Skip to main content
Glama
Sign In

Costory: Your Finops MCP

by io.costory.app-api
OverviewDiscussionsAdmin

set_object_permissions

Destructive

Replace the full grant list on a dashboard, report, budget, or cost alert. Use when the user asks to change who can view or edit a saved object. One tool for all four kinds — pass resourceKind, the object id, and the complete intended grants array. Omitted principals lose access. Roles are READER, EDITOR, or ADMIN. ORGANIZATION may be Reader or Editor, never Admin. CLERK_ADMIN may use any role and applies only to Clerk organization admins; omit it for No access. Every replacement must retain at least one USER, TEAM, or CLERK_ADMIN Admin grant, so empty grants[] is invalid. Call get_object_permissions first, then send the full list including grants you want to keep. New creates start as creator-only Admin and do not include CLERK_ADMIN. Do not use PRIVATE/PUBLIC or teamId on create/update tools. Resolve people with list_users (userId) and teams with list_teams (teamId) — both list the full organization, not only membership. EXAMPLES: • "Share the AWS dashboard read-only with the whole org" (keep yourself as Admin) → { resourceKind: "dashboard", resourceId: "clx9aws", grants: [{ principalType: "USER", userId: "", role: "ADMIN" }, { principalType: "ORGANIZATION", role: "READER" }] } • "Give the infra team Editor on this budget" (keep yourself as Admin) → { resourceKind: "budget", resourceId: "clx9bud", grants: [{ principalType: "USER", userId: "", role: "ADMIN" }, { principalType: "TEAM", teamId: "team_xyz", role: "EDITOR" }] }

Tool call template

Replace each placeholder with a value matching the input schema. Only required parameters are included; add optional parameters as needed.

{
  "id": 1,
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "arguments": {
      "resourceKind": "<resourceKind>",
      "resourceId": "<resourceId>",
      "grants": "<grants>",
      "context": "<context>"
    },
    "name": "set_object_permissions"
  }
}

Input Schema

NameRequiredDescriptionDefault
slugNoOrganization slug. Omit to auto-detect from your account (fails if you belong to multiple orgs).
grantsYesFull replacement of direct grants. Omitted principals lose access. Every object must retain a USER, TEAM, or CLERK_ADMIN Admin grant. Each principal may appear once.
contextYesA few words on why you are calling this tool, for the server developer's analytics. Describe people and things by role, such as "a customer". Do not quote the user or include names, emails, or other personal details.
llm_modelNoThe model identifier you are running as, for example "claude-opus-4-8" or "gpt-5.2". Pass "unknown" if you are not certain. Recorded for the server developer's analytics.
resourceIdYesObject id from search, get, or create.
resourceKindYesdashboard, report, budget, costAlert, or scout. Budget alerts use the parent budget.
conversation_idNoThe conversation_id this server returned earlier in this conversation, unchanged, including after later user messages. Omit it if you have none. Recorded for the server developer's analytics.

Schema Changelog

Changes observed during successful MCP inspections.

