Skip to main content
Glama

Server Details

Hosted remote MCP connector for Pane (OAuth 2.1): hand a human a rich interactive UI by URL and get structured data back — forms, approvals, surveys, pickers, editable lists. No install; works from Claude web/desktop/mobile and other remote-MCP clients.

Status
Healthy
Last Tested
Transport
Streamable HTTP
URL

Glama MCP Gateway

Connect through Glama MCP Gateway for full control over tool access and complete visibility into every call.

MCP client
Glama
MCP server

Full call logging

Every tool call is logged with complete inputs and outputs, so you can debug issues and audit what your agents are doing.

Tool access control

Enable or disable individual tools per connector, so you decide what your agents can and cannot do.

Managed credentials

Glama handles OAuth flows, token storage, and automatic rotation, so credentials never expire on your clients.

Usage analytics

See which tools your agents call, how often, and when, so you can understand usage patterns and catch anomalies.

100% free. Your data is private.
Tool DescriptionsA

Average 4.6/5 across 22 of 22 tools scored. Lowest: 3.9/5.

Server CoherenceA
Disambiguation5/5

Each tool targets a distinct resource or action: row operations (get/list/upsert/update/delete/restore) are clearly separated, while apps, attachments, community, grants, ingest, members, publisher, review, and taste each cover a different domain. Even closely related actions like share_link_rotate and domain_set have clearly scoped descriptions, so an agent can reliably select the right tool.

Naming Consistency4/5

Tool names use two patterns: noun-like names for resource areas (apps, attachments, community, grants, ingest, members) and verb_noun names for row operations (upsert_row, delete_row, etc.). This deviation is predictable and readable, but it is not perfectly uniform, so a slight deduction applies.

Tool Count4/5

With 22 tools, the server is on the heavier side, but the breadth of the platform (app lifecycle, data storage, attachments, community, reviews, feedback, identity) justifies the count. Each tool represents a meaningful feature area with multiple internal actions, so none feels redundant.

Completeness5/5

The tool surface covers the full lifecycle for apps (create, read, update, delete), rows (create, read, update, delete, restore, list deleted), attachments, membership, grants, ingest, community, and reviews. Obvious gaps like rollback or version history are not core to the domain, and the presence of get_skill helps agents understand the workflow.

Available Tools

25 tools
agentManage Agent IdentityAInspect

Agent identity and binding. Actions: whoami returns the resolved relay URL, the active profile and whether a key is configured, with no network call and no secrets; claim binds this agent to a human using a one-shot claim code from their Settings UI, and is one-way; logout clears the locally saved key and profile but does not revoke it on the relay, which is what the key tool's revoke action does.

ParametersJSON Schema
NameRequiredDescriptionDefault
codeNoThe one-shot claim code (required for claim).
actionYesAgent identity. whoami: show the resolved relay URL, active profile, and whether a key is configured (no network, no secrets). claim: bind this agent to a human via a one-shot claim code the human generated in their Settings UI (one-way). logout: clears the locally-saved key/profile; the key is not revoked on the relay, which is what the key tool's revoke action does.
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Discloses behavioral traits beyond the annotations: whoami has no network call or secrets, claim is one-way, and logout only clears local state without revoking on the relay. The annotations are all false, providing no safety signals, so this context is valuable.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description opens with the tool's purpose, then lists actions in a structured way. It is somewhat lengthy but each clause adds necessary detail. No filler text.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Covers all actions, their side effects, and alternatives. It even describes the return value for whoami, which is useful given no output schema. Complete for a three-action tool with two parameters.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema already provides full descriptions for both parameters (100% coverage), including detailed action semantics. The description adds little beyond what the schema's action enum already documents, such as the Settings UI origin for the code, but this is also present in the schema. Baseline of 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states 'Agent identity and binding' and enumerates the three actions (whoami, claim, logout) with specific behaviors. It distinguishes from siblings by referencing the `key` tool's revoke action for logout's non-revocation.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly states that logout does not revoke the key on the relay, directing the user to the `key` tool's revoke action for that purpose. Also clarifies whoami makes no network call and claim requires a one-shot code from the Settings UI.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

appsManage AppsA
Destructive
Inspect

The v2 app lifecycle apart from creation and redeploy, which deploy_app covers. Actions: list returns the owning human's apps; show returns full detail including manifest, timezone and has_share_token; audit is a read-only security review of every app the caller owns, computed from each app's stored manifest, which is what makes it see apps that were deployed once and never redeployed (a deploy-time warning never reaches those). It reports collections whose declared permissions expose them, worst first: severity 'high' means an anonymous visitor can exploit it today, typically a collection that admits "anyone" to write with no separate 'update' list, so any visitor can overwrite rows other people created rather than only adding their own. It changes nothing; the fix is a redeploy declaring the missing list, and the right list differs per app, so read the app before proposing one. update changes visibility and timezone, the slug being immutable, and switching to 'link' returns a share_url once; share_link_rotate issues a new share token for a 'link' app, returning a new share_url and revoking the old link, and generates one if the app has none; delete is an idempotent soft-delete; wake wakes a dormant app and is otherwise a no-op that reports the actual status; domain_set binds a custom domain and returns the DNS records the domain owner must publish, where the first domain bound serves the app and every later one redirects to it, which is how apex plus www is configured; domain_status returns the serving domain and its aliases, live-refreshed against Cloudflare when that is enabled, with last_error carrying the reason a domain is not activating; domain_remove unbinds one domain, or all of them when no domain is given, and is idempotent.

ParametersJSON Schema
NameRequiredDescriptionDefault
slugNolist only. Exact-match slug filter.
limitNolist only. Page size.
actionYeslist: the caller's owning human's apps. show/update/delete/wake: act on one app (app_id). audit: read-only security review of every app the caller owns. share_link_rotate: rotate a 'link' app's share token, returning a new share_url (the old link stops working); also generates one if the app has none yet. domain_set/domain_status/domain_remove: manage the app's custom domains (app_id; domain_set also needs domain).
app_idNoRequired for show/update/share_link_rotate/delete/wake/domain_set/domain_status/domain_remove.
cursorNolist only. Opaque cursor from a previous next_cursor.
domainNodomain_set: the bare custom domain to bind (e.g. app.example.com); the response's dns_records lists the DNS entries the domain owner must publish. domain_remove: optional, the one domain to unbind - omit it to unbind them all.
statusNolist only. Default: active.
severityNoaudit only. Return findings of this severity only. The response's `counts` always describe the whole audit, so filtering never hides that other findings exist.
timezoneNoupdate only. The app's IANA timezone for `schedules` reminders (e.g. Europe/Berlin). An app that declares schedules with no timezone fires reminders at 08:00 UTC.
visibilityNoupdate only. The new visibility (slug is immutable).
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations only say destructiveHint=true, but the description discloses far more: audit is read-only and computed from stored manifests, delete is an idempotent soft-delete, wake is a no-op that reports status, share_link_rotate revokes the old link, domain_set makes the first domain serve and later ones redirect, and domain_remove without domain removes all. This is exactly the kind of behavioral context that goes beyond annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single dense paragraph with a run-on structure, making it hard to scan. While every sentence adds value, it lacks front-loading and would benefit from a structured list of actions. It is adequately informative but not concise or well-structured enough for a 5.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity (10 actions, 10 parameters, no output schema), the description covers all actions, edge cases, and domain-specific behavior (e.g., audit severity explanations, domain aliasing, timezone defaults). It is complete enough for an agent to select and invoke the tool correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% with detailed parameter descriptions already present. The tool description adds little parameter-specific meaning beyond what the schema provides; any extra nuance (e.g., domain_remove omitting domain removes all) is also present in the schema. Baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states it covers the v2 app lifecycle apart from creation and redeploy, explicitly naming deploy_app as the sibling covering those. It enumerates all actions (list, show, audit, update, etc.) with their specific resources, making the tool's purpose unmistakable and distinct from deploy_app.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It explicitly directs deploy_app for creation/redeploy, providing an alternative. For each action it gives context on when to use it (e.g., audit for security review, domain_set for custom domains) and even advises reading the app before proposing a fix, which is strong when-to-use guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

attachmentsManage AttachmentsA
Destructive
Inspect

Binary attachments (images, PDFs, audio, video) referenced from event payloads and input_data via format: homespun-attachment-id. Actions: upload, fetch, presign, finalize, download, show, list, delete, mint_token, revoke_token, list_tokens.

Choosing an upload path matters for cost. An inline upload with content_base64 carries the bytes in the tool-call arguments, so they enter the model context at a token cost proportional to file size, paid again on every retry; a few-hundred-KB image is already expensive. Two paths avoid that entirely: fetch, when the bytes are reachable at a URL, and presign plus finalize, when the client can PUT the raw bytes out of band. Inline upload suits small assets and clients that have neither a URL nor an out-of-band PUT.

fetch takes { source_url (https), scope } and the relay downloads the URL itself behind an SSRF guard (https only, no private, loopback or metadata hosts, DNS pinned, redirects refused, size-capped and timed out), then runs the same byte-sniff, allowlist, size, quota and scan checks as any upload. It works on any storage backend. upload takes either content_base64 (base64 bytes, no filesystem) or file_path (an absolute path read on the relay host, so it only applies when the file is local to the relay). presign plus finalize is token-free: presign with { mime, size, sha256, scope } returns { put_url, attachment_id }, the caller PUTs the raw bytes to put_url over plain HTTP out of band, then finalize with the attachment_id. At finalize the relay re-reads the stored bytes, sniffs the real type, and enforces the same allowlist, size, sha256, quota and scan checks, so a presign that misstates its mime is caught and never served inline. The presigned path requires the Azure storage backend; a filesystem-backed relay returns a clear not-supported error and fetch or inline upload apply there instead. download writes to an absolute out_path or returns base64. An upload is scoped to agent (the default, reusable) or app. mint_token returns a /b/ capability URL, shown once, that a browser can GET without the caller's API key.

