Skip to main content
Glama

Set Managed Account Rights

ontouser_team_set_scope_rights
DestructiveIdempotent

Die Rechte eines verwalteten Kontos in EINEM Scope setzen — nicht nur hochstufen, sondern auch entziehen. can_read, can_write, can_manage_scope je 0/1; sind alle drei 0, wird die Mitgliedschaft entfernt. can_manage_scope auf dem fuehrenden Scope selbst wird mit 403 abgelehnt (kein Hochklettern in der Kette) — dafuer gibt es Einladungscodes mit kind=management. Wird can_write entzogen, faellt default_write_scope mit weg. | EN: grant, revoke, rights, membership

Input Schema

NameRequiredDescriptionDefault
can_readYes1 = Lesen erlauben, 0 = entziehen
scope_idYesScope, in dem die Rechte gelten (Pflicht)
can_writeYes1 = Schreiben erlauben, 0 = entziehen
profile_idYesProfil-ID des verwalteten Kontos (aus ontouser_team_index)
can_manage_scopeYes1 = Verwalten erlauben, 0 = entziehen. Auf dem verwaltenden Scope selbst nicht vergebbar (403).

Schema Changelog

Changes observed during successful MCP inspections.

  1. Changed6 schema fields changed
    • addedInput schema / properties / can_manage_scope
      Added value: +{
      +  "description": "1 = Verwalten erlauben, 0 = entziehen. Auf dem verwaltenden Scope selbst nicht vergebbar (403).",
      +  "type": "integer"
      +}
    • addedInput schema / properties / can_read
      Added value: +{
      +  "description": "1 = Lesen erlauben, 0 = entziehen",
      +  "type": "integer"
      +}
    • addedInput schema / properties / can_write
      Added value: +{
      +  "description": "1 = Schreiben erlauben, 0 = entziehen",
      +  "type": "integer"
      +}
    • addedInput schema / properties / profile_id
      Added value: +{
      +  "description": "Profil-ID des verwalteten Kontos (aus ontouser_team_index)",
      +  "type": "integer"
      +}
    • addedInput schema / properties / scope_id
      Added value: +{
      +  "description": "Scope, in dem die Rechte gelten (Pflicht)",
      +  "type": "integer"
      +}
    • changedInput schema / required
      Previous value: -[]New value: +[
      +  "profile_id",
      +  "scope_id",
      +  "can_read",
      +  "can_write",
      +  "can_manage_scope"
      +]
  2. Added

TDQS

A4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare destructiveHint=true, idempotentHint=true, and readOnlyHint=false, so the safety profile is covered; the description adds value beyond that by disclosing the destructive side effect (all-zero removes membership) and the cascade that revoking can_write also drops default_write_scope. It does not cover authorization requirements or what the response looks like.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

One dense paragraph with the core action and the destructive edge case front-loaded, followed by the constraint and cascade rule. The trailing '| EN: grant, revoke, rights, membership' keyword line is filler rather than information, a minor blemish on an otherwise efficient block.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 5-parameter, fully-required mutation tool with annotations but no output schema, the description covers purpose, the removal semantics, the 403 edge case, and the cascade effect. It stops short of auth/prerequisite context and any indication of the response, but nothing essential to invoking it correctly is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline is 3; the description goes beyond the per-parameter 0/1 documentation by giving the cross-parameter rule that all three at 0 deletes the membership and that can_write=0 cascades to default_write_scope. That relational meaning is not expressible in the schema and is the main reason to read the description.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource: setting the rights of a managed account within ONE scope, explicitly covering both granting and revoking. It also discloses the terminal case (all three flags 0 removes the membership), which makes the operation's identity concrete. It does not explicitly name the closest sibling (ontouser_team_set_write_scope) to disambiguate, though it references ontouser_team_index as the source of profile_id.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Makes clear the tool is for both escalation and revocation, and states a hard precondition: can_manage_scope cannot be granted on the leading scope itself (403), directing the agent to invite codes with kind=management instead. That is a genuine alternative-route hint, though there is no explicit 'use tool X instead when...' framing against the sibling rights tools.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Try in Browser

Glama MCP Gateway

Add one secure layer between your agents and this server.