5). Example: '5'. | |
| agent_key | No | Your agent_secret, if your MCP host cannot set the Authorization header. Prefer the header. | |
| objective | Yes | What the receiving agent should achieve, <=2048 chars. Example: 'Determine if this creates a sales opportunity'. | |
| dedupe_key | No | Optional. A second send with the same dedupe_key to the same mailbox is refused as a duplicate. Example: 'permit-P-1'. | |
| in_seconds | No | Alternative to due_at: become visible this many seconds from now. Example: '3600'. | |
| attachments | No | Opaque refs or blobs. Example: '[]'. | |
| repeat_count | No | How many further occurrences to queue. Default 0, max 1000. Example: '7'. | |
| every_seconds | No | Optional repeat interval (>=60). A new occurrence is queued when this one is acked. Example: '86400'. | |
| max_deliveries | No | Attempts before dead-lettering. Default 5, max 50. Example: '5'. | |
| provider_extras | No | Vendor/framework-specific state. Carried verbatim, never interpreted. Example: '{}'. |
Tool Definition Quality
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With all annotations false (readOnlyHint, idempotentHint, destructiveHint), the description carries the burden of disclosing effects, and it does so substantially. It states the tool never charges ('FREE'), queues rather than delivers synchronously, respects mailbox capacity limits ('968 ordinary items + 32 reserved for safety alerts'), and guarantees safety notifications cannot be silenced by flooding. It also discloses authentication requirements (Bearer header or agent_key). This goes well beyond the annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is front-loaded with a clear purpose statement and then expands into relevant details. It is efficient but has minor redundancy: 'FREE.' appears twice ('FREE.' and 'FREE — this tool never charges.'). It is longer than strictly necessary but every other sentence earns its place, covering safety, capacity, and authentication.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a complex tool with 15 parameters, no output schema, and all-false annotations, the description is remarkably complete. It covers the core behavior, cost model, capacity limits, safety guarantees, and authentication. The only notable omission is the return value or outcome of a successful send (e.g., whether it returns a message ID or ack), which would help since there is no output schema. Still, the description gives the agent enough to use the tool correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% with descriptions for all 15 parameters, so the baseline is 3. The description adds extra meaning by explaining the envelope's purpose: 'The envelope carries objective, context, attachments and history so the receiving invocation can start work without rebuilding state it no longer has.' This gives semantic rationale for several parameters that the schema alone does not convey. It doesn't cover every parameter, but the schema already does that, so 4 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with 'Agent-to-agent mail' and immediately defines the action: 'Queue a rich task envelope addressed to any registered agent.' This names the verb (queue/send), the resource (task envelope), and the delivery model (asynchronous mailbox), clearly distinguishing it from sibling tools like inbox_poll or work_push. It also explicitly states what the tool does NOT do: 'You may SEND to an address but never READ another agent's mailbox.'
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives clear context for when to use send: when you need to deliver work to another agent asynchronously, with 'Nobody waits and nobody polls.' It also provides a usage exclusion: 'You may SEND to an address but never READ another agent's mailbox — reading requires that agent's secret.' However, it does not explicitly name alternative tools (like inbox_poll or inbox_ack) as the rubric's top tier requires, so it falls short of a 5.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
should_continueShould I keep goingAIdempotentInspect
The check a worker makes between items. $0.002 ONLY WHEN THE ANSWER IS 'no' — that is the call that saved you money, and the first caller told to stop is the only one billed for it, because every later 'no' is the same fact. A 'keep going' answer told you nothing you did not already assume, so it is FREE, always. An unknown job answers 'keep going' and charges nothing. If we cannot determine the state we fail closed with continue:null and you should retry rather than guess. Costs $0.002 USDC per call via x402 on Base, and ONLY when continue === false, and this cancellation has not been billed before; otherwise the same call returns the full answer and settles nothing. Authenticate with Authorization: Bearer , or pass agent_key as an argument if your host cannot set headers. Equivalent HTTP route: POST /v1/job/should-continue.
