Skip to main content
Glama

Server Details

Deploy a multi-user web app from your agent: hosting, auth, database, and permissions.

Status
Healthy
Last Tested
Transport
Streamable HTTP
URL
Repository
homespunapps/homespun
GitHub Stars
1
Server Listing
Homespun

Glama MCP Gateway

Connect through Glama MCP Gateway for full control over tool access and complete visibility into every call.

MCP client
Glama
MCP server

Full call logging

Every tool call is logged with complete inputs and outputs, so you can debug issues and audit what your agents are doing.

Tool access control

Enable or disable individual tools per connector, so you decide what your agents can and cannot do.

Managed credentials

Glama handles OAuth flows, token storage, and automatic rotation, so credentials never expire on your clients.

Usage analytics

See which tools your agents call, how often, and when, so you can understand usage patterns and catch anomalies.

100% free. Your data is private.
Tool DescriptionsA

Average 4.6/5 across 24 of 24 tools scored. Lowest: 4/5.

Server CoherenceB
Disambiguation4/5

Most tools are clearly distinct, with row operations (list, get, upsert, update, delete, restore) well separated. Some boundaries like apps vs deploy_app and credentials vs grants require careful reading, but descriptions resolve the overlap.

Naming Consistency2/5

Tool names mix resource nouns (apps, attachments, connections) with verb_noun actions (delete_row, deploy_app). Singular and plural forms are inconsistent, and there is no uniform pattern across the set.

Tool Count3/5

24 tools is on the heavy side, but the platform's breadth (app deployment, data, auth, community) justifies the count. Each tool has a distinct role, though the set slightly exceeds the typical well-scoped range.

Completeness4/5

The surface covers the full app lifecycle: deploy, manage, delete, row CRUD with restore, attachments, credentials, and community features. Minor gaps like no dedicated row search or outbound webhook management are workable via existing tools.

Available Tools

25 tools
agentManage Agent IdentityAInspect

Agent identity and binding. Actions: whoami returns the resolved relay URL, the active profile and whether a key is configured, with no network call and no secrets; claim binds this agent to a human using a one-shot claim code from their Settings UI, and is one-way; logout clears the locally saved key and profile but does not revoke it on the relay, which is what the key tool's revoke action does.

ParametersJSON Schema
NameRequiredDescriptionDefault
codeNoThe one-shot claim code (required for claim).
actionYesAgent identity. whoami: show the resolved relay URL, active profile, and whether a key is configured (no network, no secrets). claim: bind this agent to a human via a one-shot claim code the human generated in their Settings UI (one-way). logout: clears the locally-saved key/profile; the key is not revoked on the relay, which is what the key tool's revoke action does.
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond the annotations (readOnlyHint=false, etc.), the description discloses behavioral traits such as whoami performing no network call and revealing no secrets, claim being one-way, and logout not revoking the key on the relay. It also clarifies the relationship with the key tool's revoke action. No contradictions with annotations. Slightly missing details on error handling or auth requirements, but the added context is valuable.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences, front-loaded with the core purpose, and then lists actions efficiently. Every sentence earns its place, no redundancy or fluff. The structure is easy to scan and understand.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with two parameters (one enum, one conditional) and no output schema, the description is quite complete. It explains what whoami returns, the one-way nature of claim, and the non-revoking behavior of logout. The only minor gap is lack of detail on what claim/logout return, but that's not critical for a simple identity management tool. Overall, it provides enough context to use correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, and the enum descriptions in the schema already explain each action's behavior, including the key tool distinction. The description repeats much of this information without adding significant new parameter-level semantics. It does add the 'Settings UI' origin for the claim code, but this is minor. Baseline 3 is appropriate when schema carries the load.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose as 'Agent identity and binding' and enumerates the three specific actions (whoami, claim, logout). It distinguishes from the sibling 'key' tool by explicitly referencing its revoke action. The verbs and resources are specific and unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides context for when each action is appropriate: whoami is a no-network status check, claim binds via one-time code, logout clears local state. It explicitly notes the alternative 'key' tool for revocation, guiding when not to use logout. However, it does not explicitly state 'use this tool when...' but the action breakdown is sufficient.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

appsManage AppsA
Destructive
Inspect

The v2 app lifecycle apart from creation and redeploy, which deploy_app covers. Actions: list returns the owning human's apps; show returns full detail including manifest, timezone and has_share_token; audit is a read-only security review of every app the caller owns, computed from each app's stored manifest, which is what makes it see apps that were deployed once and never redeployed (a deploy-time warning never reaches those). It reports collections whose declared permissions expose them, worst first: severity 'high' means an anonymous visitor can exploit it today, typically a collection that admits "anyone" to write with no separate 'update' list, so any visitor can overwrite rows other people created rather than only adding their own. It changes nothing; the fix is a redeploy declaring the missing list, and the right list differs per app, so read the app before proposing one. update changes visibility and timezone, the slug being immutable, and switching to 'link' returns a share_url once; share_link_rotate issues a new share token for a 'link' app, returning a new share_url and revoking the old link, and generates one if the app has none; delete is an idempotent soft-delete; wake wakes a dormant app and is otherwise a no-op that reports the actual status; domain_set binds a custom domain and returns the DNS records the domain owner must publish, where the first domain bound serves the app and every later one redirects to it, which is how apex plus www is configured; domain_status returns the serving domain and its aliases, live-refreshed against Cloudflare when that is enabled, with last_error carrying the reason a domain is not activating; domain_remove unbinds one domain, or all of them when no domain is given, and is idempotent.

ParametersJSON Schema
NameRequiredDescriptionDefault
slugNolist only. Exact-match slug filter.
limitNolist only. Page size.
actionYeslist: the caller's owning human's apps. show/update/delete/wake: act on one app (app_id). audit: read-only security review of every app the caller owns. share_link_rotate: rotate a 'link' app's share token, returning a new share_url (the old link stops working); also generates one if the app has none yet. domain_set/domain_status/domain_remove: manage the app's custom domains (app_id; domain_set also needs domain).
app_idNoRequired for show/update/share_link_rotate/delete/wake/domain_set/domain_status/domain_remove.
cursorNolist only. Opaque cursor from a previous next_cursor.
domainNodomain_set: the bare custom domain to bind (e.g. app.example.com); the response's dns_records lists the DNS entries the domain owner must publish. domain_remove: optional, the one domain to unbind - omit it to unbind them all.
statusNolist only. Default: active.
severityNoaudit only. Return findings of this severity only. The response's `counts` always describe the whole audit, so filtering never hides that other findings exist.
timezoneNoupdate only. The app's IANA timezone for `schedules` reminders (e.g. Europe/Berlin). An app that declares schedules with no timezone fires reminders at 08:00 UTC.
visibilityNoupdate only. The new visibility (slug is immutable).
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description discloses extensive behavioral traits: share_link_rotate revokes the old link, delete is an idempotent soft-delete, wake is a no-op that reports actual status, and domain_set explains first-domain-redirect behavior. These details go far beyond the annotations' simple destructiveHint, giving the agent a realistic model of side effects.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is dense with no fluff and front-loaded with the deploy_app exclusion, but it is a single long run-on paragraph separated by semicolons rather than structured bullets. The length is justified by the tool's 10 actions, though readability would improve with line breaks.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a complex 10-action tool with no output schema, the description covers return values for most actions (DNS records, share_url, serving domain/aliases) and edge cases (idempotency, no-op, redirects). However, it does not specify what update/delete/wake return, leaving a minor gap in completeness.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Even though the schema covers all parameters, the description adds rich semantic context—e.g., 'the right list differs per app' for audit, 'switching to link returns a share_url once', and 'when no domain is given' for domain_remove. This clarifies parameter interactions and domain-specific behavior beyond the schema's field-level descriptions.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens by framing the tool as 'The v2 app lifecycle apart from creation and redeploy, which deploy_app covers,' clearly distinguishing it from the sibling deploy_app. It then enumerates each action (list, show, audit, update, etc.) with specific verbs and outcomes, making the tool's scope unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The first sentence explicitly excludes creation/redeploy and points to deploy_app as the alternative, providing clear when-not-to-use guidance. Each action's purpose is described (e.g., audit as a read-only security review, domain_set for binding custom domains), giving context for when each sub-operation is appropriate.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

attachmentsManage AttachmentsA
Destructive
Inspect

Binary attachments (images, PDFs, audio, video) referenced from event payloads and input_data via format: homespun-attachment-id. Actions: upload, fetch, presign, finalize, download, show, list, delete, mint_token, revoke_token, list_tokens.

Choosing an upload path matters for cost. An inline upload with content_base64 carries the bytes in the tool-call arguments, so they enter the model context at a token cost proportional to file size, paid again on every retry; a few-hundred-KB image is already expensive. Two paths avoid that entirely: fetch, when the bytes are reachable at a URL, and presign plus finalize, when the client can PUT the raw bytes out of band. Inline upload suits small assets and clients that have neither a URL nor an out-of-band PUT.

fetch takes { source_url (https), scope } and the relay downloads the URL itself behind an SSRF guard (https only, no private, loopback or metadata hosts, DNS pinned, redirects refused, size-capped and timed out), then runs the same byte-sniff, allowlist, size, quota and scan checks as any upload. It works on any storage backend. upload takes either content_base64 (base64 bytes, no filesystem) or file_path (an absolute path read on the relay host, so it only applies when the file is local to the relay). presign plus finalize is token-free: presign with { mime, size, sha256, scope } returns { put_url, attachment_id }, the caller PUTs the raw bytes to put_url over plain HTTP out of band, then finalize with the attachment_id. At finalize the relay re-reads the stored bytes, sniffs the real type, and enforces the same allowlist, size, sha256, quota and scan checks, so a presign that misstates its mime is caught and never served inline. The presigned path requires the Azure storage backend; a filesystem-backed relay returns a clear not-supported error and fetch or inline upload apply there instead. download writes to an absolute out_path or returns base64. An upload is scoped to agent (the default, reusable) or app. mint_token returns a /b/ capability URL, shown once, that a browser can GET without the caller's API key.

