Control Plane

Set TLS on a Domain Listener

set_domain_tls

DestructiveIdempotent

Set or replace the TLS block on a port listener (cipher suites, minimum protocol version). Provide the complete TLS shape; existing TLS settings on this listener are overwritten.

Input Schema

TableJSON Schema

Name	Required	Description
`org`	No	Organization slug.
`tls`	Yes	TLS configuration for the listener (cipher suites, min protocol, and optional custom server/client certificates).
`domain`	Yes	Fully qualified domain name.
`portNumber`	Yes	Existing listener port number to target.

Output Schema

TableJSON Schema

Name	Required	Description
`ok`	Yes
`data`	No	The full result. Read this, not only the summary.
`details`	No
`summary`	Yes
`nextSteps`	No

Schema Changelog

Changes observed during successful MCP inspections.

Changed20 schema fields changedSep 30, 2026
- removedInput schema / $schema
```
Removed value: -"http://json-schema.org/draft-07/schema#"
```
- removedInput schema / additionalProperties
```
Removed value: -false
```
- removedInput schema / properties / domain / minLength
```
Removed value: -1
```
- changedInput schema / properties / org / description
```
Previous value: -"Organization slug (lowercase kebab-case). NEVER guess — if the user has not named one, ask. On org-not-found, stop and ask; do not retry variants."New value: +"Organization slug."
```
- removedInput schema / properties / org / maxLength
```
Removed value: -63
```
- removedInput schema / properties / org / minLength
```
Removed value: -1
```
- removedInput schema / properties / org / pattern
```
Removed value: -"^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$"
```
- removedInput schema / properties / tls / additionalProperties
```
Removed value: -false
```
- removedInput schema / properties / tls / properties / clientCertificate / additionalProperties
```
Removed value: -false
```
- removedInput schema / properties / tls / properties / clientCertificate / properties / secretLink / minLength
```
Removed value: -1
```
- removedInput schema / properties / tls / properties / serverCertificate / additionalProperties
```
Removed value: -false
```
- removedInput schema / properties / tls / properties / serverCertificate / properties / secretLink / minLength
```
Removed value: -1
```
- changedInput schema / required
```
Previous value: -[
-  "org",
-  "domain",
-  "portNumber",
-  "tls"
-]New value: +[
+  "domain",
+  "portNumber",
+  "tls"
+]
```
- removedOutput schema / $schema
```
Removed value: -"http://json-schema.org/draft-07/schema#"
```
- removedOutput schema / additionalProperties
```
Removed value: -false
```
- changedOutput schema / properties / data / description
```
Previous value: -"The full machine-readable result — list rows, the resource object, query results. Read THIS, not just the summary."New value: +"The full result. Read this, not only the summary."
```
- addedOutput schema / properties / details
```
Added value: +{
+  "type": "string"
+}
```
- removedOutput schema / properties / nextSteps / description
```
Removed value: -"Recommended follow-up actions for this task, in order."
```
- removedOutput schema / properties / ok / description
```
Removed value: -"Whether the call succeeded."
```
- removedOutput schema / properties / summary / description
```
Removed value: -"One-line summary of the result."
```
First observedJun 28, 2026

TDQS

A3.8/5.0

Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare destructiveHint=true, idempotentHint=true, and openWorldHint=true, so the safety profile is covered. The description nonetheless adds real value by spelling out the overwrite behavior ('existing TLS settings on this listener are overwritten'), which explains what specifically gets destroyed. It adds no auth/secret-resolution context for the nested certificate secretLinks.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, zero padding, with the operation and the destructive overwrite caveat front-loaded. Every clause earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

A nested-object mutation tool with an output schema, so return values need not be described. Annotations plus the overwrite note give an agent enough to call it safely. Minor gap: no explicit relationship to clear_domain_tls or guidance on how certificate secretLinks are resolved.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema fully documents domain, portNumber, tls, and the nested cipherSuites/minProtocolVersion/serverCertificate/clientCertificate fields. The description only echoes the cipher-suite and min-protocol facets and adds no format or constraint detail beyond the schema, so the baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource: 'Set or replace the TLS block on a port listener,' and specifies the TLS facets (cipher suites, minimum protocol version). It is clearly a TLS-mutating operation, but it never differentiates itself from the sibling clear_domain_tls, so an agent must infer the routing between the two.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The clause 'Provide the complete TLS shape; existing TLS settings on this listener are overwritten' gives an actionable precondition about full replacement. However, there is no explicit when-to-use guidance versus clear_domain_tls or update_domain, so usage is only implied.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

All Control Plane tools Inspect

Try in Browser

One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

Glama MCP Gateway

Add one secure layer between your agents and this server.