| Name | Required | Description | Default |
|---|---|---|---|
| job_id | Yes | The job to check. Alias: queue_id. Example: 'permit-batch-2026-08'. | |
| agent_key | No | Your agent_secret, if your MCP host cannot set the Authorization header. Prefer the header. |
Tool Definition Quality
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description thoroughly discloses billing behavior (only charged on false, free on true), unknown-job handling, fail-closed null semantics, retry advice, authentication methods, and the HTTP route. This goes far beyond the annotations and adds valuable context about side effects and failure modes.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single dense paragraph with redundant cost explanations: '$0.002 ONLY WHEN THE ANSWER IS no', 'FREE, always', and 'Costs $0.002 USDC per call...' repeat the same billing point. While information-dense, the lack of structure and repetition make it harder to parse quickly.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given no output schema, the description covers auth, billing, failure semantics, and route. However, it never explicitly states the response shape (e.g., an object with a `continue` boolean/null), instead implying it via 'continue:null' and 'continue === false'. The full return contract remains somewhat vague.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so parameters are already documented. The description adds value by noting the job_id alias 'queue_id', providing an example, clarifying agent_key is a fallback when headers cannot be set, and explaining the behavioral effect of unknown job IDs. This exceeds baseline.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description positions this as 'the check a worker makes between items,' and the title 'Should I keep going' reinforces that it asks whether a job should continue. However, it never directly states 'returns whether the job should continue' or explicitly names the boolean response field, so the purpose is clear but slightly implicit.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It gives clear usage context: this is a per-item check, and when state cannot be determined it says to 'retry rather than guess.' It also explains unknown jobs behave as 'keep going.' It does not name sibling alternatives, but the context is specific enough that an agent would know when to call it.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
watermark_getWhat is new since I last lookedARead-onlyIdempotentInspect
Fetch the position you last recorded for a stream, so you can ask an upstream only for what is new. $0.002 ONLY when a watermark exists AND its position has moved since you last paid for it — re-reading an unchanged position is free. Never set one? Then we tell you so and charge nothing. Costs $0.002 USDC per call via x402 on Base, and ONLY when found === true, and this exact position has not been billed before; otherwise the same call returns the full answer and settles nothing. Authenticate with Authorization: Bearer , or pass agent_key as an argument if your host cannot set headers. Equivalent HTTP route: POST /v1/watermark/get.
| Name | Required | Description | Default |
|---|---|---|---|
| stream | Yes | The stream identifier. Example: 'orders-feed'. | |
| agent_key | No | Your agent_secret, if your MCP host cannot set the Authorization header. Prefer the header. |
Tool Definition Quality
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already provide readOnly/idempotent hints, but the description adds significant context: the billing model (cost only when position has moved and not previously billed), free re-reads, and auth requirements (Authorization header or agent_key). This goes well beyond the annotations and clarifies real-world behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is somewhat long and contains redundancy: the billing rule is explained twice ('$0.002 ONLY when...' and 'Costs $0.002... ONLY when found === true'). While each piece of info is useful, the repetition could be tightened, making it less concise than ideal.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with billing and auth complexity, the description covers most key aspects (cost conditions, no-watermark case, auth, HTTP route). However, it does not describe the return structure (e.g., what 'found === true' implies for the response), which would be valuable given the lack of an output schema.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, but the description adds meaningful nuance for agent_key (when to use it, preference for header) and stream (example). This enriches the parameters without being redundant.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool fetches the last recorded position for a stream, with a specific verb ('Fetch') and resource. It distinguishes itself from siblings like watermark_set by focusing on retrieval, and the purpose ('ask an upstream only for what is new') adds context.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies when to use it (after a watermark has been set, to check for new data) and mentions behavior when no watermark exists. However, it does not explicitly name alternatives or state when not to use it, so it stops short of providing full usage guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
watermark_setRecord how far you readAIdempotentInspect
Record how far you got through a stream, feed or table so the next invocation knows where to start. FREE. The position is an opaque string we store verbatim and never interpret. FREE — this tool never charges. Authenticate with Authorization: Bearer , or pass agent_key as an argument if your host cannot set headers. Equivalent HTTP route: POST /v1/watermark/set.