ParametersJSON Schema
NameRequiredDescriptionDefault
mimeNoupload/presign: advisory Content-Type. The relay byte-sniffs the actual bytes and stores/serves that sniffed type regardless (a lying mime is caught, never served inline). Required for presign (scopes the upload URL + fails fast against the allowlist).
onceNomint_token: token self-deletes on first GET.
sizeNopresign: the exact byte length you will PUT. Committed at presign and re-verified against the uploaded bytes at finalize.
limitNolist page size (1..100).
scopeNoupload scope (default agent).
actionYesBinary attachment operations. The upload path affects token cost: `fetch` and presign plus finalize keep the bytes out of the model context entirely, while upload with `content_base64` carries them in the tool-call arguments at a cost proportional to file size, paid again on every retry. fetch takes { source_url, scope } and the relay downloads the bytes itself (https only, SSRF-guarded), running the same sniff, allowlist, size, quota and scan checks as any upload. upload takes `content_base64` (base64 bytes, no filesystem) or `file_path` (absolute, read on the relay host), scoped agent or app. presign plus finalize is three steps: presign with { mime, size, sha256, scope }, PUT the bytes to put_url out of band, then finalize, which re-sniffs and re-checks them. download fetches bytes by attachment_id to an absolute out_path or returns base64. show returns metadata only. list returns the agent's attachments. delete is a soft-delete. mint_token mints a /b/<token> capability URL, returned once. revoke_token and list_tokens manage those tokens.
app_idNoRequired when scope=app.
cursorNolist pagination cursor.
sha256Nopresign: the hex SHA-256 (64 chars) of the exact bytes you will PUT. Committed at presign and re-verified against the uploaded bytes at finalize.
filenameNoupload: display filename (defaults to the file's basename).
out_pathNodownload: absolute path to write the bytes to. If omitted, the bytes are returned base64-encoded in the result.
token_idNorevoke_token: the token id to revoke.
file_pathNoupload: absolute path to a file read on the server host running this MCP connector (the relay), not the calling agent's machine. It resolves only when the file is local to the relay (e.g. a locally-run CLI); a hosted or remote agent supplies the bytes as `content_base64` instead.
source_urlNofetch: an https URL the relay downloads server-side, so the bytes do not enter the model context and cost no tokens. SSRF-guarded: https only, no private, loopback, link-local or metadata hosts, DNS pinned, redirects refused, size-capped and timed out. The downloaded bytes run the same byte-sniff, allowlist, size, quota and scan checks as any upload. This and presign plus finalize are the zero-context paths for real images and media.
ttl_secondsNomint_token: per-token TTL (clamped by scope default).
attachment_idNoAttachment id. Required for download/show/delete/mint_token/revoke_token/list_tokens.
content_base64Noupload: the file bytes as base64, sent inline with no filesystem access. The base64 rides in the tool-call arguments and enters the model context, costing tokens proportional to file size; a few-hundred-KB image is already expensive, and the cost repeats on every retry. presign plus finalize avoids that for any real image or media whenever the client can do an out-of-band HTTP PUT, which leaves `content_base64` suited to small assets such as a tiny icon, and to clients that cannot PUT out of band. If both `content_base64` and `file_path` are given, `content_base64` wins. The relay sniffs the real type and enforces the same size, allowlist and quota checks as a file upload.
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Adds substantial behavioral detail beyond annotations: SSRF guard specifics, byte-sniffing/re-check on finalize, soft-delete semantics, token shown once, cost implications of inline uploads. No contradiction with destructiveHint/readOnlyHint.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Well-organized and front-loaded, but lengthy with some repetition (e.g., 'same byte-sniff, allowlist, size, quota and scan checks' appears multiple times). For a 17-param/11-action tool, the length is mostly justified; a tighter edit could remove redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Covers all actions, cost model, SSRF constraints, backend requirements, token behavior, scoping, and upload path trade-offs. With no output schema, it still gives enough for correct invocation; missing auth details are not critical given annotations.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% with detailed parameter descriptions, so baseline is 3. The main description adds orchestration-level meaning (presign/finalize flow, which params are required together, content_base64 cost), but relies heavily on the schema for individual parameter details.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with 'Binary attachments...' and enumerates 11 actions, clearly identifying the resource and verbs (upload, fetch, presign, finalize, download, etc.). It distinguishes from sibling row/table tools by focusing on the attachment lifecycle.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly contrasts upload paths with cost trade-offs: inline for small assets, fetch for URL-reachable bytes, presign+finalize for out-of-band PUTs, and notes Azure backend requirement. This is precise when-to-use guidance beyond a simple action list.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

communityCommunity TemplatesA
Destructive
Inspect

Publishing an app as a community template, taking your own listing back down, installing a template, and, for relay operators, reviewing submissions. Actions: publish, unpublish, get_config_contract, install, list_pending, get_submission, approve, reject, set_trust_level.

publish captures a live app (html, manifest, the seed rows of its seedOnInstall collections, and listing metadata) into a pending template. It is installable by the returned direct link but is not listed in the public gallery until an operator approves it, and it requires a verified email and no more than a few pending submissions at once. Privacy consequence: an approved template's content and its captured seed rows become public to every platform user, so seed data in a published app must be example-only rather than real personal data. attest_example_only:true records that this was checked. A template may take a per-publisher slug (namespaced as /) and a semver version defaulting to 1.0.0, and a republish under the same slug must bump the version.

unpublish is the publisher's own undo for a live listing, taken down by snapshot_id: it leaves the public gallery, search, and the direct snapshot install link. It works only on your own submissions, and a snapshot that does not exist or belongs to someone else reads as not found either way. Existing installs are unaffected, because an install is a fresh private copy rather than a live reference, so unpublishing never breaks an app someone already installed. It is idempotent, and publishing a new version is the way to put the listing back.

get_config_contract reads what a template needs at install, meaning its settings collection and its ordered config and upload steps, by ref. install creates a fresh private copy of a template for the caller's owning human, passing answers as config, where a 'config' value is a string and an 'upload' value is a pre-uploaded attachment id from the attachments tool.

The review actions are limited to the relay's configured community reviewers: list_pending returns the queue; get_submission returns a submission's full content by snapshot_id; approve lists it in the gallery, where a re-publish supersedes the app's prior approved version; reject takes a required note that lands in the publisher's app feed.

ParametersJSON Schema
NameRequiredDescriptionDefault
refNoget_config_contract/install only. The template to read or install: a namespaced '<handle>/<slug>' or a community snapshot id.
noteNoreject only. The required rejection note shown to the publisher (delivered to their app feed).
slugNopublish only. Optional per-publisher slug (lowercase, 3 to 48 chars, hyphens). Gives the template a namespaced id <handle>/<slug>; a republish reuses the slug and must bump the version. If omitted, a slug is derived from the title instead of leaving the template unnamed, so this field matters only when a specific url is wanted. Slugs are immutable: renaming the template later does not move its url, so the slug chosen here is permanent.
tagsNopublish only. Up to 6 curation tags.
limitNolist_pending only. Page size (1..200).
titleNopublish only. Listing title (1 to 80 chars). Defaults to the app's manifest name.
actionYespublish: publishes one of the caller's apps as a community template (app_id; optional title/description/category/tags). Privacy consequence: publishing makes the template content and the captured seed rows (the live rows of every seedOnInstall collection, captured at publish time) public to every platform user once approved, so an app whose seedOnInstall collections hold real personal data (names, emails, addresses, messages, anything private) is not safe to publish: seed data must be example-only. attest_example_only:true records that this was checked. The capture (html + manifest + seed rows) lands pending review, installable by its returned direct link but not listed until approved; an established publisher is fast-tracked, and the response's expedited/auto_approved fields report which path it took. unpublish: takes one of the caller's own published templates back down (snapshot_id). It removes the listing from the public gallery, from search, and from the direct snapshot install link. Existing installs keep working untouched, because an install is a fresh private copy rather than a live reference. It is idempotent (unpublishing an already-unpublished template is a no-op), and a snapshot that does not exist or belongs to someone else reads as not found either way. Publishing a new version is what puts the listing back. get_config_contract: read a template's install-time config contract by `ref` (a namespaced '<handle>/<slug>' or a snapshot id): its settings_collection, ordered config_steps (each with key/kind/required/secret/choices/default), and connect_steps (inbound hooks the app receives on). An 'upload' step wants a file, pre-uploaded with the attachments tool (scope agent) and passed as its attachment id. A template installed with connect_steps provisions hook URLs, which the `ingest` tool's list action returns for the new app_id, ready to wire into the external service. install: installs a template by `ref` for the caller, whose owning human becomes the owner. `config` is { stepKey: value } from the contract: a 'config' step's value is a string, an 'upload' step's value is a pre-uploaded attachment id. An omitted required step is rejected. Returns the new app's id, slug, and url; installs always create a fresh private copy. list_pending / get_submission / approve / reject / set_trust_level are relay-operator-only review actions: list_pending (the review queue, expedited submissions first), get_submission (a submission's full html+manifest+seedRows plus external_destinations, the hosts it can send data to or pull data from, by snapshot_id), approve (snapshot_id, lists it in the gallery + supersedes the app's prior approved version), reject (snapshot_id + a required note that lands in the publisher's app feed), set_trust_level (promote/demote a publisher by handle: handle + trust_level 'new'|'established'). upgrade_check / upgrade / revert keep an already-installed app current with its source template (app_id). An install is a one-shot fork, so nothing updates on its own and there is no follow/pin: you have to ask. upgrade_check reports whether a newer live version of that app's template line exists, whether it would apply cleanly, and what it would newly be allowed to reach. upgrade applies it in place, keeping the app's address, collections and rows, and landing as a new version you can undo. It refuses outright, with no override, when the new version would strand rows the app already holds; when the new version merely asks for more than the installed one, pass accept_permissions:true, but only after showing the owner what `permission_lines` says. revert puts the app back on the version it ran before the last update, and refuses when rows written since would have nowhere to live under the older one.
app_idNopublish / upgrade_check / upgrade / revert. For publish, the app to publish. For the three upgrade actions, the installed app to act on: an installed template is a fork, so the question is whether a newer version of the template that app came from exists, which only the app can answer.
configNoinstall only. The install-time answers as { stepKey: value } from the config contract: a 'config' step's value is a string, an 'upload' step's value is a pre-uploaded attachment id. Omit for a template with no config steps.
cursorNolist_pending only. Opaque cursor from a prior next_cursor.
handleNoset_trust_level only. The @-handle of the publisher to promote or demote.
versionNopublish only. Semver MAJOR.MINOR.PATCH (default '1.0.0'). A republish under the same slug must be strictly greater than the current version.
categoryNopublish only. Optional single-word category (e.g. 'household').
descriptionNopublish only. Listing blurb (up to 200 chars). Defaults to the manifest description.
setup_stepsNopublish only. Ordered typed setup steps an installing agent follows after install (up to 20). A 'config'/'upload' step may carry a `key` naming a field of the manifest's settingsCollection that its install-time answer is written into; a 'connect' step may carry an `ingestRule` naming a manifest ingest rule it wires up. Read back via get_submission and rendered on the template detail page.
snapshot_idNoRequired for get_submission/unpublish/approve/reject. The submission's snapshot id (from publish's response or list_pending).
trust_levelNoset_trust_level only. 'established' fast-tracks the publisher's future submissions through review; 'new' reverts to full review.
changelog_noteNopublish only. A short note recorded in this version's changelog.
expect_versionNoupgrade only. The version upgrade_check reported. When given, the upgrade is refused if the offer has moved since, so a publisher shipping again mid-flight cannot slip a version past you that you never showed anyone.
long_descriptionNopublish only. Optional long-form description (up to 4000 chars) shown on the template detail page below the short blurb, for readers and search ranking. Plain text: blank lines become paragraphs, and it is escaped (never rendered as raw HTML), so write prose, not markup.
accept_permissionsNoupgrade only. Required when upgrade_check reports a non-empty `permissions` diff, meaning the new version asks for more than the installed one (new hosts it can send data to, new device capabilities, a service worker, CDN scripts). Never assume it: show the owner `permission_lines` and set this only once they have agreed. It does not clear a version that would strand rows, which nothing can.
attest_example_onlyNopublish only. True attests that the template content and the captured seed rows contain no real personal data. Publishing makes both public to every platform user, so seed data (the live rows of the app's seedOnInstall collections) must be example-only, never real names/emails/addresses/private messages. Recorded and shown to the reviewer; omitting it still publishes but is flagged to the operator as not attested.
derived_from_snapshot_idNopublish only. Optional remix/fork lineage: the snapshot id this template was derived from.
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