ParametersJSON Schema
NameRequiredDescriptionDefault
mimeNoupload/presign: advisory Content-Type. The relay byte-sniffs the actual bytes and stores/serves that sniffed type regardless (a lying mime is caught, never served inline). Required for presign (scopes the upload URL + fails fast against the allowlist).
onceNomint_token: token self-deletes on first GET.
sizeNopresign: the exact byte length you will PUT. Committed at presign and re-verified against the uploaded bytes at finalize.
limitNolist page size (1..100).
scopeNoupload scope (default agent).
actionYesBinary attachment operations. The upload path affects token cost: `fetch` and presign plus finalize keep the bytes out of the model context entirely, while upload with `content_base64` carries them in the tool-call arguments at a cost proportional to file size, paid again on every retry. fetch takes { source_url, scope } and the relay downloads the bytes itself (https only, SSRF-guarded), running the same sniff, allowlist, size, quota and scan checks as any upload. upload takes `content_base64` (base64 bytes, no filesystem) or `file_path` (absolute, read on the relay host), scoped agent or app. presign plus finalize is three steps: presign with { mime, size, sha256, scope }, PUT the bytes to put_url out of band, then finalize, which re-sniffs and re-checks them. download fetches bytes by attachment_id to an absolute out_path or returns base64. show returns metadata only. list returns the agent's attachments. delete is a soft-delete. mint_token mints a /b/<token> capability URL, returned once. revoke_token and list_tokens manage those tokens.
app_idNoRequired when scope=app.
cursorNolist pagination cursor.
sha256Nopresign: the hex SHA-256 (64 chars) of the exact bytes you will PUT. Committed at presign and re-verified against the uploaded bytes at finalize.
filenameNoupload: display filename (defaults to the file's basename).
out_pathNodownload: absolute path to write the bytes to. If omitted, the bytes are returned base64-encoded in the result.
token_idNorevoke_token: the token id to revoke.
file_pathNoupload: absolute path to a file read on the server host running this MCP connector (the relay), not the calling agent's machine. It resolves only when the file is local to the relay (e.g. a locally-run CLI); a hosted or remote agent supplies the bytes as `content_base64` instead.
source_urlNofetch: an https URL the relay downloads server-side, so the bytes do not enter the model context and cost no tokens. SSRF-guarded: https only, no private, loopback, link-local or metadata hosts, DNS pinned, redirects refused, size-capped and timed out. The downloaded bytes run the same byte-sniff, allowlist, size, quota and scan checks as any upload. This and presign plus finalize are the zero-context paths for real images and media.
ttl_secondsNomint_token: per-token TTL (clamped by scope default).
attachment_idNoAttachment id. Required for download/show/delete/mint_token/revoke_token/list_tokens.
content_base64Noupload: the file bytes as base64, sent inline with no filesystem access. The base64 rides in the tool-call arguments and enters the model context, costing tokens proportional to file size; a few-hundred-KB image is already expensive, and the cost repeats on every retry. presign plus finalize avoids that for any real image or media whenever the client can do an out-of-band HTTP PUT, which leaves `content_base64` suited to small assets such as a tiny icon, and to clients that cannot PUT out of band. If both `content_base64` and `file_path` are given, `content_base64` wins. The relay sniffs the real type and enforces the same size, allowlist and quota checks as a file upload.
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond annotations (readOnlyHint=false, destructiveHint=true), the description discloses SSRF guards, soft-delete semantics, token shown-once behavior, byte-sniffing with mime misstatement being caught, and backend-specific error conditions. This adds substantial contextual detail without contradicting the annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Although long, the description is dense with essential information: cost model, security constraints, backend dependencies, and per-action behavior. It opens with the core resource, then moves to the most consequential decision (upload cost), and proceeds logically through each action—high signal density with no filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With 11 actions, 17 parameters, no output schema, and numerous operational constraints, the description covers all actions, key return shapes (put_url, base64, metadata-only), failure modes, and security safeguards. It is complete enough for an agent to correctly select and invoke any action.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% and every parameter has a highly detailed description, so the baseline of 3 applies. While the tool description reinforces critical choices like content_base64 vs file_path, it does not add meaning significantly beyond the schema's own strong explanations.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The opening sentence identifies the resource (binary attachments) and the exact format they're referenced by, then enumerates all 11 actions. This clearly distinguishes the tool from sibling operations like row access or row manipulation.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives explicit decision guidance on upload path selection based on cost, with clear trade-offs among inline, fetch, and presign+finalize. It also states prerequisites (presign requires Azure, file_path requires relay-local file) and notes when fetch applies to any backend.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

communityCommunity TemplatesA
Destructive
Inspect

Publishing an app as a community template, taking your own listing back down, installing a template, and, for relay operators, reviewing submissions. Actions: publish, unpublish, get_config_contract, install, list_pending, get_submission, approve, reject, set_trust_level.

publish captures a live app (html, manifest, the seed rows of its seedOnInstall collections, and listing metadata) into a pending template. It is installable by the returned direct link but is not listed in the public gallery until an operator approves it, and it requires a verified email and no more than a few pending submissions at once. Privacy consequence: an approved template's content and its captured seed rows become public to every platform user, so seed data in a published app must be example-only rather than real personal data. attest_example_only:true records that this was checked. A template may take a per-publisher slug (namespaced as /) and a semver version defaulting to 1.0.0, and a republish under the same slug must bump the version.

unpublish is the publisher's own undo for a live listing, taken down by snapshot_id: it leaves the public gallery, search, and the direct snapshot install link. It works only on your own submissions, and a snapshot that does not exist or belongs to someone else reads as not found either way. Existing installs are unaffected, because an install is a fresh private copy rather than a live reference, so unpublishing never breaks an app someone already installed. It is idempotent, and publishing a new version is the way to put the listing back.

get_config_contract reads what a template needs at install, meaning its settings collection and its ordered config and upload steps, by ref. install creates a fresh private copy of a template for the caller's owning human, passing answers as config, where a 'config' value is a string and an 'upload' value is a pre-uploaded attachment id from the attachments tool.

The review actions are limited to the relay's configured community reviewers: list_pending returns the queue; get_submission returns a submission's full content by snapshot_id; approve lists it in the gallery, where a re-publish supersedes the app's prior approved version; reject takes a required note that lands in the publisher's app feed.

ParametersJSON Schema
NameRequiredDescriptionDefault
refNoget_config_contract/install only. The template to read or install: a namespaced '<handle>/<slug>' or a community snapshot id.
noteNoreject only. The required rejection note shown to the publisher (delivered to their app feed).
slugNopublish only. Optional per-publisher slug (lowercase, 3 to 48 chars, hyphens). Gives the template a namespaced id <handle>/<slug>; a republish reuses the slug and must bump the version. If omitted, a slug is derived from the title instead of leaving the template unnamed, so this field matters only when a specific url is wanted. Slugs are immutable: renaming the template later does not move its url, so the slug chosen here is permanent.
tagsNopublish only. Up to 6 curation tags.
limitNolist_pending only. Page size (1..200).
titleNopublish only. Listing title (1 to 80 chars). Defaults to the app's manifest name.
actionYespublish: publishes one of the caller's apps as a community template (app_id; optional title/description/category/tags). Privacy consequence: publishing makes the template content and the captured seed rows (the live rows of every seedOnInstall collection, captured at publish time) public to every platform user once approved, so an app whose seedOnInstall collections hold real personal data (names, emails, addresses, messages, anything private) is not safe to publish: seed data must be example-only. attest_example_only:true records that this was checked. The capture (html + manifest + seed rows) lands pending review, installable by its returned direct link but not listed until approved; an established publisher is fast-tracked, and the response's expedited/auto_approved fields report which path it took. unpublish: takes one of the caller's own published templates back down (snapshot_id). It removes the listing from the public gallery, from search, and from the direct snapshot install link. Existing installs keep working untouched, because an install is a fresh private copy rather than a live reference. It is idempotent (unpublishing an already-unpublished template is a no-op), and a snapshot that does not exist or belongs to someone else reads as not found either way. Publishing a new version is what puts the listing back. get_config_contract: read a template's install-time config contract by `ref` (a namespaced '<handle>/<slug>' or a snapshot id): its settings_collection, ordered config_steps (each with key/kind/required/secret/choices/default), and connect_steps (inbound hooks the app receives on). An 'upload' step wants a file, pre-uploaded with the attachments tool (scope agent) and passed as its attachment id. A template installed with connect_steps provisions hook URLs, which the `ingest` tool's list action returns for the new app_id, ready to wire into the external service. install: installs a template by `ref` for the caller, whose owning human becomes the owner. `config` is { stepKey: value } from the contract: a 'config' step's value is a string, an 'upload' step's value is a pre-uploaded attachment id. An omitted required step is rejected. Returns the new app's id, slug, and url; installs always create a fresh private copy. list_pending / get_submission / approve / reject / set_trust_level are relay-operator-only review actions: list_pending (the review queue, expedited submissions first), get_submission (a submission's full html+manifest+seedRows plus external_destinations, the hosts it can send data to or pull data from, by snapshot_id), approve (snapshot_id, lists it in the gallery + supersedes the app's prior approved version), reject (snapshot_id + a required note that lands in the publisher's app feed), set_trust_level (promote/demote a publisher by handle: handle + trust_level 'new'|'established'). upgrade_check / upgrade / revert keep an already-installed app current with its source template (app_id). An install is a one-shot fork, so nothing updates on its own and there is no follow/pin: you have to ask. upgrade_check reports whether a newer live version of that app's template line exists, whether it would apply cleanly, and what it would newly be allowed to reach. upgrade applies it in place, keeping the app's address, collections and rows, and landing as a new version you can undo. It refuses outright, with no override, when the new version would strand rows the app already holds; when the new version merely asks for more than the installed one, pass accept_permissions:true, but only after showing the owner what `permission_lines` says. revert puts the app back on the version it ran before the last update, and refuses when rows written since would have nowhere to live under the older one.
app_idNopublish / upgrade_check / upgrade / revert. For publish, the app to publish. For the three upgrade actions, the installed app to act on: an installed template is a fork, so the question is whether a newer version of the template that app came from exists, which only the app can answer.
configNoinstall only. The install-time answers as { stepKey: value } from the config contract: a 'config' step's value is a string, an 'upload' step's value is a pre-uploaded attachment id. Omit for a template with no config steps.
cursorNolist_pending only. Opaque cursor from a prior next_cursor.
handleNoset_trust_level only. The @-handle of the publisher to promote or demote.
versionNopublish only. Semver MAJOR.MINOR.PATCH (default '1.0.0'). A republish under the same slug must be strictly greater than the current version.
categoryNopublish only. Optional single-word category (e.g. 'household').
descriptionNopublish only. Listing blurb (up to 200 chars). Defaults to the manifest description.
setup_stepsNopublish only. Ordered typed setup steps an installing agent follows after install (up to 20). A 'config'/'upload' step may carry a `key` naming a field of the manifest's settingsCollection that its install-time answer is written into; a 'connect' step may carry an `ingestRule` naming a manifest ingest rule it wires up. Read back via get_submission and rendered on the template detail page.
snapshot_idNoRequired for get_submission/unpublish/approve/reject. The submission's snapshot id (from publish's response or list_pending).
trust_levelNoset_trust_level only. 'established' fast-tracks the publisher's future submissions through review; 'new' reverts to full review.
changelog_noteNopublish only. A short note recorded in this version's changelog.
expect_versionNoupgrade only. The version upgrade_check reported. When given, the upgrade is refused if the offer has moved since, so a publisher shipping again mid-flight cannot slip a version past you that you never showed anyone.
long_descriptionNopublish only. Optional long-form description (up to 4000 chars) shown on the template detail page below the short blurb, for readers and search ranking. Plain text: blank lines become paragraphs, and it is escaped (never rendered as raw HTML), so write prose, not markup.
accept_permissionsNoupgrade only. Required when upgrade_check reports a non-empty `permissions` diff, meaning the new version asks for more than the installed one (new hosts it can send data to, new device capabilities, a service worker, CDN scripts). Never assume it: show the owner `permission_lines` and set this only once they have agreed. It does not clear a version that would strand rows, which nothing can.
attest_example_onlyNopublish only. True attests that the template content and the captured seed rows contain no real personal data. Publishing makes both public to every platform user, so seed data (the live rows of the app's seedOnInstall collections) must be example-only, never real names/emails/addresses/private messages. Recorded and shown to the reviewer; omitting it still publishes but is flagged to the operator as not attested.
derived_from_snapshot_idNopublish only. Optional remix/fork lineage: the snapshot id this template was derived from.
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description goes well beyond annotations, disclosing privacy consequences of publishing (seed rows become public), idempotence of unpublish, install isolation, upgrade refusal conditions, and attestation requirements. These are valuable behavioral details not expressed in readOnlyHint/destructiveHint, with no contradictions.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is long but organized by action, front-loaded with an overview. It is somewhat verbose and repeats content from the action parameter description, but for a multi-action tool with 12 sub-actions, the structure is appropriate and every part serves a purpose.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The main description omits the upgrade_check/upgrade/revert actions from its initial action enumeration and does not explain return values (no output schema). Those gaps are partially filled by the action property description in the schema, but the main description still leaves a coverage gap for a significant subset of actions.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With 100% schema coverage, the baseline is 3. The description adds meaningful parameter relationships such as the slug/version interplay for republishing, the distinction between config and upload values, and snapshot_id ownership semantics. Though it does not systematically document every parameter, it clarifies how key parameters interact.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's scope: publishing an app as a community template, unpublishing, installing, and operator review actions. It enumerates the specific actions and distinguishes this from sibling tools like 'publisher' and 'review' by centering on the community template lifecycle.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides clear context for each action: when to use publish vs unpublish, that list_pending/approve/reject are for relay operators, and that install creates a fresh private copy. However, it does not explicitly name alternatives or state 'use this instead of X' for overlapping sibling tools like deploy_app or publisher.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