| Name | Required | Description | Default |
|---|---|---|---|
| scope | No | Optional unit of work, so resume_packet can report where you had read to. Example: 'permit-review-2026-08'. | |
| stream | Yes | Stream identifier. Namespace-scoped, hashed before storage. Example: 'orders-feed'. | |
| position | Yes | Opaque cursor/offset/timestamp, <=1024 chars. Example: '2026-08-12T09:00:00Z'. | |
| agent_key | No | Your agent_secret, if your MCP host cannot set the Authorization header. Prefer the header. | |
| ttl_seconds | No | Retention. Default 7776000 (90d), max 31536000 (365d). Example: '7776000'. |
Tool Definition Quality
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description adds context beyond the annotations: the position is 'an opaque string we store verbatim and never interpret,' the tool is free, and authentication can be done via Authorization header or agent_key argument. These behavioral details are not present in the readOnlyHint/idempotentHint/destructiveHint annotations, enriching agent understanding of side effects and invocation constraints.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise (four sentences) and front-loads the primary purpose. However, FREE is stated twice ('FREE.' and 'FREE — this tool never charges.'), which is redundant and slightly violates the 'every sentence earns its place' principle. Otherwise, the structure is clear and efficient.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple write tool with no output schema, the description adequately covers the core behavior, auth, HTTP route, and opaque position handling. It does not explicitly state overwrite behavior (e.g., calling it again replaces the prior position), but the term 'record' implies this. Overall, it is sufficiently complete for an agent to select and use the tool correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so all five parameters already have detailed meanings. The description reiterates that position is 'opaque' (already in the schema) and mentions agent_key as an alternative authentication method (also in the schema), adding no new param semantics beyond what the input schema provides. Thus baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description begins with a specific verb-resource pair: 'Record how far you got through a stream, feed or table,' making the tool's function unmistakable. It also differentiates from siblings like watermark_get by focusing on writing progress, and the phrase 'so the next invocation knows where to start' clarifies the downstream purpose.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description clearly conveys the use case—recording progress through a stream, feed, or table—and implies it should be called after consuming data. However, it does not explicitly name alternatives or explain when not to use this tool (e.g., for ephemeral checkpoints use checkpoint_put), so it falls short of a 5.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
whoamiYour address and mailbox countsARead-onlyIdempotentInspect
Report this namespace's public address, registration time, and mailbox counts: how many items exist, how many are due right now, when the next one falls due, and how many are dead-lettered. FREE, deliberately: knowing THAT work exists must never cost money — only the envelope itself is billable. Poll this for free, then pay only when there is something to collect. FREE — this tool never charges. Authenticate with Authorization: Bearer , or pass agent_key as an argument if your host cannot set headers. Equivalent HTTP route: POST /v1/whoami.
| Name | Required | Description | Default |
|---|---|---|---|
| agent_key | No | Your agent_secret, if your MCP host cannot set the Authorization header. Prefer the header. |
Tool Definition Quality
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, idempotentHint=true, and destructiveHint=false. The description adds valuable behavioral context beyond this: the tool is intentionally free and never charges, and it requires authentication via a header or agent_key. This helps the agent understand cost and auth implications.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is front-loaded with the purpose, but the emphasis on 'FREE' is repeated four times across multiple sentences, which is redundant. The auth and HTTP route information is useful, but the cost messaging could be condensed without losing meaning.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema, the description effectively enumerates the response contents: public address, registration time, mailbox counts, due now, next due, and dead-lettered counts. It also covers authentication and cost behavior, making it sufficiently complete for a simple read-only status tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% with a single optional parameter (agent_key). The description's mention of agent_key as an authentication alternative mirrors the schema, adding no new semantic meaning beyond what the schema already provides. Baseline of 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose with a specific verb ('Report') and resource ('this namespace's public address, registration time, and mailbox counts'), and enumerates the exact details returned. This distinguishes it from sibling tools like inbox_poll or work_take, which are action-oriented.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides clear usage context: 'Poll this for free, then pay only when there is something to collect.' This implies when this tool should be used (free status checking) and clarifies there is no cost. It does not explicitly name alternative tools, but the guidance is clear enough.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
work_doneMark a work item finishedADestructiveIdempotentInspect
Complete an item you hold. FREE. If your lease already expired and the item went back to the queue we REFUSE with lease_lost rather than accepting a result from a worker that no longer owns the work — that is what the fence token is for. A fence-less call on an item that has been handed out more than once is refused as fence_required for the same reason; work_fail behaves identically. The optional result is opaque, is never parsed, and is returned by work_status as results_so_far so a parent can proceed on partial output. FREE — this tool never charges. Authenticate with Authorization: Bearer , or pass agent_key as an argument if your host cannot set headers. Equivalent HTTP route: POST /v1/work/done.
