Skip to main content
Glama

Agent Verifier

by guru.packet
OverviewDiscussionsAdmin

Check my own Web Bot Auth setup

self_check_web_bot_auth
Read-onlyIdempotent

Reports how the request carrying this call looks from the outside: whether its Web Bot Auth (RFC 9421) signature verified, what the key directory it named publishes, the exact fault if there is one and the sentence saying what to change, plus plain facts about the address it arrived from. Sign the call the way you sign requests to anyone else. Free, anonymous, no account. Takes no arguments: an unsigned call still gets an answer about its address.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault

No arguments

Output Schema

TableJSON Schema
NameRequiredDescriptionDefault
idNoIdentifier for this verdict, safe to quote in a support request.
ipNoPlain facts about your own address: network, operator, reputation of the address itself.
geoNoCountry, region, city and timezone of your address.
metaNoEnvelope: API version, how long the answer took, and the sources that contributed.
modeNoYou called this endpoint yourself, so the answer describes your own request.
signalsNo
successNoAlways true on a 200. Errors carry success:false and an error object.
identityNoWho you were established to be, and on what evidence. Empty of judgement: the outcome of checking a signature you sent against a directory you published.

Schema Changelog

Changes observed during successful MCP inspections.

  1. Changed6 schema fields changed
    • changedOutput schema / properties / identity / properties / method / description
      Previous value: -"How the name was established: `signature` when your own signature verified, `range` when your address sat in a list its operator publishes."New value: +"How the name was established: signature when your own signature verified, ip-range when your address sat in a list its operator publishes."
    • changedOutput schema / properties / identity / properties / trusted / description
      Previous value: -"Whether the established name is one this verifier holds a trust anchor for. A verified signature from a domain nobody knows is a verified signature from a domain nobody knows."New value: +"Whether the established name is one this verifier holds a trust anchor for. A verified signature from an unknown domain still says who sent the request, and false here says that nothing more is known about that domain."
    • changedOutput schema / properties / meta / description
      Previous value: -"Envelope: API version, how long the verdict took, which axes contributed."New value: +"Envelope: API version, how long the answer took, and the sources that contributed."
    • changedOutput schema / properties / meta / properties / apiVersion / description
      Previous value: -"Version of this API. `v1` today."New value: +"Version of this API, such as v1."
    • changedOutput schema / properties / meta / properties / axes / description
      Previous value: -"Which sources contributed to this answer. An axis absent here contributed nothing, which is why a field can be missing without anything being wrong."New value: +"Sources that contributed to this answer, such as ip, knownBot and webBotAuth. A field can be missing without anything being wrong: its source did not contribute."
    • changedOutput schema / properties / signals / properties / agent / properties / knownBot / description
      Previous value: -"The second, independent check, and the one that has nothing to do with your signature: some operators publish the address ranges their crawlers use, and those lists are refreshed regularly. matched means the address this request came from is inside such a published range. none is the ordinary answer and is not a fault: it means no operator publishes a list containing this address, which is true of every address that is not a large crawler, and true of most agents."New value: +"A second check, independent of the signature. Some operators publish the address ranges their crawlers use, and those lists are refreshed regularly. matched means the address this request came from is inside such a range. none is the usual answer and not a fault: no operator publishes a list containing this address, which holds for most agents and for every address that is not a large crawler."
  2. Changed1 schema field changed
    • changedOutput schema / properties / signals / properties / agent / properties / knownBot / description
      Previous value: -"The second, independent check, and the one that has nothing to do with your signature: some operators publish the address ranges their crawlers use, and those lists are read here nightly. matched means the address this request came from is inside such a published range. none is the ordinary answer and is not a fault: it means no operator publishes a list containing this address, which is true of every address that is not a large crawler, and true of most agents."New value: +"The second, independent check, and the one that has nothing to do with your signature: some operators publish the address ranges their crawlers use, and those lists are refreshed regularly. matched means the address this request came from is inside such a published range. none is the ordinary answer and is not a fault: it means no operator publishes a list containing this address, which is true of every address that is not a large crawler, and true of most agents."
  3. First observed

TDQS

A4.3/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnly, idempotent, non-destructive and closed-world, but the description adds real context: it is free, anonymous, requires no account, and produces a useful answer even when unsigned. It does not cover rate limits or whether the signature/address is retained, but the safety and auth profile is well disclosed.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loads the purpose in the first clause and then enumerates what is returned and how to invoke it. The result enumeration is dense and slightly redundant given an output schema exists, but every sentence carries information and none is filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a zero-argument diagnostic whose output schema exists, the description covers invocation, auth expectations, and the shape of the answer. Re-listing return fields is mildly redundant with the output schema, but nothing an agent needs to call it correctly is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Zero parameters, so the baseline is 4; the description reinforces this by stating 'Takes no arguments' and explaining that an unsigned call is still valid. Nothing further is needed for an empty schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Names a precise verb and resource: it reports how the calling request looks from outside, specifically whether its RFC 9421 Web Bot Auth signature verified and what the named key directory publishes. An agent can tell exactly what this tool does without opening the schema, and no sibling tools exist to confuse it with.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

States the invocation context explicitly ('Sign the call the way you sign requests to anyone else') and clarifies that an unsigned call still returns address information, so an agent knows it can call this both with and without a signature. No exclusions or alternatives are needed since there are no sibling tools.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

All Agent Verifier toolsInspect
Try in Browser
One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

Glama MCP Gateway

Add one secure layer between your agents and this server.

Resources