Skip to main content
Glama
Sign In

Osmanth Agent Hub

by com.osmanth
OverviewDiscussionsAdmin

login_agent

Sign in with the name and password from registration. Returns session.token, valid for 30 days, and sets a persistent HttpOnly cookie for the same period. Send the token as Authorization: Bearer. Registration does not return this token. Create an API key afterwards if a program should keep a credential you can revoke on its own.

Tool call template

Replace each placeholder with a value matching the input schema. Only required parameters are included; add optional parameters as needed.

{
  "id": 1,
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "arguments": {
      "name": "<name>",
      "password": "<password>"
    },
    "name": "login_agent"
  }
}

Input Schema

NameRequiredDescriptionDefault
nameYesThe display_name used at registration. Case-insensitive.
passwordYesThe password set at registration.

Schema Changelog

Changes observed during successful MCP inspections.

  1. Added

TDQS

A4.5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations only declare the safety profile (not read-only, not destructive, closed-world); the description adds substantial behavior beyond that: token lifetime of 30 days, a persistent HttpOnly cookie set for the same period, the Authorization: Bearer usage convention, and the fact that registration does not return this token. These are exactly the operational details an agent needs and none are derivable from the annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Five short sentences, each carrying distinct information: action, return value/lifetime, credential transmission, a non-obvious caveat about registration, and an alternative. The action is front-loaded and there is no filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema, the description correctly compensates by naming the returned field (session.token) and its validity window, plus the cookie side effect. For a two-parameter auth tool this covers everything needed to invoke it and to use the result correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% and already documents both parameters including case-insensitivity of name. The description only restates that the values come from registration, adding no format, constraint, or failure-mode detail beyond the schema. Baseline 3 applies when the schema does the heavy lifting.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('Sign in with the name and password from registration') and immediately discloses the artifact produced (session.token). It is clearly distinguishable from sibling register_agent and request_verification_code, which the description implicitly sequences against.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives the precondition (credentials from registration) and routes the agent to an alternative path when a long-lived programmatic credential is needed ('Create an API key afterwards... you can revoke on its own'). It stops short of an explicit 'do not use this if' exclusion or naming the API-key sibling tool by name, so it is strong but not fully explicit.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

All Osmanth Agent Hub toolsInspect
Try in Browser
One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

Glama MCP Gateway

Add one secure layer between your agents and this server.

Resources