Fast.io

auth

Destructive

Auth & sessions: signin, signup, signout, 2FA, PKCE, API keys, OAuth sessions. Call action='describe' for the full action/param reference. Destructive: api-key-delete, oauth-revoke, oauth-revoke-all.

Input Schema

TableJSON Schema

Name	Required	Description
`code`	No	Verification or authorization code. Meaning is action-specific — see action='describe' for the per-action reference (e.g. 2FA code for 2fa-verify, reset code for password-reset, OAuth code for pkce-complete).
`name`	No	API key label.
`admin`	No	pkce-login only. Request the admin access mode (`rwa`) as a CEILING on the consent screen. Default false. A ceiling is not a grant: the human must still tick the toggle, and the granted set is whatever `auth action=scopes` reports afterwards.
`email`	No	Email address.
`token`	No	2FA / verification token. Meaning is action-specific — see action='describe' for the per-action reference (e.g. 2FA-disable token, 2fa-verify-setup token, 2FA token for api-key-create/api-key-delete).
`action`	Yes	Operation. Use 'describe' for full action reference.
`key_id`	No	API key identifier.
`scopes`	No	Scope strings "entity:id:mode" with mode r \| rw \| rwa (rwa = read-write + admin access mode; a implies rw), e.g. ["org:123:rwa", "userdetails::rw", "user::r"]. api-key-create/update: omit for full access. oauth-update: REQUIRED and must be narrower-or-equal; an empty list is refused — use oauth-revoke instead.
`api_key`	No	Fastio API key.
`channel`	No	2FA channel.
`expires`	No	Token lifetime in seconds.
`password`	No	Account password.
`last_name`	No	Family name.
`password1`	No	New password.
`password2`	No	New password confirmation.
`agent_name`	No	Agent name for the approval screen and audit logs. If omitted on pkce-login this DEFAULTS to the MCP client's self-reported name (clientInfo.name from initialize), which is caller-supplied and NOT platform-verified — a human approves it on the consent screen, but it is not a vouched vendor. Pass it explicitly to control what is recorded.
`first_name`	No	Given name.
`scope_type`	No	PKCE scope type. Default 'user' (full access).
`session_id`	No	OAuth session identifier.
`email_token`	No	Email verification code.
`key_expires`	No	ISO 8601 expiration datetime.
`describe_action`	No	When action='describe', narrow the output to ONE action's full params/notes (e.g. 'status'). Omit to get the compact action index.
`exclude_current`	No	Skip current session in revoke-all.
`account_settings`	No	pkce-login only. Request the account-settings scope (`userdetails:*:rw`, gating password/email changes, 2FA enrolment and sign-out-all) as a CEILING on the consent screen. Default false. A ceiling is not a grant: the human must still tick the toggle, and the granted set is whatever `auth action=scopes` reports afterwards.
`current_session_id`	No	Current session ID for exclusion.

Schema Changelog

Changes observed during successful MCP inspections.

Changed4 schema fields changedSep 9, 2026

addedInput schema / properties / account_settings

Added value: +{
+  "description": "pkce-login only. Request the account-settings scope (`userdetails:*:rw`, gating password/email changes, 2FA enrolment and sign-out-all) as a CEILING on the consent screen. Default false. A ceiling is not a grant: the human must still tick the toggle, and the granted set is whatever `auth action=scopes` reports afterwards.",
+  "type": "boolean"
+}

changedInput schema / properties / action / enum

Previous value: -[
-  "describe",
-  "signin",
-  "signout",
-  "signup",
-  "check",
-  "session",
-  "status",
-  "scopes",
-  "set-api-key",
-  "email-check",
-  "email-verify",
-  "password-reset-request",
-  "password-reset",
-  "2fa-verify",
-  "2fa-status",
-  "2fa-enable",
-  "2fa-disable",
-  "2fa-send",
-  "2fa-verify-setup",
-  "pkce-login",
-  "pkce-complete",
-  "api-key-create",
-  "api-key-list",
-  "api-key-get",
-  "api-key-update",
-  "api-key-delete",
-  "oauth-list",
-  "oauth-details",
-  "oauth-revoke",
-  "oauth-revoke-all"
-]New value: +[
+  "describe",
+  "signin",
+  "signout",
+  "signup",
+  "check",
+  "session",
+  "status",
+  "scopes",
+  "set-api-key",
+  "email-check",
+  "email-verify",
+  "password-reset-request",
+  "password-reset",
+  "2fa-verify",
+  "2fa-status",
+  "2fa-enable",
+  "2fa-disable",
+  "2fa-send",
+  "2fa-verify-setup",
+  "pkce-login",
+  "pkce-complete",
+  "api-key-create",
+  "api-key-list",
+  "api-key-get",
+  "api-key-update",
+  "api-key-delete",
+  "oauth-list",
+  "oauth-details",
+  "oauth-update",
+  "oauth-revoke",
+  "oauth-revoke-all"
+]