This description is exceptionally transparent about side effects and preconditions. It discloses privacy consequences ('seed data in a published app must be example-only'), idempotency ('unpublishing an already-unpublished template is a no-op'), and nuanced failure behavior ('a snapshot that does not exist or belongs to someone else reads as not found'). Annotations (destructiveHint=true) are consistent, but the description adds rich context about what gets destroyed and what remains unaffected (existing installs).

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured by action but quite verbose, repeating key points (e.g., the privacy warning appears in both the main description and the action parameter description). It front-loads the action list, which helps, but several sentences could be tightened without loss of meaning. The length is justified by the tool's complexity, but it does not earn a higher conciseness score.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a complex tool with 23 parameters, no output schema, and multiple distinct operations, the description is remarkably complete. It covers return values ('returns the new app's id, slug, and url'), edge cases (idempotency, not-found behavior), permissions (relay-operator-only), and side effects (superseding prior versions). It leaves very little for the agent to infer.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With 100% schema coverage, the baseline is 3, but the description adds meaningful cross-parameter logic beyond the schema—for instance, explaining how slug and version interact ('a republish under the same slug must bump the version') and what attest_example_only actually records. It also clarifies the semantic role of config values ('a 'config' value is a string and an 'upload' value is a pre-uploaded attachment id'). This elevates the value over the raw schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a clear list of distinct actions ('publish, unpublish, get_config_contract, install, list_pending, get_submission, approve, reject, set_trust_level') and ties them to a specific resource ('community template'). It also distinguishes the tool from siblings by clarifying scope (e.g., 'for relay operators', 'install creates a fresh private copy'), so an agent can confidently select it for template publishing/installing operations.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives strong contextual guidance: it explains when each action is appropriate (e.g., publish vs unpublish, install vs upgrade) and includes explicit exclusions like 'works only on your own submissions' and 'limited to the relay's configured community reviewers'. It also references companion tools (attachments, ingest) for related steps. It stops short of explicitly naming sibling tools as alternatives (e.g., 'publisher' vs 'community'), so it misses a 5.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

connectionsManage App ConnectionsA
Destructive
Inspect

A v2 app's Connections: the stored credential (a static header token, or a full generic OAuth2 client) a manifest webhook rule authenticates its delivery target with, bound to a host so the credential can never be exfiltrated to another one. There is no update action: change a connection by deleting and recreating it. Actions: create stores a static or oauth2 connection and returns its metadata, never the secret; list returns the app's connections as metadata plus a non-reversible fingerprint, never any secret; delete is idempotent; consent_url builds (never fetches) the browser URL that completes an oauth2 connection's consent, since that is inherently a human-in-a-browser step an agent key cannot complete. A newly created oauth2 connection starts in pending_auth until the owner opens the consent_url and approves.

ParametersJSON Schema
NameRequiredDescriptionDefault
kindNocreate only. Defaults to `static`.
nameNocreate / delete / consent_url. The connection name (lowercase, starting alphanumeric, up to 64 chars) that a manifest webhook rule's `connection` field references.
labelNocreate only. Optional owner-facing label.
actionYescreate: store a webhook connection, a stored credential (static header token or a full generic OAuth2 client) a manifest webhook rule authenticates its target with (app_id+name+allowed_host, plus kind-specific fields). list: the app's connections as metadata plus a non-reversible fingerprint, never any secret (app_id). delete: idempotent (app_id+name). consent_url: build (never fetch) the browser URL that completes an oauth2 connection's owner consent (app_id+name); hand it to the signed-in owner to open, since an agent key cannot complete OAuth consent itself.
app_idYesThe app id.
scopesNocreate only (oauth2). Space-delimited scopes for the authorize request.
providerNocreate only. Freeform display label only, e.g. "hubspot"; not validated against any allowlist.
client_idNocreate only, required for kind=oauth2. Your OAuth2 app's client id.
auth_paramsNocreate only (oauth2). Extra key/values merged into the authorize redirect (e.g. to request offline access).
auth_schemeNocreate only (oauth2). The scheme the access token is sent under. Defaults to "Bearer"; set e.g. "Zoho-oauthtoken" for a non-Bearer provider.
header_nameNocreate only (static). The header the credential rides in. Defaults to "Authorization".
allowed_hostNocreate only, required for both kinds. The host-binding exfiltration defence: an exact DNS host ("api.hubapi.com") or a single leftmost wildcard ("*.zohoapis.com"). The stored credential is attached to a delivery only when its url host matches; a rule later repointed elsewhere fails delivery rather than sending the secret to the wrong host.
header_valueNocreate only, required for kind=static. The header value to send, e.g. "Bearer sk_live_...". Encrypted at rest and never returned by any call.
token_paramsNocreate only (oauth2). Extra key/values merged into the token POST.
authorize_urlNocreate only, required for kind=oauth2. The provider's OAuth2 authorize endpoint (https; rejected if it resolves to a private/loopback/metadata address).
client_secretNocreate only, required for kind=oauth2. Your OAuth2 app's client secret. Encrypted at rest and never returned by any call.
instance_fieldNocreate only (oauth2). The name of a token-response JSON field holding the API base URL (e.g. "instance_url"). When set, the relay re-binds allowed_host to that host after consent and resolves relative rule urls against it.
token_endpointNocreate only, required for kind=oauth2. The provider's OAuth2 token endpoint (same https + SSRF rules as authorize_url).
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond annotations (readOnlyHint=false, destructiveHint=true), the description reveals critical behavior: create "returns its metadata, never the secret," list returns a "non-reversible fingerprint, never any secret," delete is idempotent, and oauth2 connections start in `pending_auth` until consent. It also explains the host-binding failure mode, providing substantial transparency.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is long, but it is well-structured and information-dense, covering all major actions and edge cases. It fronts the core concept, then follows with the no-update caveat and action breakdown. While not maximally concise, every sentence contributes useful context.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity (4 actions, 18 params, no output schema), the description is remarkably complete. It explains return values (metadata vs secret/fingerprint), the pending_auth state, the consent flow, idempotency, and the host-binding security model. No major behavioral gaps remain.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the baseline is 3. The description does not add significant per-parameter meaning beyond what the schema already provides; it summarizes high-level behavior but points to the schema for field-level semantics.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose and differentiates its actions: "Actions: create stores...; list returns...; delete is idempotent; consent_url builds..." Each action has a specific verb and resource, making the tool's role unambiguous. It also distinguishes connections from generic credentials by emphasizing the host-binding exfiltration defence and webhook authentication context.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides actionable when-to-use guidance, notably "There is no update action: change a connection by deleting and recreating it" and the note that consent_url is for a "human-in-a-browser step an agent key cannot complete." It does not explicitly compare against sibling tools like 'credentials', but the context is sufficient for most use cases.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

count_rowsCount RowsA
Read-only
Inspect

The live row count of a v2 app's collection (spec B4, issue #1056), a whole-scope total with no filter and no paging. Gated by the collection's countRead opt-in, independent of its read list: a collection that opted in returns its count even to a caller who cannot list the rows (the '3 spots left' shape), and a collection that never opted in refuses with collection_count_forbidden even for a caller who could otherwise list. Returns { count }.

ParametersJSON Schema
NameRequiredDescriptionDefault
app_idYesThe app id.
collectionYesThe collection name declared in the app's manifest.
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond the readOnlyHint annotation, the description discloses the countRead opt-in mechanism, independence from read list permissions, the exact error condition (collection_count_forbidden), and the return shape. This is rich behavioral context far exceeding the annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is three sentences and front-loaded with the core purpose. While dense, it includes relevant behavioral details like opt-in gating and error semantics. Minor extras like 'spec B4, issue #1056' add reference context but are not strictly necessary, so not a perfect 5.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Despite having no output schema, the description explicitly states the return value. It covers permission gating, error cases, and the precise collection scope semantics. For a tool with nuanced authorization behavior, this is thorough and complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, and the parameter descriptions are already clear ('The app id.', 'The collection name declared in the app's manifest'). The tool description adds no extra semantics beyond what the schema provides, so baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly identifies the tool as returning 'the live row count of a v2 app's collection' and distinguishes it from list/get operations by emphasizing 'no filter and no paging' and returning '{ count }'. This separates it from sibling tools like list_rows and get_row.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It provides clear context on when to use (whole-scope count) and describes the countRead opt-in gating, but does not explicitly name alternative tools. The phrase 'no filter and no paging' implies when it's appropriate, and the '3 spots left' shape gives a concrete use case.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

credentialsManage App Service CredentialsA
Destructive
Inspect

A v2 app's scoped service credentials (#1354, #1355): the bearer token an app owner points a backend they host themselves at, so their own server can read and write the app's data without holding the owner's full authority. Effective permission is always the intersection of the allowlist and what the app's owner could do, so a credential can only ever narrow, never widen, and it carries no role. Actions: mint creates one and returns its raw token shown once, never recoverable afterward (only its hash is stored); list returns the app's credentials with their allowlist and status, never any token material; pause reversibly stops one; resume undoes a pause (never a revoke, which is permanent); rotate issues a fresh token while the old one keeps working for an overlap window, so a running backend picks up the new token with no outage; revoke kills one permanently. Every action here is owner-or-owning-agent only: a service credential itself can reach none of these, by construction, so it can never mint or widen a sibling of itself.