connectionsManage App ConnectionsA
Destructive
Inspect

A v2 app's Connections: the stored credential (a static header token, or a full generic OAuth2 client) a manifest webhook rule authenticates its delivery target with, bound to a host so the credential can never be exfiltrated to another one. There is no update action: change a connection by deleting and recreating it. Actions: create stores a static or oauth2 connection and returns its metadata, never the secret; list returns the app's connections as metadata plus a non-reversible fingerprint, never any secret; delete is idempotent; consent_url builds (never fetches) the browser URL that completes an oauth2 connection's consent, since that is inherently a human-in-a-browser step an agent key cannot complete. A newly created oauth2 connection starts in pending_auth until the owner opens the consent_url and approves.

ParametersJSON Schema
NameRequiredDescriptionDefault
kindNocreate only. Defaults to `static`.
nameNocreate / delete / consent_url. The connection name (lowercase, starting alphanumeric, up to 64 chars) that a manifest webhook rule's `connection` field references.
labelNocreate only. Optional owner-facing label.
actionYescreate: store a webhook connection, a stored credential (static header token or a full generic OAuth2 client) a manifest webhook rule authenticates its target with (app_id+name+allowed_host, plus kind-specific fields). list: the app's connections as metadata plus a non-reversible fingerprint, never any secret (app_id). delete: idempotent (app_id+name). consent_url: build (never fetch) the browser URL that completes an oauth2 connection's owner consent (app_id+name); hand it to the signed-in owner to open, since an agent key cannot complete OAuth consent itself.
app_idYesThe app id.
scopesNocreate only (oauth2). Space-delimited scopes for the authorize request.
providerNocreate only. Freeform display label only, e.g. "hubspot"; not validated against any allowlist.
client_idNocreate only, required for kind=oauth2. Your OAuth2 app's client id.
auth_paramsNocreate only (oauth2). Extra key/values merged into the authorize redirect (e.g. to request offline access).
auth_schemeNocreate only (oauth2). The scheme the access token is sent under. Defaults to "Bearer"; set e.g. "Zoho-oauthtoken" for a non-Bearer provider.
header_nameNocreate only (static). The header the credential rides in. Defaults to "Authorization".
allowed_hostNocreate only, required for both kinds. The host-binding exfiltration defence: an exact DNS host ("api.hubapi.com") or a single leftmost wildcard ("*.zohoapis.com"). The stored credential is attached to a delivery only when its url host matches; a rule later repointed elsewhere fails delivery rather than sending the secret to the wrong host.
header_valueNocreate only, required for kind=static. The header value to send, e.g. "Bearer sk_live_...". Encrypted at rest and never returned by any call.
token_paramsNocreate only (oauth2). Extra key/values merged into the token POST.
authorize_urlNocreate only, required for kind=oauth2. The provider's OAuth2 authorize endpoint (https; rejected if it resolves to a private/loopback/metadata address).
client_secretNocreate only, required for kind=oauth2. Your OAuth2 app's client secret. Encrypted at rest and never returned by any call.
instance_fieldNocreate only (oauth2). The name of a token-response JSON field holding the API base URL (e.g. "instance_url"). When set, the relay re-binds allowed_host to that host after consent and resolves relative rule urls against it.
token_endpointNocreate only, required for kind=oauth2. The provider's OAuth2 token endpoint (same https + SSRF rules as authorize_url).
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond the annotations (destructiveHint, readOnlyHint), the description reveals critical behavioral traits: never returns secrets, create returns metadata only, delete is idempotent, consent_url builds rather than fetches, and new OAuth2 connections start in pending_auth until owner approval. This adds substantial contextual value not present in annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two dense paragraphs with a clear structure: first defines the resource, then elaborates actions and lifecycle. Every sentence contributes meaning (security, idempotency, consent flow), and the length is justified for an 18-parameter tool. It is front-loaded with the core concept.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Despite no output schema, the description explains return behavior for create/list (metadata, fingerprint, never secret), consent_url (returns URL), and the pending_auth lifecycle. It does not cover error cases or pagination, but for a complex tool with thorough schema descriptions, it is largely complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, and each parameter already has detailed descriptions. The tool description adds high-level context (e.g., allowed_host as exfiltration defense, kind-specific fields) but does not materially alter or augment the per-parameter semantics beyond what the schema provides. Baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description precisely defines the resource—'a v2 app's Connections: the stored credential... bound to a host'—and enumerates the actions (create, list, delete, consent_url) with operational specifics. It clearly distinguishes this from sibling tools by emphasizing host-binding and secret-exfiltration defense, which is unique to this tool.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives explicit usage guidance: 'There is no update action: change a connection by deleting and recreating it' and explains when consent_url is appropriate ('a human-in-a-browser step an agent key cannot complete'). It does not directly name alternative tools but provides clear contextual and exclusionary guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

count_rowsCount RowsA
Read-only
Inspect

The live row count of a v2 app's collection (spec B4, issue #1056), a whole-scope total with no filter and no paging. Gated by the collection's countRead opt-in, independent of its read list: a collection that opted in returns its count even to a caller who cannot list the rows (the '3 spots left' shape), and a collection that never opted in refuses with collection_count_forbidden even for a caller who could otherwise list. Returns { count }.

ParametersJSON Schema
NameRequiredDescriptionDefault
app_idYesThe app id.
collectionYesThe collection name declared in the app's manifest.
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations only declare readOnlyHint=true and openWorldHint=false. The description adds substantial behavioral context beyond these: the countRead opt-in gate, independence from the read list, the refusal error collection_count_forbidden, the '3 spots left' use case, and the exact return shape { count }. This is exactly the kind of behavioral disclosure that helps an agent anticipate outcomes. No contradiction with annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is three sentences long and front-loaded with the core purpose. Each additional clause adds behavioral detail. The spec reference 'spec B4, issue #1056' is potentially unnecessary for an AI agent and adds noise, but it does not harm usability. Overall, it is dense yet efficient.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema, the description explicitly explains the return value ({ count }) and the error condition (collection_count_forbidden). It covers scope (whole-scope, no filter/paging), permission nuances, and the difference from list read access. This is sufficient for an agent to know when and how to call the tool safely and correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has 100% description coverage for both parameters (app_id and collection). The tool description adds minimal parameter-specific meaning beyond the schema, such as 'v2 app's collection', but does not elaborate on accepted formats or edge cases. Baseline 3 is appropriate because the schema already carries the semantic load.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb and resource: 'live row count of a v2 app's collection'. It also explicitly scopes the operation as 'whole-scope total with no filter and no paging', which distinguishes it from row-listing operations like list_rows. The spec reference (B4, #1056) adds precision.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides clear context: it is a whole-scope total, has no filter or paging, and is gated by the countRead opt-in. This implies when to use it (for counts only) and when it might not work (if opt-in is absent). However, it does not explicitly name alternative tools or provide a direct 'when not to use' statement.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

credentialsManage App Service CredentialsA
Destructive
Inspect

A v2 app's scoped service credentials (#1354, #1355): the bearer token an app owner points a backend they host themselves at, so their own server can read and write the app's data without holding the owner's full authority. Effective permission is always the intersection of the allowlist and what the app's owner could do, so a credential can only ever narrow, never widen, and it carries no role. Actions: mint creates one and returns its raw token shown once, never recoverable afterward (only its hash is stored); list returns the app's credentials with their allowlist and status, never any token material; pause reversibly stops one; resume undoes a pause (never a revoke, which is permanent); rotate issues a fresh token while the old one keeps working for an overlap window, so a running backend picks up the new token with no outage; revoke kills one permanently. Every action here is owner-or-owning-agent only: a service credential itself can reach none of these, by construction, so it can never mint or widen a sibling of itself.