  1. Changed2 schema fields changed
    • changedInput schema / properties / context / description
      Previous value: -"Explain in 15-25 words, in third person, why this tool is called and how it supports the user's goal. For analytics only. You MUST describe only the abstract purpose of the tool call. NEVER include, repeat, paraphrase, or infer personal, sensitive, or identifying information from the user request or tool results, including names, emails, phone numbers, IPs, IDs, or credentials. You MUST generalize specific entities into roles such as \"a user\", \"the customer\", or \"an account\". Example: \"Retrieving a customer's recent orders to investigate a billing issue and help support determine the appropriate resolution.\""New value: +"A few words on why you are calling this tool, for the server developer's analytics. Describe people and things by role, such as \"a customer\". Do not quote the user or include names, emails, or other personal details."
    • changedInput schema / required
      Previous value: -[
-  "resourceKind",
-  "resourceId",
-  "grants",
-  "context",
-  "llm_model"
-]New value: +[
+  "resourceKind",
+  "resourceId",
+  "grants",
+  "context"
+]
  2. Changed4 schema fields changed
    • addedInput schema / properties / context
      Added value: +{
+  "description": "Explain in 15-25 words, in third person, why this tool is called and how it supports the user's goal. For analytics only. You MUST describe only the abstract purpose of the tool call. NEVER include, repeat, paraphrase, or infer personal, sensitive, or identifying information from the user request or tool results, including names, emails, phone numbers, IPs, IDs, or credentials. You MUST generalize specific entities into roles such as \"a user\", \"the customer\", or \"an account\". Example: \"Retrieving a customer's recent orders to investigate a billing issue and help support determine the appropriate resolution.\"",
+  "type": "string"
+}
    • addedInput schema / properties / conversation_id
      Added value: +{
+  "description": "The conversation_id this server returned earlier in this conversation, unchanged, including after later user messages. Omit it if you have none. Recorded for the server developer's analytics.",
+  "type": "string"
+}
    • addedInput schema / properties / llm_model
      Added value: +{
+  "description": "The model identifier you are running as, for example \"claude-opus-4-8\" or \"gpt-5.2\". Pass \"unknown\" if you are not certain. Recorded for the server developer's analytics.",
+  "type": "string"
+}
    • changedInput schema / required
      Previous value: -[
-  "resourceKind",
-  "resourceId",
-  "grants"
-]New value: +[
+  "resourceKind",
+  "resourceId",
+  "grants",
+  "context",
+  "llm_model"
+]
  3. Changed2 schema fields changed
    • changedInput schema / properties / resourceKind / description
      Previous value: -"dashboard, report, budget, or costAlert. Budget alerts use the parent budget."New value: +"dashboard, report, budget, costAlert, or scout. Budget alerts use the parent budget."
    • changedInput schema / properties / resourceKind / enum
      Previous value: -[
-  "dashboard",
-  "report",
-  "budget",
-  "costAlert"
-]New value: +[
+  "dashboard",
+  "report",
+  "budget",
+  "costAlert",
+  "scout"
+]
  4. Added

TDQS

A4.7/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare destructiveHint=true, but the description goes well beyond that by naming the destruction semantics ('Omitted principals lose access'), the invariant that at least one USER/TEAM/CLERK_ADMIN Admin grant must survive, that empty grants[] is invalid, role-specific rules for ORGANIZATION and CLERK_ADMIN, and default behavior on create. These are exactly the failure modes an agent would otherwise hit blind.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded with the core action and constraint before roles, invariants, and examples; the worked examples clarify the 'keep yourself as Admin' pattern that the invariant implies. Slightly long and the role/ORGANIZATION rules could be tightened, but nearly every sentence carries operational weight.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

A destructive, invariant-laden mutation tool with no output schema gets solid coverage: preconditions, retention rule, invalid inputs, and identifier resolution are all present. Gaps remain on the `scout` resourceKind and on atomicity/error behavior if the replacement is rejected, so it falls short of fully complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With 100% schema description coverage the baseline is 3, and the description adds real meaning on top: it explains the replacement semantics of `grants`, the valid roles, and when to omit CLERK_ADMIN. Minor deduction because it says 'one tool for all four kinds' while the schema enum contains five values including `scout`, leaving the scout case unexplained.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('Replace the full grant list') plus the object types it covers, and distinguishes itself from the read counterpart by instructing the agent to call get_object_permissions first. An agent can tell immediately this is the write-side permission tool, not the inspection tool.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicit trigger ('Use when the user asks to change who can view or edit a saved object'), explicit prerequisite (call get_object_permissions first and resend retained grants), and explicit exclusions ('Do not use PRIVATE/PUBLIC or teamId on create/update tools'). It also routes to sibling helpers (list_users for userId, list_teams for teamId), so the agent knows what to do when it lacks identifiers.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

All Costory: Your Finops MCP toolsInspect
Try in Browser
One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

Glama MCP Gateway

Add one secure layer between your agents and this server.

Resources