ParametersJSON Schema
NameRequiredDescriptionDefault
modeNomint only. Defaults to explicit: an unnamed collection is denied, so the credential can never reach anything it was not handed (the shape for a contractor's backend). following: an unnamed collection falls through to the owner's own authority, so the credential tracks the app as it grows and each `grants` entry only narrows one collection (the shape for the owner's own backend). Neither mode can ever exceed what the app's owner could do; the effective permission is always the intersection.
labelNomint only. Optional owner-facing label shown in the credential list.
actionYesmint: create a scoped service credential, the bearer token an app owner points a backend they host themselves at (app_id; optional mode/grants/members/label/ttl_seconds). list: the app's credentials, their allowlist and status, never a token (app_id). pause: reversibly stop one, in force on its very next request (app_id+credential_id). resume: undo a pause; never undoes a revoke, which is permanent (app_id+credential_id). rotate: issue a fresh token and keep the old one working for an overlap window so a running backend picks it up without a gap (app_id+credential_id; optional overlap_seconds). revoke: kill one permanently and idempotently (app_id+credential_id).
app_idYesThe app id.
grantsNomint only. The allowlist: one entry per collection naming which of read/create/update/delete this credential may attempt there (an entry may name zero ops, which under `following` is how one collection is carved out of an otherwise app-wide credential). A collection named here must be a real declared collection on the app; a typo is rejected with a 400 rather than silently doing nothing.
membersNomint only. Opt in to the app's member directory appearing in this credential's boot/hello payloads. Defaults to false: a credential that never learns a member id cannot stamp one into a relation field.
ttl_secondsNomint only. Omit for the server's bounded default (365 days, clamped to a server maximum). null means no expiry, the explicit opt-in a long-running backend asks for; it is never the default.
credential_idNopause / resume / rotate / revoke. The credential id (see list's `id` field).
overlap_secondsNorotate only. How long the superseded token keeps resolving, so a running backend can pick up the new one with no gap. Defaults to the server default (1 day); 0 kills the old token immediately, the "this leaked" case.
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond the annotations (readOnlyHint=false, destructiveHint=true), the description discloses rich behavioral details: the raw token is shown only once and never recoverable; pause is reversible, revoke is permanent; rotate keeps the old token working for an overlap window; effective permission is the intersection of allowlist and owner's authority; and typo in grants is rejected with a 400. These go far beyond what the annotations indicate.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is long but well-structured and front-loaded with the core concept. Each sentence serves a purpose, and the 'Actions:' list is organized clearly. While slightly verbose, the complexity of six actions with distinct behaviors justifies the length. Nothing is redundant.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a complex tool with no output schema, the description is exceptionally complete. It explains return behaviors (mint returns the token once; list returns metadata, never token material), error behavior (typo rejection with 400), security scope (owner-only, credential cannot self-escalate), and parameter applicability. All nine parameters are covered. It is fully self-sufficient for an agent to select and invoke the tool correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the baseline is 3. The description adds meaningful semantic context by grouping parameters per action (e.g., mode and grants are mint-only, overlap_seconds for rotate) and explaining how they interact (e.g., under 'following' mode, a zero-op grants entry narrows one collection). This elevates the contribution above the schema alone.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose: managing scoped service credentials for a v2 app. It not only names the resource ('credentials') but explains the concept of the bearer token and its role, and it distinguishes each of the six actions (mint, list, pause, resume, rotate, revoke) with specific verbs and outcomes, effectively differentiating it from sibling tools like 'key' and 'grants'.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides explicit context for when to use each action, such as mint for creating a credential, rotate for issuing a fresh token with overlap, and revoke for permanent deletion. It also notes a key constraint: every action is owner-or-owning-agent only. While it does not name alternative tools, the clear per-action scenarios give strong usage guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

delete_rowDelete RowA
DestructiveIdempotent
Inspect

Soft-delete a row from a v2 app's collection. Recoverable: the row is tombstoned, not destroyed, and restore_row brings it back for 30 days (see list_deleted_rows). A watcher sees the deletion live as op:delete on the change feed. Pass if_match for an optimistic-locked delete. Returns { deleted: true }.

ParametersJSON Schema
NameRequiredDescriptionDefault
keyYesThe key of the row to delete.
app_idYesThe app id.
if_matchNoOptional optimistic-lock version.
collectionYesThe collection name.
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Despite annotations like destructiveHint=true, the description clarifies this is a soft delete (tombstoned, recoverable), which is critical behavioral context. It also discloses change feed semantics (op:delete) and the return value, going beyond what annotations alone provide.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is three concise sentences that front-load the primary action and then add recovery, feed, and locking details. Every sentence provides essential information with no filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description covers the tool's purpose, recovery window, related tools, change feed visibility, optimistic locking, and return value. Despite no output schema, the return value is stated, making the description complete for this simple delete operation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema already describes all four parameters thoroughly (100% coverage), so the baseline is 3. The description adds meaningful context for if_match as an 'optimistic-locked delete' and implicitly ties key to the row being deleted, adding value beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with 'Soft-delete a row from a v2 app's collection,' which clearly identifies the verb (soft-delete), resource (row), and scope. It distinguishes from sibling tools like restore_row and list_deleted_rows by explaining recoverability.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives explicit recovery context: 'restore_row brings it back for 30 days (see list_deleted_rows)' and advises when to use if_match for optimistic locking. However, it stops short of explicitly stating when not to use the tool or comparing with all possible alternatives.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

deploy_appDeploy AppAInspect

Deploy a v2 app: an HTML document plus a capability manifest, hosted at its own URL.

A redeploy only needs the content that changed. Every content field is optional when app_id is given, and an omitted one keeps what is live: omit manifest for an HTML-only change, omit html for a manifest-only change, omit assets to keep the current files. This is the cheap path and the default, because an omitted field costs no output tokens at all: a one-line colour change does not resend the whole document, and a manifest edit does not resend it either. A field only needs sending when its content differs from what is live. assets: [] is the explicit way to clear the asset set, and omitting all three is refused, since there would be nothing to change.

The extension keys used most often: app metadata; collections, with per-collection write, update, read and delete role lists, where write gates creates and also gates updates unless an update list is declared; externalHosts, a fetch allowlist; cdn, to allow CDN scripts and styles; capabilities, for Permissions-Policy opt-ins; embeds, an iframe frame-src allowlist; notify, for email-on-row rules; webhooks, for signed HTTP POST on-row rules; and agentTasks, to queue work for an agent running on the owner's own machine, described as a prompt rather than as code. The manifest grammar is documented in the Homespun guide that get_skill returns.

Pass no app_id to create, which mints a slug and URL and requires both html and manifest, or pass app_id to redeploy an existing app. Supply the HTML inline as html, or as html_path, an absolute path read on the MCP-server host, which is the relay for a hosted connector or the CLI host for a locally-run one, and not the remote agent's machine; it avoids retransmitting a large HTML file on every deploy, only a locally-run connector can read it, and inline html wins if both are given. dry_run:true (alias check) validates only: it runs the full manifest and asset validation, the redeploy compat gate and the schedule-timezone advisory, then returns { ok, warnings, compat?, breaks? } without creating a version or mutating anything, and it resolves omitted fields the same way a real deploy would, so it reports on exactly the deploy that would run.

A redeploy is refused with manifest_incompatible_redeploy, unless force:true, when it would strand rows already written (dropping a collection, tightening a schema, flipping appendOnly), or when it would widen what the app's install screen discloses: a collection's read reaching further than the live manifest, a capability added, cdn turned on, or a host added to externalHosts, embeds or a webhook target. The break quotes the sentence a user would now be asked to approve. Taking access away never prompts: dropping a role, dropping a capability, host or webhook, turning cdn off, or adding update:["creator"] to a write:["anyone"] collection, all redeploy clean. A removed collection is detached rather than deleted.

Images, fonts, audio, video and data files ship with the app in the same call via assets[]. Each is validated and stored app-scoped and served at its path on the app's own origin, so the HTML references it by a stable same-origin path such as <img src=\"frames/000.jpg\">; media and font paths support HTTP Range for seeking. A redeploy's assets replace the previous version's set when sent, carry over when omitted, and are cleared by assets: [].

Returns { app_id, slug, url, version, visibility, created } on create, or { app_id, version, compat, breaks? } on redeploy.