ParametersJSON Schema
NameRequiredDescriptionDefault
modeNomint only. Defaults to explicit: an unnamed collection is denied, so the credential can never reach anything it was not handed (the shape for a contractor's backend). following: an unnamed collection falls through to the owner's own authority, so the credential tracks the app as it grows and each `grants` entry only narrows one collection (the shape for the owner's own backend). Neither mode can ever exceed what the app's owner could do; the effective permission is always the intersection.
labelNomint only. Optional owner-facing label shown in the credential list.
actionYesmint: create a scoped service credential, the bearer token an app owner points a backend they host themselves at (app_id; optional mode/grants/members/label/ttl_seconds). list: the app's credentials, their allowlist and status, never a token (app_id). pause: reversibly stop one, in force on its very next request (app_id+credential_id). resume: undo a pause; never undoes a revoke, which is permanent (app_id+credential_id). rotate: issue a fresh token and keep the old one working for an overlap window so a running backend picks it up without a gap (app_id+credential_id; optional overlap_seconds). revoke: kill one permanently and idempotently (app_id+credential_id).
app_idYesThe app id.
grantsNomint only. The allowlist: one entry per collection naming which of read/create/update/delete this credential may attempt there (an entry may name zero ops, which under `following` is how one collection is carved out of an otherwise app-wide credential). A collection named here must be a real declared collection on the app; a typo is rejected with a 400 rather than silently doing nothing.
membersNomint only. Opt in to the app's member directory appearing in this credential's boot/hello payloads. Defaults to false: a credential that never learns a member id cannot stamp one into a relation field.
ttl_secondsNomint only. Omit for the server's bounded default (365 days, clamped to a server maximum). null means no expiry, the explicit opt-in a long-running backend asks for; it is never the default.
credential_idNopause / resume / rotate / revoke. The credential id (see list's `id` field).
overlap_secondsNorotate only. How long the superseded token keeps resolving, so a running backend can pick up the new one with no gap. Defaults to the server default (1 day); 0 kills the old token immediately, the "this leaked" case.
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations indicate destructiveHint=true and readOnlyHint=false, but the description goes far beyond these by disclosing that tokens are shown only once and only hashes are stored, that pause is reversible while revoke is permanent, that rotate overlaps the old token, and that effective permissions are always the intersection with owner authority. It also explicitly states service credentials cannot access these actions, fully aligning with annotations and adding essential behavioral context.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single dense paragraph that is information-rich with no fluff, but it could benefit from structured bullet points or short paragraphs for each action. Every sentence serves a purpose, though the lack of visual structure makes it slightly harder to scan quickly. It is appropriately sized for the tool's complexity.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity (6 actions, security nuances) and the absence of an output schema, the description thoroughly covers return behaviors (e.g., raw token shown once, list returns allowlist/status, rotate issues fresh token), side effects (pause/resume/revoke semantics), and access restrictions. It explains the security model of credential narrowing and the fact that credentials cannot self-manage, leaving no critical gaps for an agent to select and invoke the tool correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema already provides rich descriptions for all parameters (100% coverage), so the baseline is 3. The description adds meaningful semantic context beyond the schema, particularly for 'mode' and 'grants' by explaining how they affect the credential's reach and the intersection permission model. However, some parameters like ttl_seconds, overlap_seconds, and members are only described in the schema, not in the tool description, so it doesn't fully compensate but still adds value.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly identifies the tool as managing v2 app's scoped service credentials and enumerates all six actions (mint, list, pause, resume, rotate, revoke) with specific outcomes. It distinguishes this tool from potential siblings by emphasizing the scoped/bearer-token model and owner-only access, making the purpose unmistakable.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explains when to use each action (e.g., mint for creating a credential for a backend, rotate for issuing a fresh token with overlap, revoke for permanent removal) and clarifies the access restriction (owner-or-owning-agent only). It does not explicitly name alternative tools or state when not to use this tool, but the context strongly implies its intended use case.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

delete_rowDelete RowA
DestructiveIdempotent
Inspect

Soft-delete a row from a v2 app's collection. Recoverable: the row is tombstoned, not destroyed, and restore_row brings it back for 30 days (see list_deleted_rows). A watcher sees the deletion live as op:delete on the change feed. Pass if_match for an optimistic-locked delete. Returns { deleted: true }.

ParametersJSON Schema
NameRequiredDescriptionDefault
keyYesThe key of the row to delete.
app_idYesThe app id.
if_matchNoOptional optimistic-lock version.
collectionYesThe collection name.
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Goes far beyond the annotations by explaining the soft-delete tombstone behavior, 30-day recoverability, live change feed event (op:delete), and the exact return value. This is critical context since destructiveHint=true alone might imply permanent deletion, but the description clarifies it's recoverable.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three sentences, each carrying distinct value: the core action, recovery semantics, and conditional parameter use with return value. Front-loaded with 'Soft-delete' and free of fluff or redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description covers the essential aspects: what the tool does, how it behaves (soft vs hard delete), how to undo, how to observe via change feed, how to use optimistic locking, and what to expect as output. With no output schema, this is a complete picture for an agent.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the description doesn't need to explain basic parameters like app_id and collection. It adds value by explaining the purpose of if_match ('optimistic-locked delete') and the shape of the response, which are not fully captured in the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb+resource: 'Soft-delete a row from a v2 app's collection.' It clearly distinguishes itself from sibling tools like get_row, update_row, and restore_row by explicitly referencing restore_row and list_deleted_rows, making its unique role obvious.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides explicit guidance on when to use the tool and related alternatives: it notes the deletion is recoverable via restore_row and points to list_deleted_rows for viewing deleted rows. It also instructs when to use the optional if_match parameter for optimistic locking, offering clear context.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

deploy_appDeploy AppAInspect

Deploy a v2 app: an HTML document plus a capability manifest, hosted at its own URL.

A redeploy only needs the content that changed. Every content field is optional when app_id is given, and an omitted one keeps what is live: omit manifest for an HTML-only change, omit html for a manifest-only change, omit assets to keep the current files. This is the cheap path and the default, because an omitted field costs no output tokens at all: a one-line colour change does not resend the whole document, and a manifest edit does not resend it either. A field only needs sending when its content differs from what is live. assets: [] is the explicit way to clear the asset set, and omitting all three is refused, since there would be nothing to change.

The extension keys used most often: app metadata; collections, with per-collection write, update, read and delete role lists, where write gates creates and also gates updates unless an update list is declared; externalHosts, a fetch allowlist; cdn, to allow CDN scripts and styles; capabilities, for Permissions-Policy opt-ins; embeds, an iframe frame-src allowlist; notify, for email-on-row rules; webhooks, for signed HTTP POST on-row rules; and agentTasks, to queue work for an agent running on the owner's own machine, described as a prompt rather than as code. The manifest grammar is documented in the Homespun guide that get_skill returns.

Pass no app_id to create, which mints a slug and URL and requires both html and manifest, or pass app_id to redeploy an existing app. Supply the HTML inline as html, or as html_path, an absolute path read on the MCP-server host, which is the relay for a hosted connector or the CLI host for a locally-run one, and not the remote agent's machine; it avoids retransmitting a large HTML file on every deploy, only a locally-run connector can read it, and inline html wins if both are given. dry_run:true (alias check) validates only: it runs the full manifest and asset validation, the redeploy compat gate and the schedule-timezone advisory, then returns { ok, warnings, compat?, breaks? } without creating a version or mutating anything, and it resolves omitted fields the same way a real deploy would, so it reports on exactly the deploy that would run.

A redeploy is refused with manifest_incompatible_redeploy, unless force:true, when it would strand rows already written (dropping a collection, tightening a schema, flipping appendOnly), or when it would widen what the app's install screen discloses: a collection's read reaching further than the live manifest, a capability added, cdn turned on, or a host added to externalHosts, embeds or a webhook target. The break quotes the sentence a user would now be asked to approve. Taking access away never prompts: dropping a role, dropping a capability, host or webhook, turning cdn off, or adding update:["creator"] to a write:["anyone"] collection, all redeploy clean. A removed collection is detached rather than deleted.

Images, fonts, audio, video and data files ship with the app in the same call via assets[]. Each is validated and stored app-scoped and served at its path on the app's own origin, so the HTML references it by a stable same-origin path such as <img src=\"frames/000.jpg\">; media and font paths support HTTP Range for seeking. A redeploy's assets replace the previous version's set when sent, carry over when omitted, and are cleared by assets: [].

Returns { app_id, slug, url, version, visibility, created } on create, or { app_id, version, compat, breaks? } on redeploy.

ParametersJSON Schema
NameRequiredDescriptionDefault
htmlNoThe app's UI as a complete HTML document (single file, with CSS and JS inline), sent inline. Capped at 2 MB of UTF-8; over that the deploy is refused with 413 document_size_exceeded. A document near the cap is almost always carrying a file inlined as a data: URI; the same file in `assets[]` is served from the app's own origin, cached separately, and does not count toward this cap. The document comes from either this field or `html_path`. Inline is the only form a hosted or remote connector with no filesystem can use, and inline `html` wins if both are given. On a redeploy an omitted `html` keeps the live document, so a manifest-only change (adding a collection, widening externalHosts) costs nothing in HTML.
slugNoCreate only. Accepted with visibility private or public, including the private default; rejected with explicit visibility 'link', where the slug is always server-generated.
checkNoAlias for `dry_run`.
forceNoRedeploy only. Bypasses the compat gate, whether it fired on a stranded-rows narrowing or on a widening of what the install screen discloses (a removed collection is detached, never deleted).
app_idNoOmit to create a new app; pass an existing app's id to redeploy it (a new version, compat-gated unless force:true).
assetsNoOptional bundle of files shipped with the app in one deploy: images, fonts, audio/video, data. Each asset either carries its bytes inline as `content_base64` or references an already-uploaded attachment by `attachment_id`; the reference form suits real images and media, where the file is uploaded once via `attachments fetch` or presign and then bound here, with no base64 in the deploy body. Each asset is validated + stored app-scoped exactly like a normal attachment (byte-sniff, allowlist, size cap, quota, scan) and served at its `path` on the app's own origin, so the page references it by a stable same-origin path (`<img src="frames/000.jpg">`, `<video src="media/intro.mp4">`; media/font paths support HTTP Range). The whole deploy is rejected atomically if any asset fails validation. On a redeploy, sent assets replace the previous version's set, an omitted `assets` keeps the live set (no re-upload, no re-encoding), and `assets: []` is the explicit way to clear it. Bounded by the relay's per-deploy asset-count cap; total bytes by the per-app blob quota.
dry_runNoValidate only: run the full manifest + asset-shape validation, the compat gate (for a redeploy), and the schedule-timezone advisory, then return { ok, warnings, compat?, breaks? } without creating a version or mutating anything. An invalid manifest returns the same error a real deploy would; a redeploy the compat gate would refuse reports the break instead of applying it. `check` is an accepted alias.
manifestNoThe x-homespun-manifest capability document (a JSON object). Required to create; on a redeploy an omitted `manifest` keeps the live one, which fits most redeploys (the manifest was byte-identical to the previous version in 71% of real redeploys). The extension keys used most often: app metadata; collections (+ per-collection write/update/read/delete role lists, where write gates creates and also updates unless the optional update list is declared); externalHosts (fetch allowlist); cdn (allow CDN scripts/styles); capabilities (Permissions-Policy opt-ins); embeds (iframe frame-src allowlist); notify (email-on-row rules); webhooks (signed HTTP POST on-row rules); agentTasks (queue work for an agent on the owner's own machine, described as a prompt). The full grammar is documented in the Homespun guide that get_skill returns.
html_pathNoAbsolute path to the app's HTML document, read on the MCP-server host (the machine running this connector: the relay for a hosted connector, or the CLI host for a locally-run one), not on the remote agent's machine. An alternative to inline `html` that avoids retransmitting a large HTML file on every deploy. It resolves only when the file is local to the MCP server, so it serves a locally-run connector rather than a hosted or remote one, where the path does not exist and the call returns a clean error; inline `html` is the form that works there. If both `html` and `html_path` are given, inline `html` wins.
visibilityNoCreate only. Default 'private' (owner plus invited members, sign-in gated). 'link' shares with anyone holding the returned share_url, whose #k= fragment carries a secret key that can be reset (rotate it via the apps tool, action share_link_rotate) to cut off everyone with the old link; a 'link' app always gets a server-generated unguessable slug. 'private' and 'public' accept an owner-chosen `slug`.
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond annotations, it discloses the compat gate with force bypass, atomic asset validation, that dry_run returns a report without mutating anything, that html_path is read on the MCP-server host, and that removed collections are detached rather than deleted. This is substantial non-obvious behavior.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is long but well-organized into thematic paragraphs: core semantics, manifest keys, create/redeploy, compat gate, assets, and return values. While it could be condensed, most sentences contribute; the structure aids readability for a complex 10-parameter tool.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Despite no output schema, it documents return shapes for create and redeploy. It covers prerequisites (manifest grammar via get_skill), constraints (2 MB cap, html_path host-bound), edge cases (force, clearing assets), and validation behavior. The description is self-sufficient for correct invocation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% with descriptive parameter documentation, so baseline is 3. The description adds redeploy-specific semantics like 'Every content field is optional when app_id is given' and the meaning of 'assets: []' to clear the set, and clarifies precedence of inline html over html_path, adding value beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with 'Deploy a v2 app: an HTML document plus a capability manifest, hosted at its own URL,' which clearly states the action and resource. It also distinguishes between create and redeploy by app_id, separating it from sibling tools like apps (management) and attachments (upload).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It explicitly explains when to use create (no app_id) vs redeploy (with app_id), when to use html_path instead of inline html for locally-run connectors, and dry_run for validation without mutation. It also says 'omitting all three is refused' and points to get_skill for manifest grammar, providing alternatives and exclusions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