| Name | Required | Description | Default |
|---|---|---|---|
| fence | No | The fence token from work_take, for THIS item. Checked exactly when supplied; when omitted we accept the call only while the item has been handed out exactly once, and otherwise refuse with fence_required. Every item on a queue draws its own token independently, so the fence you hold for one item is not one step away from the fence another worker holds for another. The example below is a shape, not a usable value. Example: '3170294857216913'. | |
| result | No | Optional opaque outcome, <=8192 bytes. Never parsed or indexed. Example: '{"ok":true}'. | |
| item_id | Yes | The item you were given. Example: 'P-1'. | |
| queue_id | Yes | The queue. Alias: job_id. Example: 'permit-batch-2026-08'. | |
| agent_key | No | Your agent_secret, if your MCP host cannot set the Authorization header. Prefer the header. |
Tool Definition Quality
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description goes well beyond annotations, explaining the lease_lost and fence_required refusal cases, the opaque and never-parsed nature of the result, how the result surfaces via work_status, the cost (FREE), and authentication requirements. This provides extensive behavioral context for a mutation/destructive tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single dense paragraph that repeats 'FREE' twice and includes an HTTP route, which is not essential for MCP invocation. It front-loads the main purpose well but could be tightened without losing key safety and refusal details.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a complex mutation with no output schema, the description covers when to use, error conditions, result behavior, authentication, and cost. It does not specify what the direct response from work_done is on success, but given the rich context and idempotent annotation, it is largely complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
While the schema already documents all 5 parameters with 100% coverage, the description adds critical semantic context for fence (why it exists, what happens without it) and result (opaque, returned via work_status). This raises the value beyond the schema's plain definitions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with 'Complete an item you hold,' which clearly states the action and target. It further clarifies that this is for finishing a work item successfully, and distinguishes itself from work_fail by noting identical refusal behavior for fence-less calls, implying the success/failure split.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It explicitly states when to use (when you hold the item and want to mark it done) and describes failure conditions (lease expired, fence token mismatches). It references work_fail for comparison but does not explicitly say 'use work_fail for failures,' so it lacks a direct alternative recommendation.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
work_failGive a work item back, or fail it for goodADestructiveIdempotentInspect
Report that an item did not work out. FREE. THIS IS ALSO THE CORRECT WAY TO HAND AN ITEM BACK WHEN NOTHING WENT WRONG — there is no work_release; retry:true (the default) returns it immediately for another worker instead of waiting out the lease. When its attempts are exhausted it is DEAD-LETTERED and SURFACED in work_status, never silently dropped. With retry:false it is marked permanently failed, stops consuming attempts, and CANNOT BE UNDONE. PASS fence: exactly like work_done, if your lease already expired and the item went back to the queue we REFUSE with lease_lost, a stale fence is refused as not_holder, and a fence-less call on an item that has been handed out more than once is refused as fence_required — because accepting it would let a revived worker dead-letter an item another worker is processing right now. FREE — this tool never charges. Authenticate with Authorization: Bearer , or pass agent_key as an argument if your host cannot set headers. Equivalent HTTP route: POST /v1/work/fail.
| Name | Required | Description | Default |
|---|---|---|---|
| error | No | Optional short reason, <=512 chars, surfaced on the dead letter so a human can see WHY it exhausted. Example: 'upstream 503'. | |
| fence | No | The fence token from work_take, for THIS item. Checked exactly when supplied; when omitted we accept the call only while the item has been handed out exactly once, and otherwise refuse with fence_required. Every item on a queue draws its own token independently, so the fence you hold for one item is not one step away from the fence another worker holds for another. The example below is a shape, not a usable value. Example: '3170294857216913'. | |
| retry | No | Put it back for another attempt (default true), or fail it permanently (false). Example: 'true'. | |
| item_id | Yes | The item you were given. Example: 'P-1'. | |
| queue_id | Yes | The queue. Alias: job_id. Example: 'permit-batch-2026-08'. | |
| agent_key | No | Your agent_secret, if your MCP host cannot set the Authorization header. Prefer the header. |
Tool Definition Quality
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Beyond the annotations (readOnlyHint:false, destructiveHint:true), the description details critical behaviors: attempts exhaustion leads to dead-lettering and surfacing in work_status, never silently dropped; retry:false cannot be undone; and fence validation failures (lease_lost, not_holder, fence_required) with the safety rationale. It also discloses the tool is free, requires auth, and has an HTTP route, adding depth beyond structured metadata.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is information-dense and front-loaded with the main purpose and the surprising hand-back use case. However, it contains redundancy—'FREE' appears twice, and 'this tool never charges' repeats the point—and the fence explanation is lengthy, though necessary. Overall it is reasonably structured but not perfectly concise.