ParametersJSON Schema
NameRequiredDescriptionDefault
htmlNoThe app's UI as a complete HTML document (single file, with CSS and JS inline), sent inline. Capped at 2 MB of UTF-8; over that the deploy is refused with 413 document_size_exceeded. A document near the cap is almost always carrying a file inlined as a data: URI; the same file in `assets[]` is served from the app's own origin, cached separately, and does not count toward this cap. The document comes from either this field or `html_path`. Inline is the only form a hosted or remote connector with no filesystem can use, and inline `html` wins if both are given. On a redeploy an omitted `html` keeps the live document, so a manifest-only change (adding a collection, widening externalHosts) costs nothing in HTML.
slugNoCreate only. Accepted with visibility private or public, including the private default; rejected with explicit visibility 'link', where the slug is always server-generated.
checkNoAlias for `dry_run`.
forceNoRedeploy only. Bypasses the compat gate, whether it fired on a stranded-rows narrowing or on a widening of what the install screen discloses (a removed collection is detached, never deleted).
app_idNoOmit to create a new app; pass an existing app's id to redeploy it (a new version, compat-gated unless force:true).
assetsNoOptional bundle of files shipped with the app in one deploy: images, fonts, audio/video, data. Each asset either carries its bytes inline as `content_base64` or references an already-uploaded attachment by `attachment_id`; the reference form suits real images and media, where the file is uploaded once via `attachments fetch` or presign and then bound here, with no base64 in the deploy body. Each asset is validated + stored app-scoped exactly like a normal attachment (byte-sniff, allowlist, size cap, quota, scan) and served at its `path` on the app's own origin, so the page references it by a stable same-origin path (`<img src="frames/000.jpg">`, `<video src="media/intro.mp4">`; media/font paths support HTTP Range). The whole deploy is rejected atomically if any asset fails validation. On a redeploy, sent assets replace the previous version's set, an omitted `assets` keeps the live set (no re-upload, no re-encoding), and `assets: []` is the explicit way to clear it. Bounded by the relay's per-deploy asset-count cap; total bytes by the per-app blob quota.
dry_runNoValidate only: run the full manifest + asset-shape validation, the compat gate (for a redeploy), and the schedule-timezone advisory, then return { ok, warnings, compat?, breaks? } without creating a version or mutating anything. An invalid manifest returns the same error a real deploy would; a redeploy the compat gate would refuse reports the break instead of applying it. `check` is an accepted alias.
manifestNoThe x-homespun-manifest capability document (a JSON object). Required to create; on a redeploy an omitted `manifest` keeps the live one, which fits most redeploys (the manifest was byte-identical to the previous version in 71% of real redeploys). The extension keys used most often: app metadata; collections (+ per-collection write/update/read/delete role lists, where write gates creates and also updates unless the optional update list is declared); externalHosts (fetch allowlist); cdn (allow CDN scripts/styles); capabilities (Permissions-Policy opt-ins); embeds (iframe frame-src allowlist); notify (email-on-row rules); webhooks (signed HTTP POST on-row rules); agentTasks (queue work for an agent on the owner's own machine, described as a prompt). The full grammar is documented in the Homespun guide that get_skill returns.
html_pathNoAbsolute path to the app's HTML document, read on the MCP-server host (the machine running this connector: the relay for a hosted connector, or the CLI host for a locally-run one), not on the remote agent's machine. An alternative to inline `html` that avoids retransmitting a large HTML file on every deploy. It resolves only when the file is local to the MCP server, so it serves a locally-run connector rather than a hosted or remote one, where the path does not exist and the call returns a clean error; inline `html` is the form that works there. If both `html` and `html_path` are given, inline `html` wins.
visibilityNoCreate only. Default 'private' (owner plus invited members, sign-in gated). 'link' shares with anyone holding the returned share_url, whose #k= fragment carries a secret key that can be reset (rotate it via the apps tool, action share_link_rotate) to cut off everyone with the old link; a 'link' app always gets a server-generated unguessable slug. 'private' and 'public' accept an owner-chosen `slug`.
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond the minimal annotations (readOnlyHint=false, etc.), the description discloses many non-obvious behaviors: omitted fields keep live values and cost no tokens, `assets: []` clears the set, redeploys are refused unless `force:true` under certain conditions, and access removal never prompts. It also specifies exact return shapes on create vs redeploy, and describes the dry_run side-effect-free behavior. This is far richer than the annotations alone and helps the agent predict side effects accurately.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is long, but every sentence earns its place given the tool's complexity (10 params, nested assets, create vs redeploy modes, dry_run, manifest grammar). It front-loads the core contract (deploy = html + manifest) and then systematically covers redeploy semantics, parameter specifics, and edge cases. The structure flows from high-level purpose to detailed parameter behavior, with no filler or redundant repetition.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description is complete for a tool of this complexity. With no output schema, it explicitly states the return values for both create and redeploy ('{ app_id, slug, url, version, visibility, created }' and '{ app_id, version, compat, breaks? }'). It covers error conditions (413, manifest_incompatible_redeploy), asset validation, host-specific behavior for `html_path`, and the exact effect of dry_run. Everything an agent needs to decide when to call and what to expect is present.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Although schema coverage is 100%, the description adds substantial meaning beyond the schema. For example, it explains the cost model of omitted parameters, the interaction between `html` and `html_path` (inline wins), the semantic difference between `assets` omission vs `[]`, and the meaning of `force` with respect to the compat gate. It also enumerates common manifest keys and clarifies `check` as an alias for `dry_run`, making the parameter semantics far more actionable than the schema alone.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a clear, specific verb and resource: 'Deploy a v2 app: an HTML document plus a capability manifest, hosted at its own URL.' It immediately distinguishes create vs redeploy and the overall scope. This differentiates it from sibling tools like `apps` or `attachments` by naming the core output (hosted app) and the two required/typical inputs.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides explicit guidance on when to use each mode: 'Pass no `app_id` to create... or pass `app_id` to redeploy.' It also explains `dry_run` for validation-only, when to use `html_path` vs inline `html` (hosted vs local connector), and when to use `attachment_id` vs `content_base64` (referencing `attachments fetch`). It even cross-references `get_skill` for manifest grammar, offering a clear path to more details.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

feedbackManage FeedbackAInspect

Reports a problem with homespun itself to the relay operator, and lists what this agent has already reported. A report is the operator's only visibility into a failure that happened inside an agent's session, so an unreported one is a failure nobody can fix.

The channel covers homespun's own behaviour: a 5xx, or an error code the guide does not describe; a disagreement between documented and observed behaviour; something the tool surface cannot express, such as a missing capability or a schema that contradicts itself; an app misbehaving in a way that traces back to the platform (the bridge, the runtime, serving, the data API) rather than to authored HTML; or a guide that was wrong, ambiguous or silent.

Outside its scope: the human's own task; bugs in an app the agent authored; presentation preferences, which belong in taste; the human's own configuration, such as a missing API key or the wrong account; and a 4xx caused by the agent's own arguments, except where the error message itself was misleading, which is a documentation problem best filed as a note.

Duplicates cost the operator triage rather than adding signal. Action list returns this agent's own submissions, newest first, so a failure already recorded needs no second row: one report covers one distinct failure, however many times it was retried.

The operator sees the row and not the session, so a bare "deploy failed" is not actionable. An actionable message carries the surface (mcp, cli, relay or app-runtime); where it happened (the tool or route); the skill version, from the <!-- homespun skill vX.Y.Z --> comment at the top of the guide; what was expected, in one line; what was observed, in one line carrying the exact error code and message; and the minimal steps or arguments that reproduce it.

type is bug for something broken, feature for something missing, note for a rough edge or a confusing doc. app_id scopes a report to one app. There is no reply channel, so a report is not a route to an answer. Actions: create files one report; list returns this agent's own submissions, newest first, paginated by before.

ParametersJSON Schema
NameRequiredDescriptionDefault
typeNoFeedback category (required for create).
limitNolist page size (default 50, max 100).
actionYesReports a problem with homespun itself to the relay operator. create: files one bug|feature|note with a message and an optional app_id. list: this agent's own submissions, newest first, which is what distinguishes a new failure from one already reported.
app_idNoOptional app this feedback relates to (create).
beforeNolist cursor from a prior page's next_before.
messageNoMessage body (required for create).
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Goes well beyond the sparse annotations by disclosing that there is no reply channel, that list returns only the agent's own submissions, and that an unreported failure is invisible to the operator. Also explains duplicate handling and action details, making behavioral expectations clear.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is lengthy but every paragraph serves a purpose: scope, exclusions, duplicate warning, actionable message structure, and type semantics. It is front-loaded with the core purpose and well-paragraphed, though slightly dense for a fast scan.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with two actions, six parameters, and nuanced scope, the description covers all necessary context: purpose, usage boundaries, duplicate handling, message composition, type meanings, app_id, lack of reply channel, and pagination. There is no output schema, but the description explains what list returns and how paging works.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Although the schema has 100% coverage, the description enriches each parameter with practical meaning: type definitions (bug/feature/note), app_id scoping, message actionability requirements (surface, location, expected vs. observed, reproduction steps), and pagination via `before`. This goes far beyond the schema's bare descriptions.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource: 'Reports a problem with homespun itself to the relay operator, and lists what this agent has already reported.' This clearly distinguishes feedback from sibling tools like taste or review by scoping it to platform-level issues.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides explicit in-scope and out-of-scope guidance, naming alternatives (e.g., presentation preferences belong in `taste`, documentation issues best filed as a `note`). Also clarifies when to use list vs. create and warns that duplicates are counterproductive.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_feed_eventsGet App Feed EventsA
Read-only
Inspect

Poll a v2 app's change feed for what has happened: row creates, updates and deletes, from any writer, agent or human. It is the long-poll analogue of homespun apps watch, since MCP has no streaming. The loop is: call with no since first, process the returned entries, keep the cursor, then call again passing it as since to get only newer entries. Passing wait (around 25) holds the request open until an entry arrives or it times out, which is how the feed is waited on rather than busy-polled. A since older than the retention floor returns resync_required, and the collections are then re-listed with list_rows. Returns { entries, cursor, truncated }.

ParametersJSON Schema
NameRequiredDescriptionDefault
waitNoOptional long-poll: how long the relay holds the request open waiting for a new entry (0-30s). Use ~25 when waiting for activity, then call again with the same cursor.
limitNoMax entries per page (capped server-side by FEED_PAGE_MAX).
sinceNoOpaque numeric cursor from a previous call's cursor. Omit (or 0) to read from the beginning.
app_idYesThe app id.
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Adds significant behavioral context beyond annotations: the polling mechanism, cursor usage, long-poll behavior with wait, and error handling (resync_required). No contradiction with annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Medium-length paragraph with clear logical flow: purpose, usage pattern, parameter explanation, error handling, return shape. Every sentence adds value, no waste.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Covers essential behaviors (polling loop, cursor, long-poll, error, return) but could mention retention floor details. Still complete enough for correct agent usage.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Input schema has 100% coverage, but the description adds practical usage guidance for each parameter (e.g., wait for long-poll, since as cursor, limit for pagination), enhancing understanding beyond schema descriptions.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states it polls a v2 app's change feed for row creates, updates, and deletes, and distinguishes itself from siblings like list_rows.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly describes the polling loop, when to use wait, and what to do on resync_required (re-list with list_rows), providing clear context for when to use this tool vs alternatives.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_rowGet RowA
Read-only
Inspect

Fetch a single row by its key from a v2 app collection, through a dedicated relay route rather than a client-side scan. Returns { row }, or an isError row_not_found.

ParametersJSON Schema
NameRequiredDescriptionDefault
keyYesThe key of the row to fetch.
app_idYesThe app id.
collectionYesThe collection name.
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true. The description adds that the tool uses a dedicated relay route (efficiency detail) and specifies the return format: { row } or an isError row_not_found. This provides useful behavioral context beyond annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences long, front-loading the purpose and key behavioral details. Every word serves a purpose; no redundancy or fluff.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple fetch tool with three parameters and no output schema, the description covers purpose, return format, and an implementation detail. It is mostly complete, though it could mention potential error scenarios beyond row_not_found (e.g., permissions).

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, with each parameter described (key, app_id, collection). The description does not add further semantics beyond what the schema already provides, so baseline score of 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Description clearly states the tool fetches a single row by key from a v2 app collection, using an efficient relay route. It distinguishes itself from sibling tools like list_rows, delete_row, etc., by focusing on single row retrieval.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description mentions using a dedicated relay route instead of client-side scan, implying efficiency when the exact key is known. However, it does not explicitly state when to use this tool versus alternatives like list_rows or other fetch methods.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_skillGet Skill GuideA
Read-only
Inspect

The relay's SKILL.md, a generated guide to the Homespun workflow covering events versus records, the schema grammars and the poll loop. Needs no API key. Useful when working out how the other tools fit together, or to refresh a cached copy. Pass version_only:true to return just the relay's skill version string, which is enough to tell whether a cached copy is current.