feedbackManage FeedbackAInspect

Reports a problem with homespun itself to the relay operator, and lists what this agent has already reported. A report is the operator's only visibility into a failure that happened inside an agent's session, so an unreported one is a failure nobody can fix.

The channel covers homespun's own behaviour: a 5xx, or an error code the guide does not describe; a disagreement between documented and observed behaviour; something the tool surface cannot express, such as a missing capability or a schema that contradicts itself; an app misbehaving in a way that traces back to the platform (the bridge, the runtime, serving, the data API) rather than to authored HTML; or a guide that was wrong, ambiguous or silent.

Outside its scope: the human's own task; bugs in an app the agent authored; presentation preferences, which belong in taste; the human's own configuration, such as a missing API key or the wrong account; and a 4xx caused by the agent's own arguments, except where the error message itself was misleading, which is a documentation problem best filed as a note.

Duplicates cost the operator triage rather than adding signal. Action list returns this agent's own submissions, newest first, so a failure already recorded needs no second row: one report covers one distinct failure, however many times it was retried.

The operator sees the row and not the session, so a bare "deploy failed" is not actionable. An actionable message carries the surface (mcp, cli, relay or app-runtime); where it happened (the tool or route); the skill version, from the <!-- homespun skill vX.Y.Z --> comment at the top of the guide; what was expected, in one line; what was observed, in one line carrying the exact error code and message; and the minimal steps or arguments that reproduce it.

type is bug for something broken, feature for something missing, note for a rough edge or a confusing doc. app_id scopes a report to one app. There is no reply channel, so a report is not a route to an answer. Actions: create files one report; list returns this agent's own submissions, newest first, paginated by before.

ParametersJSON Schema
NameRequiredDescriptionDefault
typeNoFeedback category (required for create).
limitNolist page size (default 50, max 100).
actionYesReports a problem with homespun itself to the relay operator. create: files one bug|feature|note with a message and an optional app_id. list: this agent's own submissions, newest first, which is what distinguishes a new failure from one already reported.
app_idNoOptional app this feedback relates to (create).
beforeNolist cursor from a prior page's next_before.
messageNoMessage body (required for create).
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With all annotations false, the description carries the full burden. It discloses that the operator sees the row, not the session, that there is no reply channel, that duplicates cost triage, and gives detailed requirements for an actionable message. This goes beyond the schema.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is long but information-dense, with no fluff. Each paragraph adds unique value: scope boundaries, duplicate policy, message composition, and parameter semantics. The main purpose is front-loaded in the first sentence.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Despite no output schema, the description covers return behavior (list newest first, paginated by `before`), all param semantics, and operational expectations (no reply channel, duplicate handling). It is comprehensive for a reporting tool with moderate complexity.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so baseline is 3, but the description enriches parameters: it defines each `type` enum ('bug for something broken, feature for something missing, note for a rough edge'), explains `app_id` scopes to one app, and `before` as pagination cursor. It also clarifies the `action` parameter's effects.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The first sentence explicitly states the tool 'Reports a problem with homespun itself to the relay operator, and lists what this agent has already reported,' naming the resource (homespun problems) and actions (create/list). This distinguishes it from sibling tools like `taste` or `deploy_app` by scope.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides explicit scope: it lists what is in scope (5xx, error codes, disagreements, platform issues) and out of scope (human's task, authored app bugs, presentation preferences – which it says belong in `taste`). It also instructs to use `list` to check duplicates before creating a report.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_feed_eventsGet App Feed EventsA
Read-only
Inspect

Poll a v2 app's change feed for what has happened: row creates, updates and deletes, from any writer, agent or human. It is the long-poll analogue of homespun apps watch, since MCP has no streaming. The loop is: call with no since first, process the returned entries, keep the cursor, then call again passing it as since to get only newer entries. Passing wait (around 25) holds the request open until an entry arrives or it times out, which is how the feed is waited on rather than busy-polled. A since older than the retention floor returns resync_required, and the collections are then re-listed with list_rows. Returns { entries, cursor, truncated }.

ParametersJSON Schema
NameRequiredDescriptionDefault
waitNoOptional long-poll: how long the relay holds the request open waiting for a new entry (0-30s). Use ~25 when waiting for activity, then call again with the same cursor.
limitNoMax entries per page (capped server-side by FEED_PAGE_MAX).
sinceNoOpaque numeric cursor from a previous call's cursor. Omit (or 0) to read from the beginning.
app_idYesThe app id.
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Discloses long-poll behavior, cursor mechanism, and resync condition. Describes return shape ({ entries, cursor, truncated }). Annotations indicate readOnlyHint=true, which aligns. No contradictions.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Description is a single paragraph well-structured: purpose, loop logic, optional parameters, error handling, return shape. No wasted words; every sentence adds value.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Despite no output schema, the description covers return shape, error condition, and complete usage pattern. Handles complexity of polling pattern and parameter interaction thoroughly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so baseline is 3. Description adds value by explaining parameter interaction in the polling loop (e.g., 'since' as cursor, 'wait' for long-poll) and the resync behavior, though it repeats some schema descriptions.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool polls a v2 app's change feed for row creates, updates, and deletes. It uses specific verbs and distinguishes from sibling tools like list_rows by focusing on the change feed.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides explicit instructions: call without 'since' first, process entries, keep cursor, then call with 'since'. Explains long-poll with 'wait' and when to fall back to list_rows on resync_required.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_rowGet RowA
Read-only
Inspect

Fetch a single row by its key from a v2 app collection, through a dedicated relay route rather than a client-side scan. Returns { row }, or an isError row_not_found.

ParametersJSON Schema
NameRequiredDescriptionDefault
keyYesThe key of the row to fetch.
app_idYesThe app id.
collectionYesThe collection name.
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already indicate readOnlyHint=true, so the description adds value by disclosing the route method (dedicated relay route vs. client-side scan) and the return format with error handling, providing context beyond the annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, front-loaded with action, no wasted words. Every sentence contributes meaningful information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple read-only tool with 3 required parameters and no output schema, the description fully covers functionality, route method, return format, and error case, making it complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% with parameter descriptions provided. The description does not add significant meaning beyond the schema, so baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the verb 'Fetch', the resource 'a single row by its key from a v2 app collection', and distinguishes the tool from siblings by mentioning the dedicated relay route and specific return format.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

While the purpose is clear, the description does not explicitly state when to use this tool versus alternatives like list_rows, update_row, or delete_row. It implies usage for direct key-based access but lacks explicit when-not or alternative guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_skillGet Skill GuideA
Read-only
Inspect

The relay's SKILL.md, a generated guide to the Homespun workflow covering events versus records, the schema grammars and the poll loop. Needs no API key. Useful when working out how the other tools fit together, or to refresh a cached copy. Pass version_only:true to return just the relay's skill version string, which is enough to tell whether a cached copy is current.

ParametersJSON Schema
NameRequiredDescriptionDefault
version_onlyNoIf true, return only the relay's current skill version string instead of the full SKILL.md markdown.
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true, and the description reinforces this by stating no API key needed. It discloses what the tool returns (full SKILL.md or version string) and the content of the guide, adding value beyond the annotations without contradiction.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three well-structured sentences: first describes the resource, second states prerequisites, third gives usage with the parameter. No fluff; every sentence serves a purpose.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple read-only tool with one optional parameter and no output schema, the description covers all needed context: what it returns, why you'd use it, how the parameter works, and that no authentication is needed.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% for the single boolean parameter, providing a baseline of 3. The description adds extra context: 'to tell whether a cached copy is current', which helps the agent understand the parameter's utility.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states it retrieves the relay's SKILL.md guide covering events vs records, schema grammars, and poll loop. This distinguishes it from all sibling tools which are other operations (agent, apps, etc.).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly says 'Needs no API key' and suggests using it when working out how tools fit together or to refresh a cached copy. It also explains the version_only parameter purpose, giving clear guidance on when to use which variant.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

grantsManage App Grant LinksA
Destructive
Inspect

A v2 app's grant links (M5). A grant link is a capability URL that confers a declared custom role (x-homespun-manifest.roles) on a stable per-holder anonymous identity, so a holder's own rows are isolated by author/:own scoping. A grant does not escalate to owner, member or agent. Actions: mint creates a link and returns a grant_url carrying the token in its #g= fragment, shown once and not recoverable afterwards; list returns the app's links and never a token; revoke is idempotent. mode 'once' is one-time, claimed by the first browser to open it; 'multi' is shared, capped by max_uses within expiry. An optional pin (pin_row_key or pin_where) narrows a holder to specific rows and never widens their access. One consequence worth knowing when minting: a write-only grant pinned to a single row key can still read that row's existing data back through create dedup, so such a grant exposes that row's current contents to the holder.