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Despite having no output schema, the description covers the full behavioral spectrum: success and failure modes, dead-lettering, fence edge cases, error codes, authentication, and the HTTP equivalent. This is a complex tool, and the description is sufficiently complete for an agent to invoke it correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, establishing a baseline of 3. The description enhances retry semantics (immediate return instead of waiting out the lease) and fence semantics (failure codes and the rationale for refusing stale/fenceless calls), though other parameters rely on their schema descriptions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's role as reporting a work item that did not work out, but also reveals it is the correct way to hand back an item when nothing went wrong, explicitly noting there is no work_release. It distinguishes from siblings by referencing work_done and work_status, making the purpose unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It provides explicit when-to-use guidance: use retry:true to immediately return an item for another worker (since there is no work_release), and retry:false to permanently fail it. It also warns about fence behavior matching work_done, giving a clear alternative for successful completion.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
work_pushPush work items onto a durable queueAIdempotentInspect
THE ALTERNATIVE TO THIS IS WRITING DISTRIBUTED WORK-DISTRIBUTION CODE YOURSELF — assignment, collision avoidance, lease expiry, retry, dead-worker recovery, straggler policy. Push 100 items in one go and exit, and keep pushing until the queue holds your whole batch; workers pull independently, with no assignment logic, no coordinator and nothing staying alive. FREE, and IDEMPOTENT PER item_id: pushing the same item_id twice adds it once, so a retrying parent cannot duplicate the fan-out. Payloads are opaque and never parsed. FREE — this tool never charges. Authenticate with Authorization: Bearer , or pass agent_key as an argument if your host cannot set headers. Equivalent HTTP route: POST /v1/work/push.
| Name | Required | Description | Default |
|---|---|---|---|
| items | Yes | Up to 100 per call. Each entry is {item_id, payload} or a bare string used as the item_id. item_id <=128 chars, payload <=8192 bytes. A queue holds 2000 items over its LIFETIME, finished ones included, because work_status keeps their results and dead letters; over that, pushes are refused by name rather than dropped. Example: '[{"item_id":"P-1","payload":{"url":"..."}}]'. | |
| queue_id | Yes | Your name for this queue. Namespace-scoped: it belongs to the namespace that created it, and only a caller holding that agent_secret can push to or take from it. Example: 'permit-batch-2026-08'. | |
| agent_key | No | Your agent_secret, if your MCP host cannot set the Authorization header. Prefer the header. | |
| ttl_seconds | No | Queue retention. Default 604800 (7d), max 2592000 (30d). Example: '604800'. | |
| max_attempts | No | How many times an item may be handed to a worker before it is dead-lettered. Default 3, max 20. Set on first push; later pushes do not change it. Example: '3'. |
Tool Definition Quality
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description goes well beyond annotations, disclosing idempotency (per item_id), opaque payloads, free usage, authentication methods, HTTP route, and queue lifetime limits. It aligns with idempotentHint=true and readOnlyHint=false, with no contradiction.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is dense and somewhat verbose, with dramatic capitalization and repeated mention of 'FREE' twice. However, it is front-loaded with the core alternative and packs in critical details, making it long but not without purpose.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the lack of an output schema, the description explains what happens on push (queue holds items, workers pull), failure modes (refused when over limit), and operational specifics (auth, HTTP route). It is thorough, though it omits the exact success response format.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Even though schema coverage is 100%, the description adds meaning to parameters by explaining idempotency semantics for items, namespace-scoping for queue_id, and authentication alternatives. This enriches the schema without being redundant.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The title and description clearly state the tool pushes work items onto a durable queue. The description specifies the action ('Push 100 items in one go and exit') and contrasts with alternative approaches, distinguishing it from sibling tools like work_take.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides clear usage context: it is for enqueueing work without building custom distribution, with batching and idempotency advice. It does not explicitly mention sibling tools for pulling or processing, but the contrast with writing your own system gives strong when-to-use guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
work_statusHow far along is the fan-outAIdempotentInspect
Turn a fan-out from a black box into something you can act on: how many items are pending, leased, done, failed and dead-lettered, the results collected so far, and every dead letter with the error that exhausted it. THIS IS WHAT LETS A PARENT PROCEED WITH 4 OF 5 instead of blocking on a straggler. Counts are produced by scanning the queue, not from counters that can drift. $0.002 ONLY when there is real progress — at least one completion, failure or dead letter — and only when the answer has changed since you last paid for it. An untouched queue charges nothing and says so. The counts are exact and never paged; the results and dead-letter ARRAYS are windowed at 50 rows each and hand you a page token when there is more, so every dead-lettered item is genuinely reachable rather than merely flagged as missing. Paging is free — you are charged per distinct progress state, not per page. Costs $0.002 USDC per call via x402 on Base, and ONLY when done + failed + dead_lettered >= 1, and this exact progress state has not been billed before; otherwise the same call returns the full answer and settles nothing. Authenticate with Authorization: Bearer , or pass agent_key as an argument if your host cannot set headers. Equivalent HTTP route: POST /v1/work/status.
