Skip to main content
Glama
Sign In

Proof Holdings

by holdings.proof
OverviewDiscussionsAdmin

revoke_api_key

Destructive

Revoke an API key by ID. The key will immediately stop working. This action cannot be undone.

Agent usage: This operation requires 2FA. Before calling, complete the 2FA flow: (1) call start_2fa with action_type "api_key_revoke", (2) wait for user to verify the code, (3) poll get_2fa_status until "verified", (4) then call revoke_api_key.

ACCESS: needs a Proof account. Authenticate this client (Claude Code: /mcp → Authenticate), or sign in with start_login — a session opens this tool — then call this tool again.

Tool call template

Replace each placeholder with a value matching the input schema. Only required parameters are included; add optional parameters as needed.

{
  "id": 1,
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "arguments": {
      "id": "<id>"
    },
    "name": "revoke_api_key"
  }
}

Input Schema

NameRequiredDescriptionDefault
idYesAPI key ID to revoke

Output Schema

NameRequiredDescriptionDefault
messageNo
successYes

Schema Changelog

Changes observed during successful MCP inspections.

  1. Changed1 schema field changed
    • changedOutput schema / (root)
      Previous value: -nullNew value: +{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "additionalProperties": {},
+  "description": "Generic success response",
+  "properties": {
+    "message": {
+      "type": "string"
+    },
+    "success": {
+      "type": "boolean"
+    }
+  },
+  "required": [
+    "success"
+  ],
+  "type": "object"
+}
  2. Changed1 schema field changed
    • removedInput schema / additionalProperties
      Removed value: -false
  3. First observed

TDQS

A4.4/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare destructiveHint=true and readOnlyHint=false; the description adds material context beyond them — the effect takes hold immediately, the action is irreversible, 2FA is required, and authentication via start_login opens a session. This is the behavioral detail an agent needs before invoking a destructive op.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loads effect and irreversibility in the first two sentences, then separates the 2FA sequence and access note into labeled sections. The ACCESS block is slightly long and partly boilerplate, but every element maps to a real prerequisite for this call.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a destructive single-parameter call, the description covers effect, irreversibility, the required 2FA sequence with concrete sibling tools, and the authentication prerequisite. An output schema exists, so return values need no prose.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Only one parameter, and schema description coverage is 100% ("API key ID to revoke"). The description's "by ID" matches the schema without adding format, source, or how to obtain the ID (e.g., from list_api_keys), so baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ("Revoke an API key by ID") and immediately conveys the effect (key stops working, irreversible). The distinctness from siblings like create_api_key, regenerate_api_key, and list_api_keys is inferable from the verb, but no sibling is named explicitly.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives an explicit pre-call workflow: call start_2fa with action_type "api_key_revoke", wait for user verification, poll get_2fa_status until "verified", then call this tool. It names the exact sibling tools and the ordering constraint, leaving nothing to inference.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

All Proof Holdings toolsInspect
Try in Browser
One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

Glama MCP Gateway

Add one secure layer between your agents and this server.

Resources