ParametersJSON Schema
NameRequiredDescriptionDefault
modeNomint only. once: one-time link, claimed by the first browser that opens it (a real per-person link; later opens by others are inert). multi (default): a shared link, capped by max_uses within expiry.
roleNomint only. A declared custom role for the app (an x-homespun-manifest.roles key). A built-in role (owner/member/agent/anyone) is rejected: a grant can never escalate.
labelNomint only. Optional owner label shown in the grant list.
actionYesmint: create a grant link carrying a declared custom role (app_id+role). list: the app's grant links (app_id). revoke: revoke one link (app_id+grant_id).
app_idYesThe app id.
grant_idNorevoke only. The grant link id (see list's `id` field).
max_usesNomint only (multi mode). Cap total claims; omit for unlimited within expiry. Ignored for once (forced to 1).
pin_whereNomint only. Optional narrowing pin as Wave C2 where conditions ({field, op, value}[]). Narrows within the role (never widens). Mutually exclusive with pin_row_key.
pin_row_keyNomint only. Optional narrowing pin to a single row key. Narrows within the role (never widens). Mutually exclusive with pin_where.
ttl_secondsNomint only. Grant lifetime in seconds; defaults to the server default (30 days) and is clamped to the server max.
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description discloses important behavioral traits beyond annotations: grant_url is shown once and unrecoverable, list never returns tokens, revoke is idempotent, and the subtle edge case where a write-only pinned grant can read existing row data. These details add significant value even though annotations already mark destructiveHint=true and idempotentHint=false.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a dense paragraph but each sentence carries unique information. It could be formatted with bullet points for easier scanning, but it is not padded or redundant—every clause contributes to understanding.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Even without an output schema, the description explains key return behavior (mint returns grant_url in #g= fragment, list returns links but never tokens). It covers all actions, modes, pins, and a security-relevant edge case, making it nearly complete for an agent to invoke correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Although schema coverage is 100%, the description adds extra meaning beyond the raw parameter descriptions: it clarifies mode behavior (once claimed by first browser, multi capped by max_uses), explains that pins narrow access, and highlights the write-only grant dedup consequence. This goes beyond what the schema alone communicates.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states what the tool does: manages app grant links, which are capability URLs conferring declared custom roles. It enumerates the three actions (mint, list, revoke) and explicitly notes that grants do not escalate to owner/member/agent, distinguishing it from any sibling tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides clear context for when to use each action (mint vs list vs revoke) and explains mode semantics (once vs multi) and pin limitations. It doesn't explicitly name alternative tools, but none of the siblings overlap, so the guidance is sufficient for an agent to decide.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

ingestManage App Inbound HooksA
Destructive
Inspect

A v2 app's inbound catch-hooks (inbound-webhooks). A catch-hook lets an external system such as Stripe, Zapier, Make, Home Assistant or an email router POST JSON to a secret URL that writes into a declared collection, so the app receives data with no agent online. Hooks are declared in the manifest (x-homespun-manifest.ingest) and materialized at deploy, so this tool has no create or delete: it reads back the URL, rotates a leaked one, and manages the opt-in signing secret. After deploying a manifest that declares a hook, list is what yields the exact URL to paste into the external system. Actions: list returns the app's hooks, each with its full secret URL, current rule collection, mode, wake and handshake settings, per-status delivery counts and signing-secret state; rotate mints a fresh URL secret for one hook by name and returns the new url once, after which the old url stops working immediately with no redeploy needed; set_signing_secret provisions or rotates a hook's signing secret, which is a different secret from the URL and is what a provider HMACs the body with, minting one returned once when secret is omitted or storing a provider value verbatim when it is passed, and never echoing it back; clear_signing_secret removes it. Signature verification currently ships dark: nothing verifies a signature yet.

ParametersJSON Schema
NameRequiredDescriptionDefault
nameNorotate / set_signing_secret / clear_signing_secret. The manifest ingest hook name (an x-homespun-manifest.ingest[].name). See list's `name` field.
actionYeslist: the app's inbound catch-hooks, each with its full secret URL, current rule (collection/mode/wake/handshake), and per-status delivery counts (app_id). rotate: mint a fresh URL secret for one hook and return its new URL once, invalidating the old URL immediately (app_id+name). set_signing_secret: provision or rotate a hook's opt-in signing secret, distinct from the URL secret (it is what a provider HMACs the body with); omit `secret` to mint one (returned once) or pass `secret` to store a provider-generated value verbatim (never echoed) (app_id+name). clear_signing_secret: remove a hook's signing secret (app_id+name).
app_idYesThe app id.
secretNoset_signing_secret only. A provider-generated signing secret to store verbatim (the Stripe path). Omit to have the relay mint one (the GitHub path), returned once in the response.
grace_secondsNoset_signing_secret only. On a rotation, how long the previous secret stays valid so deliveries verify while you update the provider (default 3600, max 86400).
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond the annotations (readOnlyHint=false, destructiveHint=true), the description extensively discloses behavioral traits: rotate invalidates the old URL immediately without redeploy, set_signing_secret returns a minted secret only once and never echoes stored secrets, clear_signing_secret removes the signing secret, and signature verification currently 'ships dark' (nothing verifies a signature). This provides substantial context that annotations alone do not cover, with no contradictions.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is longer than average but well-structured: it opens with a definition, then explains the manifest/deploy constraint, and then breaks down each action. Every sentence contributes meaningful context (e.g., external system examples, behavior on rotate, dark signature). Some redundancy with the schema's action descriptions exists, but it does not feel bloated for the tool's multi-action complexity.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity (5 parameters, 4 actions, no output schema), the description is remarkably complete. It explains what each action returns (URL once, secret once), the lifecycle (no create/delete, secrets not echoed), and the current limitation of signature verification. It covers edge behaviors (old URL stops immediately, grace_seconds for rotation) sufficiently for an agent to invoke it correctly without an output schema.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema already covers all parameters with high detail (100% coverage), so baseline is 3. However, the description adds clarifying context about the difference between URL secret and signing secret, and explains the 'secret' parameter's two paths (omit to mint vs pass to store verbatim), which enhances understanding beyond the schema. It doesn't introduce new parameter syntax but improves semantic comprehension.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description explicitly states the tool manages a v2 app's inbound catch-hooks, with a clear resource (inbound-webhooks) and specific actions (list, rotate, set_signing_secret, clear_signing_secret). It distinguishes from siblings by focusing on webhook URL management and signing secrets, and clarifies it has no create/delete. This is a specific verb+resource that is unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives explicit usage context: 'After deploying a manifest that declares a hook, list is what yields the exact URL to paste into the external system.' It also states when not to use the tool ('no create or delete') because hooks are declared in the manifest and materialized at deploy. This provides clear when/when-not guidance, and while no alternative sibling is named, the exclusion is sufficient for this unique tool.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

keyManage API KeyA
Destructive
Inspect

The calling agent's API key. Actions: list returns key info (agent_id, key_prefix, timestamps); mint creates a sibling API key for the caller's own agent identity with the same scope and ownership and returns its raw value once, which is how an MCP-driven agent hands a CLI or child process a working credential, and the raw value is not retrievable afterwards, the sibling appears in a later list made with it, and the owner can revoke it; revoke destroys the agent's own key, which stops working immediately and cannot be undone, so it requires confirm:true. The relay derives identity from the caller's token, so every action applies to the caller's own agent and mint cannot target another agent's id.

ParametersJSON Schema
NameRequiredDescriptionDefault
actionYesThe calling agent's API key. list: key info (agent_id, key_prefix, timestamps). mint: mints a sibling API key for the calling agent's own identity (same scope/ownership) and returns its raw value once, which is what hands a CLI or child process a working credential; the sibling is a distinct key that shows up in a subsequent `list` made with it, the owner can revoke it, and the raw value is never retrievable again. mint always acts on the calling agent, never another agent's id. revoke: self-destructs the agent's own key, which stops working immediately and is irreversible (requires confirm:true).
confirmNoRequired (true) for revoke.
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Despite annotations indicating destructiveHint, the description adds crucial behavioral details: revoke is irreversible and requires confirm:true, mint returns the raw value only once and it becomes non-retrievable, and the sibling key appears in later lists. It also clarifies that identity comes from the caller's token, preventing targeting others.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single long run-on paragraph containing many details. While all information is relevant, the lack of structured bullet points or clear separation between actions reduces readability and conciseness.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description covers all aspects needed for operation with no output schema: what list returns, what mint returns and its one-time-only caveat, revoke's requirements, identity derivation, and security constraints. It is fully self-contained for an agent to invoke actions correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema already has 100% coverage with descriptions for both 'action' and 'confirm' that mirror the tool description. The description does not add new semantic meaning beyond the schema, so the baseline of 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool manages the calling agent's API key with three specific actions: list, mint, and revoke. It distinguishes itself from sibling tools by focusing on API key lifecycle operations, using specific verbs and resources.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides explicit scenarios for each action: mint is for handing a CLI or child process a credential, revoke is for irreversible destruction requiring confirmation, and list is for key info. It also states what cannot be done ('mint cannot target another agent's id'), offering clear when-to-use and limitations.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_deleted_rowsList Deleted RowsA
Read-onlyIdempotent
Inspect

List a collection's recently deleted rows: the recovery bin. Deleting a row is a soft delete, so it can be restored with restore_row until recoverable_until passes (30 days after deletion by default). Owner or agent only, and deliberately independent of the collection's read permissions. Rows already purged appear with purged:true and cannot be restored. Returns { rows, next_before }.

