Skip to main content
Glama

revoke_agent_api_key

Revoke an API key

Revokes one lasoak_ API key, the same action as Revoke on the dashboard. A revoked key can no longer be exchanged for a session at agentAuth, and its MCP event subscriptions stop. A session already minted from the key is not cut off: its id_token lasts out its hour. Revoking a key that is already revoked succeeds and changes nothing.

To revoke a key you hold the raw value of, you can instead POST it as token to /oauth/revoke (RFC 7009) without looking up its keyId.

Free.

Input Schema

NameRequiredDescriptionDefault
keyIdYesThe key's id, as returned by `createAgentApiKey` or `listAgentApiKeys`.

Output Schema

NameRequiredDescriptionDefault

No arguments

Schema Changelog

Changes observed during successful MCP inspections.

  1. Added

TDQS

A4.6/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations only supply the boolean profile (readOnly=false, destructive=false, idempotent=false); the description goes well beyond them by stating the blast radius: the key can no longer be exchanged at `agentAuth`, its MCP event subscriptions stop, but an already-minted session lives out its `id_token` hour. It also discloses that re-revoking an already-revoked key succeeds as a no-op and that the call is free, which is exactly the operational context an agent needs before mutating state.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is front-loaded with the action and effects, and nearly every sentence carries distinct information (equivalence, effects, session survival, idempotence, alternative, cost). The heading-plus-first-sentence repetition of 'Revoke an API key' and the RFC citation are mild padding, keeping it just short of a 5.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a single-parameter mutation with an output schema present, everything the agent needs is covered: what is revoked, what stops, what survives, what happens on repeat calls, and the alternative endpoint. Return-value details are correctly left to the declared output schema.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% and the single `keyId` parameter is fully documented in the schema, including its source (`createAgentApiKey` / `listAgentApiKeys`) and an example value. The description adds no format or syntax detail beyond that (it only implies which identifier the alternative path avoids), so the baseline 3 is correct.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource ('Revoke an API key') and immediately disambiguates it from the create/list key siblings by naming the `lasoak_` key format and equating the action to the dashboard's Revoke. An agent can place it precisely among create_agent_api_key, list_agent_api_keys, and exchange_api_key.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It explicitly routes the agent: use this tool with a `keyId`, or POST the raw token to `/oauth/revoke` (RFC 7009) if you already hold the value and don't want to look up its id. That is a concrete when-to-use-this-vs-alternative condition rather than vague context.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Try in Browser

Glama MCP Gateway

Add one secure layer between your agents and this server.

Resources