ParametersJSON Schema
NameRequiredDescriptionDefault
version_onlyNoIf true, return only the relay's current skill version string instead of the full SKILL.md markdown.
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true, and the description adds that no API key is needed, confirming a safe read operation. It explains the return options (full guide or version string) and the caching optimization. Minor gap: could mention if the operation is fast or has side effects, but overall good.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three well-structured sentences. The first identifies the tool and its content, the second gives usage context, the third explains the parameter. No wasted words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's simplicity (one boolean param, no output schema), the description covers all essential aspects: what it returns, when to use, how to use the parameter, and what the guide contains. No gaps for effective agent invocation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% for the single parameter. The description adds meaningful context by explaining the caching use case for version_only, going beyond the schema's basic description. It clarifies why one might use this parameter.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly identifies the tool as retrieving the relay's SKILL.md guide, explaining its content (Homespun workflow, events vs records, schema grammars, poll loop). The title 'Get Skill Guide' aligns well, and the description distinguishes the version_only parameter's purpose.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly states when to use: 'when working out how the other tools fit together, or to refresh a cached copy.' Also mentions it needs no API key, and gives guidance on using version_only to check cache freshness.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

grantsManage App Grant LinksA
Destructive
Inspect

A v2 app's grant links (M5). A grant link is a capability URL that confers a declared custom role (x-homespun-manifest.roles) on a stable per-holder anonymous identity, so a holder's own rows are isolated by author/:own scoping. A grant does not escalate to owner, member or agent. Actions: mint creates a link and returns a grant_url carrying the token in its #g= fragment, shown once and not recoverable afterwards; list returns the app's links and never a token; revoke is idempotent. mode 'once' is one-time, claimed by the first browser to open it; 'multi' is shared, capped by max_uses within expiry. An optional pin (pin_row_key or pin_where) narrows a holder to specific rows and never widens their access. One consequence worth knowing when minting: a write-only grant pinned to a single row key can still read that row's existing data back through create dedup, so such a grant exposes that row's current contents to the holder.

ParametersJSON Schema
NameRequiredDescriptionDefault
modeNomint only. once: one-time link, claimed by the first browser that opens it (a real per-person link; later opens by others are inert). multi (default): a shared link, capped by max_uses within expiry.
roleNomint only. A declared custom role for the app (an x-homespun-manifest.roles key). A built-in role (owner/member/agent/anyone) is rejected: a grant can never escalate.
labelNomint only. Optional owner label shown in the grant list.
actionYesmint: create a grant link carrying a declared custom role (app_id+role). list: the app's grant links (app_id). revoke: revoke one link (app_id+grant_id).
app_idYesThe app id.
grant_idNorevoke only. The grant link id (see list's `id` field).
max_usesNomint only (multi mode). Cap total claims; omit for unlimited within expiry. Ignored for once (forced to 1).
pin_whereNomint only. Optional narrowing pin as Wave C2 where conditions ({field, op, value}[]). Narrows within the role (never widens). Mutually exclusive with pin_row_key.
pin_row_keyNomint only. Optional narrowing pin to a single row key. Narrows within the role (never widens). Mutually exclusive with pin_where.
ttl_secondsNomint only. Grant lifetime in seconds; defaults to the server default (30 days) and is clamped to the server max.
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond the annotations (readOnlyHint false, destructiveHint true, etc.), the description discloses critical behaviors: the grant_url token is shown once and not recoverable, list never returns a token, revoke is idempotent, pins never widen access, and the write-only grant read-back caveat. This is far richer than the structured hints alone.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is dense but every sentence earns its place, covering definition, actions, modes, pin behavior, and a security-relevant caveat. It is well-structured, front-loaded with the core concept, and contains no filler or redundant repetition.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 10-parameter, multi-action tool with no output schema, the description is unusually thorough: it describes mint/list/revoke, token handling, once/multi modes, pin narrowing, and a subtle security consequence. It stops short of fully describing return shapes for list/revoke and error behavior, but the schema and annotations fill some gaps.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema already covers 100% of parameters with descriptions, so the baseline is 3; the description adds meaningful context on top—mode explanations, pin narrowing semantics, and the max_uses cap within expiry. It enriches the schema without replacing it, so 4 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly defines the resource ('A v2 app's grant links') and enumerates the three actions with specific verbs: mint, list, and revoke. It distinguishes itself from sibling tools by focusing on capability URLs and custom role grants, with a clear explanation of what a grant link is and does.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives clear context on when to use each action and explains key modes (once vs multi), but it does not explicitly name alternative tools or state 'use members instead.' It does provide a useful exclusion: 'A grant does not escalate to owner, member or agent,' which helps scope its usage.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

ingestManage App Inbound HooksA
Destructive
Inspect

A v2 app's inbound catch-hooks (inbound-webhooks). A catch-hook lets an external system such as Stripe, Zapier, Make, Home Assistant or an email router POST JSON to a secret URL that writes into a declared collection, so the app receives data with no agent online. Hooks are declared in the manifest (x-homespun-manifest.ingest) and materialized at deploy, so this tool has no create or delete: it reads back the URL, rotates a leaked one, and manages the opt-in signing secret. After deploying a manifest that declares a hook, list is what yields the exact URL to paste into the external system. Actions: list returns the app's hooks, each with its full secret URL, current rule collection, mode, wake and handshake settings, per-status delivery counts and signing-secret state; rotate mints a fresh URL secret for one hook by name and returns the new url once, after which the old url stops working immediately with no redeploy needed; set_signing_secret provisions or rotates a hook's signing secret, which is a different secret from the URL and is what a provider HMACs the body with, minting one returned once when secret is omitted or storing a provider value verbatim when it is passed, and never echoing it back; clear_signing_secret removes it. Signature verification currently ships dark: nothing verifies a signature yet.

ParametersJSON Schema
NameRequiredDescriptionDefault
nameNorotate / set_signing_secret / clear_signing_secret. The manifest ingest hook name (an x-homespun-manifest.ingest[].name). See list's `name` field.
actionYeslist: the app's inbound catch-hooks, each with its full secret URL, current rule (collection/mode/wake/handshake), and per-status delivery counts (app_id). rotate: mint a fresh URL secret for one hook and return its new URL once, invalidating the old URL immediately (app_id+name). set_signing_secret: provision or rotate a hook's opt-in signing secret, distinct from the URL secret (it is what a provider HMACs the body with); omit `secret` to mint one (returned once) or pass `secret` to store a provider-generated value verbatim (never echoed) (app_id+name). clear_signing_secret: remove a hook's signing secret (app_id+name).
app_idYesThe app id.
secretNoset_signing_secret only. A provider-generated signing secret to store verbatim (the Stripe path). Omit to have the relay mint one (the GitHub path), returned once in the response.
grace_secondsNoset_signing_secret only. On a rotation, how long the previous secret stays valid so deliveries verify while you update the provider (default 3600, max 86400).
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description adds behavioral context beyond the destructiveHint annotation: rotate invalidates the old URL immediately with no redeploy, set_signing_secret never echoes a stored secret, and 'Signature verification currently ships dark: nothing verifies a signature yet.' These are valuable, honest disclosures that the annotations alone do not provide.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a long, dense paragraph. While it contains important context, the action summary duplicates the schema's action enum descriptions almost verbatim, which is redundant for an agent that can already read the schema. The structure is not broken into bullets or sections, making it harder to scan.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with no output schema, the description covers return behavior well: list returns full URLs and settings, rotate returns a new URL once, set_signing_secret mints or stores a secret and never echoes it, and clear_signing_secret removes it. It also explains the overall relationship to manifests and deploys, making the tool's context complete for an AI agent.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema already provides 100% parameter coverage with detailed descriptions for action, name, secret, and grace_seconds. The description largely repeats the schema's action semantics (e.g., 'mint a fresh URL secret for one hook... invalidating the old URL immediately') rather than adding new parameter-level meaning. It adds contextual examples (Stripe, Zapier) but does not enhance parameter understanding beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly identifies the tool as managing a v2 app's inbound catch-hooks (inbound-webhooks), explicitly stating the three key operations: reading back the URL, rotating a leaked URL, and managing the opt-in signing secret. It distinguishes itself from sibling CRUD/row tools by stating it has no create or delete capability.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description says when to use the tool: 'After deploying a manifest that declares a hook, list is what yields the exact URL to paste into the external system.' It also explicitly says 'this tool has no create or delete,' which is a clear when-not. However, it does not name specific alternative sibling tools, so it stops short of full explicit alternatives.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

keyManage API KeyA
Destructive
Inspect

The calling agent's API key. Actions: list returns key info (agent_id, key_prefix, timestamps); mint creates a sibling API key for the caller's own agent identity with the same scope and ownership and returns its raw value once, which is how an MCP-driven agent hands a CLI or child process a working credential, and the raw value is not retrievable afterwards, the sibling appears in a later list made with it, and the owner can revoke it; revoke destroys the agent's own key, which stops working immediately and cannot be undone, so it requires confirm:true. The relay derives identity from the caller's token, so every action applies to the caller's own agent and mint cannot target another agent's id.

ParametersJSON Schema
NameRequiredDescriptionDefault
actionYesThe calling agent's API key. list: key info (agent_id, key_prefix, timestamps). mint: mints a sibling API key for the calling agent's own identity (same scope/ownership) and returns its raw value once, which is what hands a CLI or child process a working credential; the sibling is a distinct key that shows up in a subsequent `list` made with it, the owner can revoke it, and the raw value is never retrievable again. mint always acts on the calling agent, never another agent's id. revoke: self-destructs the agent's own key, which stops working immediately and is irreversible (requires confirm:true).
confirmNoRequired (true) for revoke.
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Discloses critical behavioral details beyond annotations: mint returns raw value only once and never again, sibling appears in later list, revocation is immediate and irreversible, and confirm:true is required. Also explains identity derivation from caller token. This goes well beyond the destructiveHint annotation.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is dense and information-packed, but it is a single run-on paragraph. It could be structured with bullet points for readability, but every sentence adds value with no fluff, so it remains efficient.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's security-sensitive nature (destroying credentials, minting keys), no output schema, and minimal annotations, the description is remarkably complete. It covers all actions, side effects, irreversibility, confirmation requirement, identity constraints, and the unique one-time retrieval of minted keys, leaving no major gaps.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, and the schema parameter descriptions already contain most of the behavioral detail. The main description adds a little extra context (e.g., relay identity derivation) but does not significantly enhance understanding of parameters beyond what the schema provides, so baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the resource (the calling agent's API key) and lists three specific actions (list, mint, revoke), each with distinct behavior. It distinguishes itself from sibling tools by focusing on self-managed API key operations.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides explicit usage context for each action: list for key info, mint for creating a sibling key to hand to a CLI/child process, revoke for self-destruction with confirm required. It also explains identity constraints (cannot target another agent) and acts on the caller's own key, giving clear when/why guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_deleted_rowsList Deleted RowsA
Read-onlyIdempotent
Inspect

List a collection's recently deleted rows: the recovery bin. Deleting a row is a soft delete, so it can be restored with restore_row until recoverable_until passes (30 days after deletion by default). Owner or agent only, and deliberately independent of the collection's read permissions. Rows already purged appear with purged:true and cannot be restored. Returns { rows, next_before }.