ParametersJSON Schema
NameRequiredDescriptionDefault
limitNoMax rows to return (default 100).
app_idYesThe app id.
beforeNoCursor for the next page: pass back the previous page's next_before.
collectionYesThe collection name.
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond the annotations (readOnlyHint, idempotentHint, destructiveHint), the description discloses key behaviors: soft delete, recoverable_until (30 days default), purged rows with purged:true that cannot be restored, and independence from read permissions. This significantly enriches the agent's understanding of what to expect.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, well-structured paragraph that front-loads the primary purpose, then adds relevant details (recovery, permissions, purged status, return format). Every sentence adds value without unnecessary verbosity.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema, the description explains the return shape '{ rows, next_before }' and the purged flag. It covers access restrictions, recovery window, and a key behavioral nuance (purged rows cannot be restored). For a list operation with good annotations, this is complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the input schema fully documents app_id, collection, limit, and before. The description adds context about the 'next_before' cursor in the return value but doesn't need to explain parameters further. Baseline 3 is appropriate since the schema carries the parameter semantics.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose: 'List a collection's recently deleted rows: the recovery bin.' It identifies a specific verb (list), resource (deleted rows), and scope (a collection), and distinguishes it from sibling tools like list_rows and restore_row.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides useful usage context: 'Owner or agent only, and deliberately independent of the collection's read permissions.' It also explains the soft-delete behavior and the 30-day recovery window, which helps the agent know when this tool is appropriate. It doesn't explicitly name alternatives, but the context implies when to use it over list_rows.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_rowsList RowsA
Read-only
Inspect

List rows in a v2 app's mutable collection. This is also how a collection's current state is polled, since MCP has no streaming: pass the prior next_cursor as since to fetch only rows that are new or changed. Returns { rows, next_cursor, has_more }.

ParametersJSON Schema
NameRequiredDescriptionDefault
limitNoPage size.
sinceNoOpaque cursor from a previous call's next_cursor. Also the poll handle: pass it back to fetch only newer/changed rows.
app_idYesThe app id.
collectionYesThe collection name declared in the app's manifest.
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and openWorldHint=false, so the safety profile is covered. The description adds valuable behavioral context beyond these annotations: MCP has no streaming, the tool doubles as a poll mechanism, and the `since` cursor returns only new or changed rows. This meaningfully clarifies the tool's runtime behavior and pagination contract.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is three sentences long and every sentence earns its place: the core operation, the critical polling behavior, and the return shape. It is front-loaded with the primary purpose and contains no filler or redundant restatements of the title or annotations.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the moderate complexity of cursor-based pagination and polling, the description is complete: it states the return fields, explains how to use `since`, and notes the mutable-collection context. With readOnlyHint and a 100%-covered schema, no critical gaps remain for an agent to invoke the tool correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, providing baseline parameter descriptions for all four fields. The description goes beyond the schema by giving `since` rich semantic meaning (poll handle, prior next_cursor, 'only rows that are new or changed'), and by clarifying the response structure ({ rows, next_cursor, has_more }). This adds real value over the schema alone.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource: 'List rows in a v2 app's mutable collection', which clearly identifies the operation and scope. It also differentiates itself from sibling tools like get_row (single row) and list_deleted_rows by focusing on the mutable collection and adding a polling use case.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly explains when to use the tool for polling ('This is also how a collection's current state is polled') and how to leverage the `since` cursor for incremental fetches. It does not name alternatives or exclusions (e.g., when to use list_deleted_rows instead), but the context is clear enough for most selection scenarios.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

membersManage App MembersA
DestructiveIdempotent
Inspect

A v2 app's membership (auth spec section 6): who besides the owner can sign in to a private app and write to member-scoped collections. Actions: add invites or attaches a member by email, attaching immediately when the email already has a Human and otherwise sending a magic-link invite; list returns the app's owner and members; set_role changes an existing member's declared custom role in place, or clears it when null, and leaves their sessions intact, which is what makes it the way to re-role someone rather than removing and re-adding them; remove is idempotent and also revokes the human's live sessions on this app, and the app owner cannot be removed; roles returns the derived roles summary, giving the effective access a holder actually has per declared role and collection, reported separately for signed-in members and for grant-link holders because their role floors differ, along with member and active-grant-link counts.

ParametersJSON Schema
NameRequiredDescriptionDefault
roleNoadd only. Defaults to 'member' server-side — no other role is assignable via this API (ownership transfer is not available here).
emailNoadd only. The email to invite/attach. If a Human already exists for it, the member row is attached immediately; otherwise the relay emails a magic-link invite.
actionYesadd: invite-or-attach a member by email (app_id+email; optional custom_roles). list: the app's owner + members (app_id). set_role: replace an existing member's declared roles in place without signing them out (app_id+human_id+custom_roles, an empty list to clear). remove: drop a member (app_id+human_id). roles: the app's declared roles with what each one includes and, per collection, the effective access a holder has (separately for members and grant-link holders, whose role floors differ) plus how many members and live grant links hold each role (app_id).
app_idYesThe app id.
human_idNoremove and set_role. The Human id to target — see list's `humanId` field. The app owner can be neither removed nor re-roled.
custom_rolesNoadd (optional) and set_role (required). The declared roles (x-homespun-manifest.roles keys) attached to the member alongside their base member powers. A member may hold several and holds the union of what each grants, plus everything those roles `includes`. A built-in/reserved role or an undeclared role is rejected. Omit on add for an ordinary member; pass [] on set_role to clear the roles back to a plain member.
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond the annotations, the description discloses side effects such as remove being idempotent and revoking live sessions, set_role leaving sessions intact, add attaching immediately if a Human exists else sending a magic-link invite, and roles reporting separate effective access for members vs grant-link holders. This adds substantial behavioral context.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single dense paragraph, front-loaded with the purpose and then breaking down each action. Every clause carries unique information, but the length may challenge skimming; still, it is efficient with no filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 6-parameter, 5-action tool with no output schema, the description covers each action's behavior, side effects, limitations, and edge cases (owner immovable, session invalidation, role floors). It provides enough guidance to invoke any action correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema already provides detailed descriptions for all parameters with 100% coverage. The description partly restates these semantics (e.g., email attach vs invite) without adding much beyond the schema. There is a minor inconsistency: the description says set_role clears 'when null' while the schema requires an empty array, so no extra value is provided.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states this tool manages a v2 app's membership, enumerating each action (add, list, set_role, remove, roles) with specific verbs and resource scoping. It distinguishes itself from sibling tools like grants by focusing on app membership and access control.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly recommends set_role over removing and re-adding for re-roling, and notes that the app owner cannot be removed or re-roled, giving concrete usage guidance. It doesn't systematically list when not to use each action, but the key exclusions and alternatives are covered.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

publisherPublisher ProfileAInspect

The caller's community publisher identity: the @-handle and public profile shown in the template gallery. Actions: get returns the profile, including the handle, whether it has been claimed, tenure, and the rating and template counters; claim sets the handle from a lowercase 3-to-32-character string and may be used only once, after which the handle is permanent, and it refuses a handle that is reserved or already taken; update changes display_name, bio or url at any time. claim and update require a verified email. An existing publisher may hold a provisional maker-... handle assigned automatically, which claim renames on its one allowed use.

ParametersJSON Schema
NameRequiredDescriptionDefault
bioNoupdate only. Short public bio (up to 500 chars); null clears it.
urlNoupdate only. Public http(s) URL (up to 200 chars); null clears it.
actionYesget: returns the caller's publisher profile (handle, tenure, counters). claim: sets the caller's @-handle, once (handle arg; lowercase, 3 to 32 chars, permanent after claiming; needs a verified email). update: changes the caller's public display_name/bio/url (any of them; needs a verified email).
handleNoclaim only. The lowercase @-handle to claim (^[a-z0-9](?:[a-z0-9-]{1,30}[a-z0-9])$). Permanent once claimed.
display_nameNoupdate only. Public display name (up to 80 chars); null clears it.
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description reveals key behavioral traits beyond the annotations: one-time use for claim, permanence of the handle, refusal of reserved/taken handles, email verification requirement, the provisional `maker-...` handle renaming, and that update can happen 'at any time'. This greatly enriches the agent's understanding of side effects and restrictions.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

At roughly 120 words, the description is compact yet information-dense, front-loading the resource identity before detailing actions. The semicolon-separated structure is efficient, though it could be improved with bullet points for readability. Every sentence adds value.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description covers purpose, prerequisites, constraints, and get's return fields (handle, claimed status, tenure, counters). It does not specify the return values for claim or update actions, and there is no output schema, so that is a minor gap. Overall it is complete for a complex multi-action tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so a baseline of 3 applies, but the description adds meaningful action-level semantics: it explains what get/claim/update do, the handle format and permanence rule, and which fields update modifies. This goes beyond the schema's parameter descriptions, though it doesn't explicitly mention that null clears fields (already in schema).

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly defines the resource as 'the caller's community publisher identity: the @-handle and public profile shown in the template gallery' and enumerates three distinct actions (get, claim, update) with specific behaviors for each. This explicitly distinguishes it from sibling row-management tools by focusing on the publisher profile.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives clear context for when to use the tool (managing the caller's publisher identity) and discloses prerequisites ('claim and update require a verified email') and constraints ('may be used only once', 'handle is permanent'). It does not explicitly name alternative tools or state when not to use this one, but the unique resource scope makes usage obvious.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

restore_rowRestore RowAInspect

Restore a soft-deleted row, undoing delete_row. The row comes back with its original data and creator, its version bumped. Find restorable keys with list_deleted_rows. Owner or agent only. Fails with restore_expired if the row was purged, or restore_conflict if another live row took a unique value this one held while it was deleted. Returns { row }.

ParametersJSON Schema
NameRequiredDescriptionDefault
keyYesThe key of the deleted row to restore.
app_idYesThe app id.
collectionYesThe collection name.
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond the annotations (readOnlyHint=false, idempotentHint=false, destructiveHint=false), the description adds rich behavioral context: the row returns with original data and creator, version is bumped, only owner/agent can restore, specific error codes are listed (restore_expired, restore_conflict), and it explicitly states the return shape as { row }. No contradiction with annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is four sentences, front-loaded with the core purpose, and packs substantial detail (behavior, authorization, errors, return) without redundancy. Every sentence earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Despite having no output schema, the description fully explains what the tool does, how to find inputs, what the return looks like, under what conditions it fails, and who can call it. It is complete for a mutation tool with 3 parameters and no output schema.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema already covers all three parameters with 100% description coverage. The description adds practical semantics by tying the 'key' parameter to list_deleted_rows, which helps the agent select valid values. App_id and collection are straightforward and schema-described, so this is a modest but meaningful addition over the baseline.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool restores a soft-deleted row, explicitly connecting it to 'undoing delete_row'. It distinguishes itself from siblings like list_deleted_rows, delete_row, update_row, and upsert_row by specifying the exact action and resource.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It provides explicit guidance on when to use: 'Find restorable keys with list_deleted_rows' tells users how to locate valid inputs, and 'Owner or agent only' states an authorization prerequisite. It also covers when the tool will not work via failure conditions like restore_expired and restore_conflict.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

reviewCommunity ReviewsA
Destructive
Inspect

Ratings and reviews of community templates, responses from a template's own publisher, and, for relay operators, moderation. Actions: create leaves a 1-to-5 star rating and an optional written body on a template the caller has installed, identifying it by template ("/") or by handle plus slug, and requires a verified email; each install yields exactly one review, and the aggregate carries across template versions. A body containing a link or a contact email is held automatically for a moderator before it appears. respond replies to a review of the caller's own template line (review_id plus response, or null to clear it), with one editable response per review. report flags a review for the relay's moderators (review_id plus reason) and is deduped per account. remove and unhold are limited to the relay's configured community reviewers: remove takes a review down and adjusts the rating aggregate, and unhold publishes a previously held review into the aggregate.

