Skip to main content
Glama

The Bridge

by dev.thebridge
OverviewDiscussionsAdmin

Update App

update_app
Idempotent

Update app-level settings on the Bridge app. Only the fields you pass are changed: name (display name shown on the hosted auth pages and in emails), apiUrl (your backend's base URL), uiUrl (your frontend's base URL — used to build links in invitation and password-reset emails), webhookUrl (where Bridge POSTs platform events), defaultCallbackUri (the OAuth callback used when a login flow does not name one), allowedOrigins (CORS origins), tenantSelfSignup (whether a new user may create their own workspace instead of being invited) and paymentsAutoRedirect (force new users to pick a plan before entering the app — a billing paywall). WARNING: allowedOrigins REPLACES the entire list, so call get_app first and pass the existing origins plus the new one; the previous list is returned as previousAllowedOrigins so a mistake can be undone. Redirect URIs are NOT settable here — use add_redirect_uri / remove_redirect_uri, which preserve the rest of the list. Login methods are not settable here either — use update_auth_methods, or setup_sso for a provider with credentials. Token lifetimes: use update_password_policy. Before writing app code that consumes this, call get_integration_guide with topic=auth and the framework the app uses.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
appNoId of the Bridge app to act on for this call (see list_apps). Omit to use the current app.
nameNoApp display name.
uiUrlNoFrontend base URL, absolute http(s). Used to build email links.
apiUrlNoBackend base URL, absolute http(s).
webhookUrlNoAbsolute http(s) URL Bridge POSTs platform events to.
allowedOriginsNoCORS origins (scheme://host[:port]). REPLACES the whole list — include the existing origins from get_app, not just the new one.
tenantSelfSignupNoAllow users to create their own workspace instead of being invited.
defaultCallbackUriNoDefault OAuth callback URI, absolute http(s).
paymentsAutoRedirectNoForce new users to pick a plan before entering the app (billing paywall).

Schema Changelog

Changes observed during successful MCP inspections.

  1. First observed

TDQS

A4.6/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare the safety profile (readOnlyHint=false, destructiveHint=false, idempotentHint=true), so the bar is lower. The description still adds real context: the allowedOrigins list REPLACES rather than appends, and previousAllowedOrigins is returned so a mistake can be undone. This is exactly the kind of destructive-in-practice caveat the annotations don't convey.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded with the core action and merge semantics, then the warning, then the exclusion routing. Every sentence carries information, though the long parenthetical field glosses make it denser than strictly necessary.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 9-parameter, all-optional mutation tool with no output schema, the description covers merge behavior, the destructive replacement caveat, sibling routing, and even a return-value hint (previousAllowedOrigins). Nothing needed to call it correctly is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so baseline is 3. The description goes beyond the schema by explaining what each field affects (name appears on hosted auth pages and emails, uiUrl builds invitation/reset links, webhookUrl receives platform events, paymentsAutoRedirect is a billing paywall), adding intent the schema alone doesn't.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb (update) and resource (app-level settings on the Bridge app) and enumerates exactly which fields are settable. It also distinguishes itself from siblings by declaring what is NOT handled here (redirect URIs, login methods, token lifetimes) and naming the tools that are.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly states the merge semantics ('Only the fields you pass are changed') and routes each excluded concern to the right alternative: add_redirect_uri/remove_redirect_uri, update_auth_methods, setup_sso, update_password_policy. It even names the get_app prerequisite and get_integration_guide for downstream code.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

All The Bridge toolsInspect
Try in Browser
One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

Glama MCP Gateway

Add one secure layer between your agents and this server.

Resources