ParametersJSON Schema
NameRequiredDescriptionDefault
limitNoMax rows to return (default 100).
app_idYesThe app id.
beforeNoCursor for the next page: pass back the previous page's next_before.
collectionYesThe collection name.
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond annotations (readOnlyHint, idempotentHint), the description discloses soft-delete behavior, the 30-day retention window, purged rows appearing with purged:true, and that purged rows cannot be restored. It also reveals the return shape, adding significant context.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Multiple sentences, each conveys distinct information: purpose, restore behavior, permissions, purged handling, and output shape. No fluff; front-loaded with the core action.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

No output schema exists, so explicitly stating the return object ({ rows, next_before }) is essential. The description also covers auth constraints and edge cases (purged rows), making it complete for a tool of this complexity.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% with all four parameters described, including limit default and before cursor. The description doesn't add parameter-specific semantics beyond what the schema already provides, so the baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource ('List a collection's recently deleted rows') and names the 'recovery bin.' It also references restore_row and soft-delete semantics, distinguishing it from list_rows and other sibling tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Clearly states when this is relevant: 'Deleting a row is a soft delete, so it can be restored with restore_row until recoverable_until passes.' It also notes permission requirements (owner/agent only) and independence from read permissions. It doesn't explicitly contrast with list_rows, but the context is clear.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_rowsList RowsA
Read-only
Inspect

List rows in a v2 app's mutable collection. This is also how a collection's current state is polled, since MCP has no streaming: pass the prior next_cursor as since to fetch only rows that are new or changed. Returns { rows, next_cursor, has_more }.

ParametersJSON Schema
NameRequiredDescriptionDefault
limitNoPage size.
sinceNoOpaque cursor from a previous call's next_cursor. Also the poll handle: pass it back to fetch only newer/changed rows.
app_idYesThe app id.
collectionYesThe collection name declared in the app's manifest.
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description adds behavioral details beyond the readOnlyHint annotation by explaining the non-streaming nature of MCP and the polling mechanism. It also discloses the return shape with rows, next_cursor, and has_more. It does not mention auth or rate limits, but those are not critical for a read-only operation.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences long, immediately states the core purpose, and includes the return shape and a key usage pattern. Every sentence earns its place with no redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description covers the return structure and polling/pagination behavior, which is essential for this type of tool. The existence of a list_deleted_rows sibling implies this lists non-deleted rows, though that is not explicitly stated. Overall, it is sufficiently complete for a read-only list operation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

All four parameters are described in the schema with 100% coverage, so the baseline is 3. The description reinforces the polling use of `since` but the schema already states it is a poll handle. No additional parameter semantics are provided.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool lists rows in a v2 app's mutable collection, using a specific verb and resource. It distinguishes itself from sibling tools like get_row (single row) and delete_row/update_row/upsert_row (mutations).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It explicitly explains that this tool is also the way to poll a collection's current state, and instructs passing the prior next_cursor as `since` for incremental fetching. This provides clear guidance on when to use this tool versus alternatives for tracking changes.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

membersManage App MembersA
DestructiveIdempotent
Inspect

A v2 app's membership (auth spec section 6): who besides the owner can sign in to a private app and write to member-scoped collections. Actions: add invites or attaches a member by email, attaching immediately when the email already has a Human and otherwise sending a magic-link invite; list returns the app's owner and members; set_role changes an existing member's declared custom role in place, or clears it when null, and leaves their sessions intact, which is what makes it the way to re-role someone rather than removing and re-adding them; remove is idempotent and also revokes the human's live sessions on this app, and the app owner cannot be removed; roles returns the derived roles summary, giving the effective access a holder actually has per declared role and collection, reported separately for signed-in members and for grant-link holders because their role floors differ, along with member and active-grant-link counts.

ParametersJSON Schema
NameRequiredDescriptionDefault
roleNoadd only. Defaults to 'member' server-side — no other role is assignable via this API (ownership transfer is not available here).
emailNoadd only. The email to invite/attach. If a Human already exists for it, the member row is attached immediately; otherwise the relay emails a magic-link invite.
actionYesadd: invite-or-attach a member by email (app_id+email; optional custom_roles). list: the app's owner + members (app_id). set_role: replace an existing member's declared roles in place without signing them out (app_id+human_id+custom_roles, an empty list to clear). remove: drop a member (app_id+human_id). roles: the app's declared roles with what each one includes and, per collection, the effective access a holder has (separately for members and grant-link holders, whose role floors differ) plus how many members and live grant links hold each role (app_id).
app_idYesThe app id.
human_idNoremove and set_role. The Human id to target — see list's `humanId` field. The app owner can be neither removed nor re-roled.
custom_rolesNoadd (optional) and set_role (required). The declared roles (x-homespun-manifest.roles keys) attached to the member alongside their base member powers. A member may hold several and holds the union of what each grants, plus everything those roles `includes`. A built-in/reserved role or an undeclared role is rejected. Omit on add for an ordinary member; pass [] on set_role to clear the roles back to a plain member.
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description discloses important side effects beyond annotations: remove 'revokes the human's live sessions on this app', set_role 'leaves their sessions intact', add attaches immediately if a Human exists otherwise sends a magic-link invite, and the owner cannot be removed. This enriches the idempotent and destructive hints already present.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single dense paragraph but is organized by action and each clause earns its place given the tool's multi-action complexity. It could be more scannable with bullets, but it is not needlessly verbose.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema, the description compensates by explaining what list returns (owner + members) and what roles returns (effective access summaries and counts). It also covers constraints and side effects for add, set_role, and remove. It does not describe the exact return values for mutating actions, but that is a minor gap given annotations.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the baseline is 3, and the description largely restates what the schema already explains (e.g., email invite-or-attach, custom_roles semantics). It adds a small extra by pointing to list's humanId as the source for human_id, but no significant new parameter-level meaning.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description defines the tool as managing a v2 app's membership and enumerates each action with a specific verb (add, list, set_role, remove, roles), making it clear what the tool does and distinguishing it from sibling tools like grants. The scope is precise: 'who besides the owner can sign in to a private app and write to member-scoped collections.'

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives practical guidance, notably that set_role is 'the way to re-role someone rather than removing and re-adding them', and explains add's conditional invite-or-attach behavior. It does not provide explicit when-not-to-use guidance beyond the owner removal constraint, but the context is clear.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

publisherPublisher ProfileAInspect

The caller's community publisher identity: the @-handle and public profile shown in the template gallery. Actions: get returns the profile, including the handle, whether it has been claimed, tenure, and the rating and template counters; claim sets the handle from a lowercase 3-to-32-character string and may be used only once, after which the handle is permanent, and it refuses a handle that is reserved or already taken; update changes display_name, bio or url at any time. claim and update require a verified email. An existing publisher may hold a provisional maker-... handle assigned automatically, which claim renames on its one allowed use.

ParametersJSON Schema
NameRequiredDescriptionDefault
bioNoupdate only. Short public bio (up to 500 chars); null clears it.
urlNoupdate only. Public http(s) URL (up to 200 chars); null clears it.
actionYesget: returns the caller's publisher profile (handle, tenure, counters). claim: sets the caller's @-handle, once (handle arg; lowercase, 3 to 32 chars, permanent after claiming; needs a verified email). update: changes the caller's public display_name/bio/url (any of them; needs a verified email).
handleNoclaim only. The lowercase @-handle to claim (^[a-z0-9](?:[a-z0-9-]{1,30}[a-z0-9])$). Permanent once claimed.
display_nameNoupdate only. Public display name (up to 80 chars); null clears it.
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond annotations, the description discloses important behaviors: claim is one-time permanent, refuses reserved/taken handles, requires verified email, and explains the provisional `maker-` handle. This is rich behavioral context not available from annotations alone.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured with actions clearly enumerated in a compact paragraph. It front-loads the core identity concept and each sentence provides necessary information without redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the multi-action nature and lack of output schema, the description thoroughly covers return values for get, behaviors for claim/update, and prerequisites. It is complete enough for an agent to select and invoke correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema already describes all parameters with high coverage, but the description adds critical meaning: the handle permanence after claim and the one-time use restriction. This extra context clarifies parameter semantics beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly defines the tool as managing the caller's publisher identity, with distinct actions (get, claim, update) and specific resources (handle, profile fields). It differentiates from sibling tools like members or community by focusing on the publisher profile.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives clear context for when to use each action, including prerequisites like verified email for claim/update. It does not explicitly name alternative tools, but the scope is unambiguous and no sibling is a direct substitute.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

restore_rowRestore RowAInspect

Restore a soft-deleted row, undoing delete_row. The row comes back with its original data and creator, its version bumped. Find restorable keys with list_deleted_rows. Owner or agent only. Fails with restore_expired if the row was purged, or restore_conflict if another live row took a unique value this one held while it was deleted. Returns { row }.