ParametersJSON Schema
NameRequiredDescriptionDefault
bodyNocreate only. Optional written review (up to 2000 chars).
slugNocreate only. Per-publisher slug (with `handle`).
starsNocreate only. Star rating, an integer 1 to 5.
actionYescreate: leaves a star rating (1..5) and optional body on a community template the caller has installed (identified by `template` "<handle>/<slug>" or by `handle`+`slug`); requires a verified email, and one review per install. A body containing a link or contact email is auto-held for a moderator before it shows. respond: replies to a review of one of the caller's own templates (review_id + response; null clears it). report: flags a review for the relay's moderators (review_id + reason; one report per account). remove / unhold are relay-operator-only moderation actions on a review_id: remove takes a review down (adjusting the aggregate), unhold publishes a previously auto-held review.
handleNocreate only. Publisher handle (with `slug`), an alternative to `template`.
reasonNoreport only. Why you are reporting this review (up to 500 chars).
responseNorespond only. The publisher's public response (up to 2000 chars); null clears it.
templateNocreate only. The namespaced template id <handle>/<slug> to review.
review_idNoRequired for respond/report/remove/unhold. The review's id.
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description goes well beyond the annotations (readOnlyHint=false, destructiveHint=true). It discloses critical behavioral details: requires a verified email, exactly one review per install, aggregate carries across template versions, auto-hold for bodies containing links/contact emails, deduped reports per account, editable response with null to clear, and aggregate adjustments on remove. This fully compensates for the lack of detailed annotation semantics and provides high transparency.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single dense paragraph but well-structured by action, progressing from create to respond to report to remove/unhold. Each sentence explains a distinct action or constraint without excessive fluff. While long, it earns its length given the complexity of five sub-operations. Could be slightly improved with bullet points, but it remains readable and scannable.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity (5 actions, 9 parameters, no output schema), the description is remarkably complete. It covers permission levels (verified email, relay operators), state changes (one review per install, aggregate carrying across versions), moderation behavior (auto-hold, unhold), and edge cases (null clearing, deduplication). The only minor omission is exact return values, but the absence of an output schema makes that acceptable.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% with every parameter described, which meets the baseline of 3. The description adds value beyond the schema by explaining cross-parameter constraints (e.g., 'identifying it by `template` or by `handle` plus `slug`', 'null clears it', 'one report per account'). It clarifies the action-specific parameter usage, enhancing the agent's understanding of how parameters interact.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a clear scope statement: 'Ratings and reviews of community templates, responses from a template's own publisher, and, for relay operators, moderation.' It then enumerates five distinct actions with specific verbs (create, respond, report, remove, unhold) and their targets (templates, reviews, moderators). This distinguishes it from sibling tools like 'feedback' and 'taste' by focusing on the community review lifecycle.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides clear context for when to use each action: create is for installed templates with verified email, respond is for one's own template line, report is for flagging, remove/unhold are relay-operator-only. It implies exclusions (e.g., relay operators only for moderation) but does not explicitly name alternative tools or say 'when not to use.' The context is strong enough for an agent to select appropriate actions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

tasteManage UI Taste NotesA
Destructive
Inspect

The agent's UI taste notes: a short freeform markdown document of presentation preferences gathered from human feedback, such as 'denser layout' or 'no rounded corners'. Reading it before generating or revising an app is what carries earlier feedback into new output. Actions: get returns the current document; set replaces it in whole, so it does not append; clear discards it. Scoped to presentation preferences rather than general storage.

ParametersJSON Schema
NameRequiredDescriptionDefault
tasteNoThe full markdown notes (required for set; whole-document replace, not append).
actionYesThe agent's freeform UI taste notes (markdown) — presentation preferences learned from human feedback. get: read them before generating an app. set: whole-document replace (taste, non-empty). clear: delete them.
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description explicitly discloses behavioral traits beyond annotations: 'set replaces it in whole, so it does not append; clear discards it.' This aligns with the destructiveHint annotation (true) and provides necessary detail about the replace (non-append) behavior, ensuring the agent understands the tool's effects.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise at three sentences plus action definitions. It front-loads the purpose and scope, with no redundant information. Every sentence contributes meaning, making it easy for an agent to process efficiently.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's simplicity (2 parameters, no output schema), the description covers all necessary context: what taste notes are, when to read them, how each action works, and the scope. The annotations provide destructive hint, but the description adds the critical detail that set is a full replacement. Complete for correct invocation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so baseline is 3. The description adds value by clarifying that the 'set' action replaces the whole document and requires non-empty taste. This goes beyond the schema's description by emphasizing the 'whole-document replace' behavior, preventing misinterpretation as append.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states what the tool does: manages a freeform markdown document of UI taste notes. It specifies the actions (get, set, clear) and distinguishes it from general storage by scoping it to presentation preferences. This avoids confusion with sibling tools like update_row.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explains when to use the tool: 'Reading it before generating or revising an app is what carries earlier feedback into new output.' It also clarifies that it is for presentation preferences only, not general storage. While it doesn't explicitly list alternatives, the context is clear enough for correct usage.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

update_rowUpdate RowA
Idempotent
Inspect

Update an existing row in a v2 app's collection, replacing its data. Gated by the collection's update role list when it declares one, and by its write list otherwise, so a collection that scopes updates to the row's creator refuses an edit on someone else's row. Pass if_match with the row's current version for an optimistic-locked update; on a version mismatch the relay returns the current row, which is what a retry needs. Returns { row }.

ParametersJSON Schema
NameRequiredDescriptionDefault
keyYesThe key of the row to update.
dataYesThe new row body (replaces the row's data) - any JSON value valid against the collection's row schema.
app_idYesThe app id.
if_matchNoOptional optimistic-lock version. On mismatch the update is rejected with the current row in details.current.
collectionYesThe collection name.
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already indicate idempotentHint=true and destructiveHint=false. The description adds valuable context: authorization behavior, optimistic locking details, and the outcome on version mismatch ('returns the current row, which is what a retry needs'). No contradiction with annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three sentences, each serving a purpose: definition, authorization, locking. No filler words, front-loads the core action. Efficient and well-structured.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Covers core behavior, authorization, and optimistic locking details. The success response is mentioned minimally as '{ row }', but without an output schema, this is acceptable. Minor lack of detail on other error conditions besides version mismatch, but overall sufficient for a moderate-complexity tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so baseline is 3. The description goes beyond by explaining the if_match parameter's behavior ('on a version mismatch the relay returns the current row') and implicitly clarifying the collection parameter's role in authorization. Adds meaningful context.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Clearly states 'Update an existing row in a v2 app's collection, replacing its data.' The verb 'update' and resource 'row' are specific, and the scope is well-defined, distinguishing it from sibling tools like delete_row, get_row, and upsert_row.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides clear context on authorization gating ('Gated by the collection's update role list') and optimistic locking with if_match. However, it does not explicitly mention when to use this tool versus the sibling upsert_row, leaving a slight gap in usage guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

upsert_rowUpsert RowAInspect

Create a row in a v2 app's collection, or return the existing row when key is already present (deduped:true). Row creation goes through this tool; there is no separate strict-create verb. Omit key to add a new row with a server-generated key, or pass key to ensure a row exists at that key. Passing key is also what makes a retry safe: a call unsure whether it already landed can repeat it and get the same row back rather than a duplicate. Without key, a retry mints a second row with its own server-generated key, since there is nothing to dedup against. The collection must be declared in the app's manifest with 'agent' in its write list, which is the list that gates creates. When key matches a row the collection's read list does not reach for this caller, the result is row_not_found rather than the row, matching what get_row would return, so this never reads past read. Returns { row, deduped? }.

ParametersJSON Schema
NameRequiredDescriptionDefault
keyNoOptional stable key. Reusing an existing key returns the existing row (deduped:true), or row_not_found when the collection's read list does not reach that row for the caller.
dataYesThe row body - any JSON value valid against the collection's row schema (an object, or any JSON value for a schemaless collection).
app_idYesThe app id.
collectionYesThe collection name.
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description discloses far more than annotations: retry semantics with key dedup, duplicate creation without key, manifest write-list gating, read-list restrictions causing row_not_found, and the return shape. Since annotations only provide generic hints (readOnlyHint false, idempotentHint false), this description carries the full behavioral burden and does so excellently.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is long but every sentence contributes valuable information: core behavior, key semantics, retry behavior, permissions, access-control edge cases, and return shape. It is front-loaded with the main action and no sentence is filler. The structure is logical and appropriately sized for the tool's complexity.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Despite no output schema and sparse annotations, the description covers all essential context: the dedup behavior, key-based retry safety, prerequisites (manifest write list), access-control consequences, and return payload. It also mentions edge cases like row_not_found. This is complete for an upsert tool with subtle permission and idempotency considerations.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema already describes all four parameters with 100% coverage, so the baseline is 3. The description adds meaningful context beyond schema definitions, especially for `key`: it explains that omitting it creates a server-generated key and that retrying with an omitted key produces a duplicate. This extra guidance justifies a score above baseline.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a precise action: 'Create a row in a v2 app's collection, or return the existing row when `key` is already present (deduped:true).' It clearly identifies the resource (v2 app collection), the verb (create/upsert), and differentiates from siblings like get_row and update_row by noting there is no separate strict-create verb. This is a specific and unambiguous statement of purpose.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides strong guidance on when to use it: omit `key` for a new row with a server-generated key, or pass `key` to ensure existence and make retries safe. It also explains access-control preconditions (manifest write list) and read-list behavior. However, it does not explicitly contrast with sibling tools such as 'use get_row for reads' or 'use update_row for modifications,' so it falls just short of full alternative differentiation.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Discussions

No comments yet. Be the first to start the discussion!

Related MCP Servers

  • A
    license
    A
    quality
    A
    maintenance
    GTM signal intelligence suite for AI agents. Six tools: hiring signals, tech stack detection, company-to-LinkedIn resolution, ICP scoring, job board scanning, and a combined signals aggregator. Built for outbound sales workflows.
    11
    737
    1
    MIT
  • F
    license
    -
    quality
    C
    maintenance
    Browse IndustryLens's published competitive-intelligence reports and head-to-head competitor comparisons from any AI agent — real, source-backed data.

View all MCP Servers

Try in Browser

Your Connectors

Sign in to create a connector for this server.

Resources