| Name | Required | Description | Default |
|---|---|---|---|
| queue_id | Yes | The queue. Alias: job_id. Example: 'permit-batch-2026-08'. | |
| agent_key | No | Your agent_secret, if your MCP host cannot set the Authorization header. Prefer the header. | |
| dead_page_token | No | Optional: the `next_dead_page_token` from a previous call, to read the next page of dead letters. Opaque — hand it back exactly as given. Omit for the first page. Example: 'x:item-0051'. | |
| results_page_token | No | Optional: the `next_results_page_token` from a previous call, to read the next page of results. Opaque — hand it back exactly as given. Omit for the first page. Example: 'c:00001754932100000:item-0051'. |
Tool Definition Quality
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description discloses critical behavioral details beyond annotations: billing occurs only when there is real progress and the state changed, counts are exact (scanned, not drifted), arrays are windowed at 50 rows with page tokens, paging is free, and authentication methods. This is far more than the idempotentHint/readOnlyHint annotations provide, with no contradictions.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is dense but every sentence adds unique value: purpose, use case, counting method, cost model, pagination, and auth. It is front-loaded with the core purpose and then details. While long, the all-caps emphasis and multiple clauses make it slightly harder to scan, but it remains appropriately sized for the tool's complexity.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema, the description must describe the return shape, and it does: counts, collected results, dead letters with errors, and page tokens. It also covers cost, idempotency, auth, and the equivalent HTTP route. For a tool with billing and pagination nuances, this is comprehensive and leaves no essential behavior unexplained.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the description does not need to define basic parameters. It adds meaning beyond the schema by explaining that page tokens enable access to windowed arrays, that paging is free, and how agent_key relates to the Authorization header. This contextualizes the parameters' purpose and usage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's function: turning a fan-out from a black box into something actionable by reporting counts (pending, leased, done, failed, dead-lettered), results, and dead letters. It uses a specific verb ('turn... into') and resource (fan-out progress), and the use case (proceeding with 4 of 5) differentiates it from generic status tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly identifies when to use this tool: when a parent needs to decide whether to proceed with partial completions instead of blocking on a straggler. It provides context for use but does not explicitly name alternatives or state when not to use it, relying on the clear scenario to imply usage.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
work_takeTake work, leased so a dead worker cannot lose itAInspect
Take up to n items, LEASED not deleted — the same lease semantics as lease()/renew()/release(): a holder, a fence token, an expiry. Two workers can never be handed the same item, because one single-threaded Durable Object owns the queue. IF YOUR PROCESS DIES THE LEASE SIMPLY EXPIRES AND THE ITEMS RETURN TO THE QUEUE with attempts incremented; nothing had to stay alive to notice, and that recovery is the point. EACH ITEM CARRIES ITS OWN FENCE, drawn independently on every take: the token you are given for one item tells you nothing about the token another worker was given for another item, and it is not the previous holder's token plus one. The item's ORDER is generation (identical to attempts, the number of times it has been handed out) — that is the number to compare and the number to hand to an external store; the fence is the secret. $0.002 when at least one item is handed to you for the FIRST time; a re-take after your own lease expired is free, exactly like mailbox redelivery. An empty or cancelled queue returns nothing, says so, and costs nothing. Costs $0.002 USDC per call via x402 on Base, and ONLY when at least one item was handed to a worker for the FIRST time (a re-take after a lease expired is free); otherwise the same call returns the full answer and settles nothing. Authenticate with Authorization: Bearer , or pass agent_key as an argument if your host cannot set headers. Equivalent HTTP route: POST /v1/work/take.