ParametersJSON Schema
NameRequiredDescriptionDefault
keyYesThe key of the deleted row to restore.
app_idYesThe app id.
collectionYesThe collection name.
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With all annotation hints false, the description carries the full transparency burden. It discloses the mutation effects (original data, creator, version bump), authorization requirements (owner or agent), specific error conditions (restore_expired, restore_conflict), and return format ({ row }). This is rich behavioral context beyond what annotations provide.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is three sentences, front-loaded with the primary purpose, then behavior, then error handling. Every sentence earns its place with no redundancy or filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a moderate-complexity tool with no output schema, the description covers all essential aspects: what it does, prerequisites, failure modes, and return value. It references the relevant sibling tool for discovery, making it complete for an agent to select and invoke correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

While schema coverage is 100%, the schema descriptions are minimal. The description adds meaningful semantics for the 'key' parameter by directing users to list_deleted_rows to find valid keys. App_id and collection remain basic, but the added key guidance raises the value above the baseline 3.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource: 'Restore a soft-deleted row, undoing delete_row.' It clearly distinguishes the tool from siblings like delete_row and list_deleted_rows, and explains that it reverses a prior soft delete.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It provides explicit guidance by linking to list_deleted_rows for finding restorable keys, and implies the proper use case (restoring a soft-deleted row). The failure conditions for purge and conflict also implicitly tell the user when not to use it. This meets the standard for explicit alternatives and usage context.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

reviewCommunity ReviewsA
Destructive
Inspect

Ratings and reviews of community templates, responses from a template's own publisher, and, for relay operators, moderation. Actions: create leaves a 1-to-5 star rating and an optional written body on a template the caller has installed, identifying it by template ("/") or by handle plus slug, and requires a verified email; each install yields exactly one review, and the aggregate carries across template versions. A body containing a link or a contact email is held automatically for a moderator before it appears. respond replies to a review of the caller's own template line (review_id plus response, or null to clear it), with one editable response per review. report flags a review for the relay's moderators (review_id plus reason) and is deduped per account. remove and unhold are limited to the relay's configured community reviewers: remove takes a review down and adjusts the rating aggregate, and unhold publishes a previously held review into the aggregate.

ParametersJSON Schema
NameRequiredDescriptionDefault
bodyNocreate only. Optional written review (up to 2000 chars).
slugNocreate only. Per-publisher slug (with `handle`).
starsNocreate only. Star rating, an integer 1 to 5.
actionYescreate: leaves a star rating (1..5) and optional body on a community template the caller has installed (identified by `template` "<handle>/<slug>" or by `handle`+`slug`); requires a verified email, and one review per install. A body containing a link or contact email is auto-held for a moderator before it shows. respond: replies to a review of one of the caller's own templates (review_id + response; null clears it). report: flags a review for the relay's moderators (review_id + reason; one report per account). remove / unhold are relay-operator-only moderation actions on a review_id: remove takes a review down (adjusting the aggregate), unhold publishes a previously auto-held review.
handleNocreate only. Publisher handle (with `slug`), an alternative to `template`.
reasonNoreport only. Why you are reporting this review (up to 500 chars).
responseNorespond only. The publisher's public response (up to 2000 chars); null clears it.
templateNocreate only. The namespaced template id <handle>/<slug> to review.
review_idNoRequired for respond/report/remove/unhold. The review's id.
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description goes well beyond annotations, disclosing important behaviors such as auto-holding bodies containing links/contact emails, aggregate carry across template versions, one-review-per-install limit, deduplication of reports, and how remove adjusts the aggregate. These details are not present in annotations and meaningfully inform the agent about side effects and moderation flows.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single dense paragraph that front-loads the overall purpose before breaking down each action. It avoids filler, uses semicolons to pack related constraints efficiently, and every clause contributes unique information despite covering five actions in limited space.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity (5 actions, 9 parameters, no output schema), the description covers all necessary facets: action-specific targets, permission restrictions, side effects on aggregates, and moderation workflow. The annotations and schema are rich, but the description fills in behavioral context that is essential for correct invocation, making it complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, with each parameter already described in detail (e.g., 'create only', 'report only', null semantics for response). The description reinforces which parameters belong to which action but does not add new parameter-level meaning beyond what the schema already provides. Baseline 3 is appropriate given the schema's thoroughness.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly identifies the tool as managing community reviews with five distinct actions (create, respond, report, remove, unhold), each with a specific verb and resource. It distinguishes itself from sibling tools by explicitly covering ratings, publisher responses, and moderation, leaving no ambiguity about its scope.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides explicit context for each action, including prerequisites (e.g., caller has installed the template for create, own template for respond, relay-operator status for remove/unhold) and constraints (one review per install, deduplication for report). It does not explicitly name alternative tools or state when not to use this tool, but the action-level guidance is strong and actionable.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

tasteManage UI Taste NotesA
Destructive
Inspect

The agent's UI taste notes: a short freeform markdown document of presentation preferences gathered from human feedback, such as 'denser layout' or 'no rounded corners'. Reading it before generating or revising an app is what carries earlier feedback into new output. Actions: get returns the current document; set replaces it in whole, so it does not append; clear discards it. Scoped to presentation preferences rather than general storage.

ParametersJSON Schema
NameRequiredDescriptionDefault
tasteNoThe full markdown notes (required for set; whole-document replace, not append).
actionYesThe agent's freeform UI taste notes (markdown) — presentation preferences learned from human feedback. get: read them before generating an app. set: whole-document replace (taste, non-empty). clear: delete them.
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond annotations (destructiveHint=true), the description discloses that set replaces the whole document (not appends) and clear discards it, aligning with destructive behavior.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise, front-loaded with the purpose, and uses short sentences with no wasted words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With only two parameters and annotations present, the description fully explains actions and scope, leaving no gaps.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% and the description adds context that set requires a non-empty taste and performs whole-document replace, supplementing the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool manages UI taste notes with specific actions (get, set, clear). It distinguishes from sibling tools like 'agent' or 'apps' by emphasizing presentation preferences.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explains when to read (before generating/revising an app) and scopes usage to presentation preferences, but does not explicitly list when not to use or provide direct alternatives.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

update_rowUpdate RowA
Idempotent
Inspect

Update an existing row in a v2 app's collection, replacing its data. Gated by the collection's update role list when it declares one, and by its write list otherwise, so a collection that scopes updates to the row's creator refuses an edit on someone else's row. Pass if_match with the row's current version for an optimistic-locked update; on a version mismatch the relay returns the current row, which is what a retry needs. Returns { row }.

ParametersJSON Schema
NameRequiredDescriptionDefault
keyYesThe key of the row to update.
dataYesThe new row body (replaces the row's data) - any JSON value valid against the collection's row schema.
app_idYesThe app id.
if_matchNoOptional optimistic-lock version. On mismatch the update is rejected with the current row in details.current.
collectionYesThe collection name.
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Adds significant behavioral details beyond annotations: role-based access, optimistic locking with if_match, and retry behavior on version mismatch. No contradiction with annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Four sentences with no fluff. Purpose stated first, then authorization, then locking, then return. Every sentence earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Covers all necessary aspects: purpose, authorization, parameter semantics (via schema and description), and special behavior (optimistic locking). No output schema, but description adequately describes the return value as { row } and mismatch behavior.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema covers all 5 parameters (100% coverage). The description adds value by explaining the purpose of if_match (optimistic locking and retry flow) beyond the schema's minimal description.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the verb-resource pair: 'Update an existing row in a v2 app's collection, replacing its data.' It distinguishes from siblings like delete_row and upsert_row by focusing on updating existing rows.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides explicit context on authorization gating and optimistic locking behavior, but does not explicitly state when not to use this tool or name specific alternatives like upsert_row for create-or-update scenarios.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

upsert_rowUpsert RowAInspect

Create a row in a v2 app's collection, or return the existing row when key is already present (deduped:true). Row creation goes through this tool; there is no separate strict-create verb. Omit key to add a new row with a server-generated key, or pass key to ensure a row exists at that key. Passing key is also what makes a retry safe: a call unsure whether it already landed can repeat it and get the same row back rather than a duplicate. Without key, a retry mints a second row with its own server-generated key, since there is nothing to dedup against. The collection must be declared in the app's manifest with 'agent' in its write list, which is the list that gates creates. When key matches a row the collection's read list does not reach for this caller, the result is row_not_found rather than the row, matching what get_row would return, so this never reads past read. Returns { row, deduped? }.

ParametersJSON Schema
NameRequiredDescriptionDefault
keyNoOptional stable key. Reusing an existing key returns the existing row (deduped:true), or row_not_found when the collection's read list does not reach that row for the caller.
dataYesThe row body - any JSON value valid against the collection's row schema (an object, or any JSON value for a schemaless collection).
app_idYesThe app id.
collectionYesThe collection name.
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Even though annotations already mark readOnly=false and destructive=false, the description goes far beyond them. It discloses dedupe behavior, retry safety, the duplicate-row risk when `key` is omitted, the manifest `write` list requirement, the `row_not_found` behavior when the `read` list does not reach the row, and the return shape `{ row, deduped? }`. This is exemplary behavioral transparency.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is long but dense and well-structured. It front-loads the core purpose, then logically explains key semantics, retry behavior, permission requirements, and return shape. Every sentence contributes necessary behavioral or usage context without padding.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity and the absence of an output schema, the description is exceptionally complete. It covers prerequisites (manifest write list), edge cases (dedupe, retry, read-list limitations), and the return format. There are no significant gaps in what an agent needs to know to invoke this tool correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema already covers all four parameters with descriptions (100% coverage), so the baseline is 3. The description adds meaningful semantic detail beyond the schema, especially for `key`: omitting it creates a new row, passing it enables dedupe and retry safety. It also clarifies the `data` parameter as 'any JSON value valid against the collection's row schema'. This elevated value justifies a 4.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description begins with a specific verb+resource: 'Create a row in a v2 app's collection, or return the existing row when `key` is already present' – clearly stating its upsert behavior. It distinguishes itself from sibling tools like get_row, update_row, and delete_row by emphasizing the create-or-return semantics and deduplication.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives clear context for when to use this tool: 'Row creation goes through this tool; there is no separate strict-create verb.' It also explains the key distinction between omitting `key` (new row with server-generated key) and passing `key` (dedupe/retry safety), which guides usage. It does not explicitly contrast with update_row or list other exclusions, so it stops short of a perfect 5.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Discussions

No comments yet. Be the first to start the discussion!

Related MCP Servers

  • A
    license
    -
    quality
    B
    maintenance
    Enables coding agents to deploy applications to private, authenticated URLs with a guest list, so only specified users can access them without writing auth code.
    3
    MIT
  • A
    license
    -
    quality
    A
    maintenance
    Deploy and monetize agent-built apps from one MCP. Ship a full-stack app (login, database, usage billing) with one command, then charge the signed-in end user per API call via X-Settle-Payer (end-user-pays: cost times markup, app owner earns the markup).
    Apache 2.0
  • A
    license
    A
    quality
    D
    maintenance
    Agent-native hosting: your agent deploys any folder to a live URL in one command — no account, no dashboard, no CAPTCHA — and hands the human a link plus a plain-language summary. Full deploy lifecycle as MCP tools (deploy, verify, logs, inspect, rollback), production approval human-only; static sites and full Node.js apps, open source (Apache-2.0).
    13
    Apache 2.0
  • A
    license
    A
    quality
    B
    maintenance
    Enables AI agents to build, edit, and publish live websites with hosting, database, auth, and domains via the Model Context Protocol.
    13
    12
    1
    MIT

View all MCP Servers

Try in Browser

Your Connectors

Sign in to create a connector for this server.