Skip to main content
Glama

Hatch

by com.viberooster

Protect a site with a login

auth
DestructiveIdempotent

Put a sign-in screen in front of a forever roost so visitors must authenticate. Pass tenantId plus an action: • enable with mode: "password" and a password → ONE shared site password (everyone uses the same one). Best for a private demo or staging link. • setPassword with a new password → rotate the shared password. • disable → remove the login and serve the site publicly again. • status → report whether auth is on and which mode. Returns { enabled, mode, loginUrl }. Auth is only available on forever roosts — convert a free roost first. The sign-in screen lives at /__roost/login. Prefer password mode; useraccounts is unavailable (per-tenant databases are no longer provisioned).

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
modeNo`password` = one shared site password (recommended). `useraccounts` is unavailable. Required when `action` is `enable`.
actionNoWhat to do. Defaults to `status`.
passwordNoThe shared site password (password mode only). Required for `enable` (password mode) and `setPassword`.
tenantIdYesTenant id from the original hatch response.
sessionTokenNoOptional paired session token from poll_pairing (when Authorization headers are unavailable).

TDQS

A4.9/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Despite having annotations (readOnlyHint=false, destructiveHint=true), the description adds substantial behavioral context: disable 'remove[s] the login', setPassword 'rotate[s]' the password, and the return shape `{ enabled, mode, loginUrl }`. It also discloses the login screen location and prerequisite roost type, going beyond the raw annotation hints.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured with a lead-in summary, a bulleted action list, a return format line, and prerequisite caveats. Every sentence serves a purpose: it explains the core function, each action, the response, and the forever-roost requirement without redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool has no output schema, yet the description provides the return shape. It covers all major usage aspects: prerequisites (forever roost), actions, mode caveats, login URL, and disable behavior. The only omitted detail is sessionToken's optional use, but that is in the schema and not critical for general understanding.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so baseline is 3. The description adds semantic value by explaining each action's effect in business terms (e.g., 'ONE shared site password', 'rotate the shared password') and notes that `useraccounts` is unavailable, which is not in the schema descriptions. This elevates it above baseline but not to a 5 because sessionToken is not re-explained and the schema already documents required fields.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description explicitly states 'Put a sign-in screen in front of a `forever` roost so visitors must authenticate,' which is a specific verb and resource. It also enumerates distinct actions (enable, setPassword, disable, status), making it clearly distinguishable from sibling tools like deploy or share.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It provides clear when-to-use context ('Best for a private demo or staging link') and when-not-to-use constraints ('only available on `forever` roosts — `convert` a free roost first'; 'useraccounts is unavailable'). It also directs users away from unavailable modes, fulfilling the when/alternatives criterion.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

All Hatch toolsInspect
Try in Browser
RayrunBuild, deploy, and operate MCP servers without becoming an infrastructure team.ray.runAd

Glama MCP Gateway

Add one secure layer between your agents and this server.

TDQS

A3.8/5.0
Disambiguation3/5

Core actions like hatch, convert, upload, and lookup are generally distinct, but the polling family (poll_approval, poll_decision, poll_pairing) is easy to confuse, and await_decision misleadingly sounds like a wait operation rather than the creation of a review. Descriptions clarify boundaries, but the names alone leave room for misselection.

Naming Consistency3/5

Most tools use an imperative verb style, but the pattern is inconsistent: some are bare verbs (hatch, convert, deploy, list, lookup, share, upload), some are verb_noun (poll_decision, refresh_session, get_pairing_code), and auth is a bare noun. The names are readable but do not follow one predictable convention.

Tool Count3/5

16 tools sits at the heavy end of the comfortable range, inflated by three polling tools plus pairing/session management that are only tangentially related to the core task of creating and updating roosts. Each tool has a purpose, but the surface feels larger than the core domain requires.

Completeness3/5

The set covers create, read/list, update via convert/upload/deploy, sharing, and auth, but there is no delete/destroy or teardown tool, and custom domain/state management is only passively visible through lookup. Agents can complete common workflows but will hit dead ends on teardown or lifecycle management.

Resources