| Name | Required | Description | Default |
|---|---|---|---|
| n | No | How many items to take. 1..25. Default 1. Example: '5'. | |
| holder | No | Who is taking — an instance id you choose, exactly as with lease(). Default 'worker'. Example: 'worker-3'. | |
| queue_id | Yes | The queue to take from. Alias: job_id — a job and its work queue are the same thing. Example: 'permit-batch-2026-08'. | |
| agent_key | No | Your agent_secret, if your MCP host cannot set the Authorization header. Prefer the header. | |
| lease_seconds | No | How long you hold them before they return to the queue. Default 300, min 5, max 86400. Example: '300'. |
Tool Definition Quality
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description covers critical behaviors beyond the annotations: leases expire and items return, fence tokens are independent, generation equals attempts, empty queues return nothing, and pricing only applies on first-time handouts. It also details authentication methods and the equivalent HTTP route — all valuable context that annotations (all false) do not provide.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, extremely long paragraph with repeated pricing information and all-caps emphasis. It lacks bullet points or structured sections, making it harder to parse quickly. Several sentences could be merged or removed without losing value, so it fails the 'every sentence earns its place' test.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema, the description thoroughly explains what happens on success, on empty/cancelled queues, and on re-takes after lease expiry. It also covers pricing, authentication, and the HTTP route, making the tool fully self-contained for an agent to invoke correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the baseline is 3. The description adds background on lease semantics and examples (e.g., n up to 25, lease_seconds defaults), but it does not go beyond the parameter-level details already present in the schema. It therefore meets the baseline without meaningful enrichment.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with 'Take up to n items, LEASED not deleted' — a specific verb, resource, and lease semantics that clearly distinguish it from sibling lease management tools. It also explicitly contrasts with lease()/renew()/release() and mentions the same behavior, leaving no ambiguity about what work_take does.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explains when items return to the queue (lease expiry) and what happens on empty/cancelled queues, giving clear operational context. However, it does not explicitly name alternative tools like work_done or work_fail for when NOT to use this tool, so the guidance stays implied rather than explicitly exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Claim this connector by publishing a /.well-known/glama.json file on your server's domain with the following structure:
{
"$schema": "https://glama.ai/mcp/schemas/connector.json",
"maintainers": [{ "email": "your-email@example.com" }]
}The email address must match the email associated with your Glama account. Once published, Glama will automatically detect and verify the file within a few minutes.
Control your server's listing on Glama, including description and metadata
Access analytics and receive server usage reports
Get monitoring and health status updates for your server
Feature your server to boost visibility and reach more users
For users:
Full audit trail – every tool call is logged with inputs and outputs for compliance and debugging
Granular tool control – enable or disable individual tools per connector to limit what your AI agents can do
Centralized credential management – store and rotate API keys and OAuth tokens in one place
Change alerts – get notified when a connector changes its schema, adds or removes tools, or updates tool definitions, so nothing breaks silently
For server owners:
Proven adoption – public usage metrics on your listing show real-world traction and build trust with prospective users
Tool-level analytics – see which tools are being used most, helping you prioritize development and documentation
Direct user feedback – users can report issues and suggest improvements through the listing, giving you a channel you would not have otherwise
The connector status is unhealthy when Glama is unable to successfully connect to the server. This can happen for several reasons:
The server is experiencing an outage
The URL of the server is wrong
Credentials required to access the server are missing or invalid
If you are the owner of this MCP connector and would like to make modifications to the listing, including providing test credentials for accessing the server, please contact support@glama.ai.
Discussions
No comments yet. Be the first to start the discussion!
Related MCP Servers
- Flicense-qualityBmaintenanceLease governed AI agent instances without hand-built runner queues.
- AlicenseAqualityDmaintenanceProvides state and log management tools designed for long-lived AI agents that may be interrupted and resumed. It enables tracking agent progress and maintaining an append-only event history to ensure continuity across multiple sessions.4MIT
- Flicense-qualityBmaintenanceDurable MCP control plane for coordinating agent networks, with message ledger, idempotent delivery, and cryptographic identity for each orchestrator.
- Alicense-qualityBmaintenanceEnables durable agent session transfer between machines by serializing state, provisioning sandboxes, and metering costs via MCP tools over a Postgres-backed state machine.3MIT