list_personasList the security personas of the active project — the identities the authorization scanners impersonate. Pass personaId to get a single one. Secret values in the auth config are always returned masked as '********'; the plain values never leave the server. Requires project context.
| Name | Required | Description | Default |
|---|---|---|---|
| personaId | No | Public Id (Guid) of a single persona. When given, only that persona is returned. |
Changes observed during successful MCP inspections. Dates show when Glama detected each change.
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description discloses an important behavioral aspect: secret values are always masked as '********' and plain values never leave the server. This complements the readOnlyHint annotation and sets clear expectations about data handling. No other side effects are implied, and the read-only nature is consistent.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is compact and free of redundancy. It covers the essence in two well-structured sentences without extraneous details, making it easy for an agent to quickly grasp the tool's function and usage.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's low complexity (one optional parameter, no output schema specified), the description sufficiently addresses what the tool does, how to use it, and a critical behavioral detail (masking of secrets). It also notes the required project context, covering all necessary operational aspects.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The single parameter personaId is already well-described in the schema ('Public Id (Guid) of a single persona. When given, only that persona is returned.'). The description reinforces this by saying 'Pass personaId to get a single one,' adding a slight emphasis on how the parameter filters results. Since the schema coverage is 100%, the baseline is 3, but the descriptive reinforcement earns a 4.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the primary action ('List'), the resource ('security personas of the active project'), and the scope ('active project'). It also explains what personas are ('identities the authorization scanners impersonate'), making the tool's purpose unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides practical usage guidance by explaining how to retrieve a single persona ('Pass personaId to get a single one') and notes the prerequisite of project context. It does not explicitly compare against sibling tools like test_persona, but the inclusion of the optional parameter behavior and context requirement offers sufficient direction.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Add one secure layer between your agents and this server.
The tools are mostly distinct with clear descriptions. Some pairs like get_header_policies vs get_resolved_headers or get_environment_verification vs get_monitoring_sync_status could be slightly confusing, but the descriptions clarify scope and purpose.
All tools follow a consistent snake_case verb_noun pattern (get_, list_, create_, update_, manage_, etc.). Even the few bare verbs like 'search' and 'set_context' are consistent with the naming scheme.
With 165 tools, the server is extremely heavy. This far exceeds the 'too many' threshold of 25+, making it difficult for an agent to navigate and select the right tool efficiently.
The tool surface covers a very broad API lifecycle domain: specs, environments, test cases, monitors, mock servers, security, governance, documentation, and team management. Read and write operations are present across most areas, with no obvious missing core functionality.