Skip to main content
Glama
Sign In

Costory: Your Finops MCP

by io.costory.app-api
OverviewDiscussionsAdmin

get_object_permissions

Read-only

List direct Reader/Editor/Admin grants on a dashboard, report, budget, or cost alert. Use when the user asks who can view or edit a saved object. One tool for all four kinds — pass resourceKind plus the object id from search / get / create. Returns grants (person, team, organization, or organization admins), the caller's effective role, and capabilities (canView / canEdit / canManage). canManage is true only for Admin. Budget alerts use resourceKind "budget" and the parent budget id. Templates have no ordinary grants. Read-only. EXAMPLES: • "Who can open the AWS dashboard?" → { resourceKind: "dashboard", resourceId: "clx9aws" } • "What access do I have on this report?" → { resourceKind: "report", resourceId: "clx9rpt" }

Tool call template

Replace each placeholder with a value matching the input schema. Only required parameters are included; add optional parameters as needed.

{
  "id": 1,
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "arguments": {
      "resourceKind": "<resourceKind>",
      "resourceId": "<resourceId>",
      "context": "<context>"
    },
    "name": "get_object_permissions"
  }
}

Input Schema

NameRequiredDescriptionDefault
slugNoOrganization slug. Omit to auto-detect from your account (fails if you belong to multiple orgs).
contextYesA few words on why you are calling this tool, for the server developer's analytics. Describe people and things by role, such as "a customer". Do not quote the user or include names, emails, or other personal details.
llm_modelNoThe model identifier you are running as, for example "claude-opus-4-8" or "gpt-5.2". Pass "unknown" if you are not certain. Recorded for the server developer's analytics.
resourceIdYesObject id from search, get, or create.
resourceKindYesdashboard, report, budget, costAlert, or scout. Budget alerts use the parent budget.
conversation_idNoThe conversation_id this server returned earlier in this conversation, unchanged, including after later user messages. Omit it if you have none. Recorded for the server developer's analytics.

Schema Changelog

Changes observed during successful MCP inspections.

  1. Changed2 schema fields changed
    • changedInput schema / properties / context / description
      Previous value: -"Explain in 15-25 words, in third person, why this tool is called and how it supports the user's goal. For analytics only. You MUST describe only the abstract purpose of the tool call. NEVER include, repeat, paraphrase, or infer personal, sensitive, or identifying information from the user request or tool results, including names, emails, phone numbers, IPs, IDs, or credentials. You MUST generalize specific entities into roles such as \"a user\", \"the customer\", or \"an account\". Example: \"Retrieving a customer's recent orders to investigate a billing issue and help support determine the appropriate resolution.\""New value: +"A few words on why you are calling this tool, for the server developer's analytics. Describe people and things by role, such as \"a customer\". Do not quote the user or include names, emails, or other personal details."
    • changedInput schema / required
      Previous value: -[
-  "resourceKind",
-  "resourceId",
-  "context",
-  "llm_model"
-]New value: +[
+  "resourceKind",
+  "resourceId",
+  "context"
+]
  2. Changed4 schema fields changed
    • addedInput schema / properties / context
      Added value: +{
+  "description": "Explain in 15-25 words, in third person, why this tool is called and how it supports the user's goal. For analytics only. You MUST describe only the abstract purpose of the tool call. NEVER include, repeat, paraphrase, or infer personal, sensitive, or identifying information from the user request or tool results, including names, emails, phone numbers, IPs, IDs, or credentials. You MUST generalize specific entities into roles such as \"a user\", \"the customer\", or \"an account\". Example: \"Retrieving a customer's recent orders to investigate a billing issue and help support determine the appropriate resolution.\"",
+  "type": "string"
+}
    • addedInput schema / properties / conversation_id
      Added value: +{
+  "description": "The conversation_id this server returned earlier in this conversation, unchanged, including after later user messages. Omit it if you have none. Recorded for the server developer's analytics.",
+  "type": "string"
+}
    • addedInput schema / properties / llm_model
      Added value: +{
+  "description": "The model identifier you are running as, for example \"claude-opus-4-8\" or \"gpt-5.2\". Pass \"unknown\" if you are not certain. Recorded for the server developer's analytics.",
+  "type": "string"
+}
    • changedInput schema / required
      Previous value: -[
-  "resourceKind",
-  "resourceId"
-]New value: +[
+  "resourceKind",
+  "resourceId",
+  "context",
+  "llm_model"
+]
  3. Changed2 schema fields changed
    • changedInput schema / properties / resourceKind / description
      Previous value: -"dashboard, report, budget, or costAlert. Budget alerts use the parent budget."New value: +"dashboard, report, budget, costAlert, or scout. Budget alerts use the parent budget."
    • changedInput schema / properties / resourceKind / enum
      Previous value: -[
-  "dashboard",
-  "report",
-  "budget",
-  "costAlert"
-]New value: +[
+  "dashboard",
+  "report",
+  "budget",
+  "costAlert",
+  "scout"
+]
  4. Added

TDQS

A4.1/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The annotations already declare readOnlyHint=true and destructiveHint=false, and the description still adds real value: it enumerates the grantee types returned, states that both the caller's effective role and canView/canEdit/canManage capabilities come back, and defines canManage as Admin-only. That is substantive behavioral context beyond the safety profile; it does not mention rate limits or pagination, but the result set is small enough that this is minor.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The purpose and trigger are front-loaded, followed by return shape and caveats, then two concrete examples — good information ordering with no filler. The 'four kinds' claim against a five-value enum and the slightly dense single-paragraph body keep it from a 5.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema, the description carries the return-value burden and does so well by naming grantee types, effective role, and capabilities. For a six-parameter read tool with full schema coverage this is nearly complete; only the unexplained 'scout' resource kind and the required analytics parameters left unmentioned in prose remain gaps.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline is 3. The description reinforces that resourceId comes from search/get/create and that budget alerts use the parent budget id, but that same guidance already appears in the schema descriptions. It also says 'all four kinds' while the resourceKind enum lists five values including 'scout', which is never explained anywhere — a small semantic gap the description should have closed.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The opening sentence names a specific verb and resource ('List direct Reader/Editor/Admin grants'), the object types it applies to, and closes with 'Read-only', which clearly separates it from a mutating sibling such as set_object_permissions. An agent can tell what it does without opening the schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

'Use when the user asks who can view or edit a saved object' gives an explicit trigger condition, and 'Templates have no ordinary grants' plus the budget-alert note add exclusions. It stops short of naming a concrete alternative for setting permissions, so it is clear context rather than full when/when-not routing.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

All Costory: Your Finops MCP toolsInspect
Try in Browser
One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

Glama MCP Gateway

Add one secure layer between your agents and this server.

Resources