addedInput schema / properties / admin

Added value: +{
+  "description": "pkce-login only. Request the admin access mode (`rwa`) as a CEILING on the consent screen. Default false. A ceiling is not a grant: the human must still tick the toggle, and the granted set is whatever `auth action=scopes` reports afterwards.",
+  "type": "boolean"
+}

changedInput schema / properties / scopes / description

Previous value: -"Scope strings, e.g. ['org:123:rw']. Omit for full access."New value: +"Scope strings \"entity:id:mode\" with mode r | rw | rwa (rwa = read-write + admin access mode; a implies rw), e.g. [\"org:123:rwa\", \"userdetails:*:rw\", \"user:*:r\"]. api-key-create/update: omit for full access. oauth-update: REQUIRED and must be narrower-or-equal; an empty list is refused — use oauth-revoke instead."

Changed1 schema field changedAug 30, 2026

changedInput schema / properties / agent_name / description

Previous value: -"Agent name for approval screen and audit logs."New value: +"Agent name for the approval screen and audit logs. If omitted on pkce-login this DEFAULTS to the MCP client's self-reported name (clientInfo.name from initialize), which is caller-supplied and NOT platform-verified — a human approves it on the consent screen, but it is not a vouched vendor. Pass it explicitly to control what is recorded."

Changed2 schema fields changedAug 6, 2026

changedInput schema / properties / code / description

Previous value: -"Verification or authorization code. Meaning is action-specific — see action='describe' for the per-action reference (e.g. 2FA code for 2fa-verify, reset code…"New value: +"Verification or authorization code. Meaning is action-specific — see action='describe' for the per-action reference (e.g. 2FA code for 2fa-verify, reset code for password-reset, OAuth code for pkce-complete)."

changedInput schema / properties / token / description

Previous value: -"2FA / verification token. Meaning is action-specific — see action='describe' for the per-action reference (e.g. 2FA-disable token, 2fa-verify-setup token, 2FA…"New value: +"2FA / verification token. Meaning is action-specific — see action='describe' for the per-action reference (e.g. 2FA-disable token, 2fa-verify-setup token, 2FA token for api-key-create/api-key-delete)."

Changed5 schema fields changedJun 26, 2026

changedInput schema / properties / action / enum

Previous value: -[
-  "describe",
-  "signin",
-  "signout",
-  "signup",
-  "check",
-  "session",
-  "status",
-  "set-api-key",
-  "email-check",
-  "email-verify",
-  "password-reset-request",
-  "password-reset",
-  "2fa-verify",
-  "2fa-status",
-  "2fa-enable",
-  "2fa-disable",
-  "2fa-send",
-  "2fa-verify-setup",
-  "pkce-login",
-  "pkce-complete",
-  "api-key-create",
-  "api-key-list",
-  "api-key-get",
-  "api-key-update",
-  "api-key-delete",
-  "oauth-list",
-  "oauth-details",
-  "oauth-revoke",
-  "oauth-revoke-all"
-]New value: +[
+  "describe",
+  "signin",
+  "signout",
+  "signup",
+  "check",
+  "session",
+  "status",
+  "scopes",
+  "set-api-key",
+  "email-check",
+  "email-verify",
+  "password-reset-request",
+  "password-reset",
+  "2fa-verify",
+  "2fa-status",
+  "2fa-enable",
+  "2fa-disable",
+  "2fa-send",
+  "2fa-verify-setup",
+  "pkce-login",
+  "pkce-complete",
+  "api-key-create",
+  "api-key-list",
+  "api-key-get",
+  "api-key-update",
+  "api-key-delete",
+  "oauth-list",
+  "oauth-details",
+  "oauth-revoke",
+  "oauth-revoke-all"
+]

changedInput schema / properties / api_key / description

Previous value: -"Fast.io API key."New value: +"Fastio API key."

changedInput schema / properties / code / description

Previous value: -"Verification or authorization code."New value: +"Verification or authorization code. Meaning is action-specific — see action='describe' for the per-action reference (e.g. 2FA code for 2fa-verify, reset code…"

addedInput schema / properties / describe_action

Added value: +{
+  "description": "When action='describe', narrow the output to ONE action's full params/notes (e.g. 'status'). Omit to get the compact action index.",
+  "type": "string"
+}

changedInput schema / properties / token / description

Previous value: -"2FA token or verification token."New value: +"2FA / verification token. Meaning is action-specific — see action='describe' for the per-action reference (e.g. 2FA-disable token, 2fa-verify-setup token, 2FA…"

Changed4 schema fields changedMay 22, 2026

removedInput schema / properties / expires / anyOf

Removed value: -[
-  {
-    "maximum": 9007199254740991,
-    "minimum": 1,
-    "type": "integer"
-  },
-  {
-    "pattern": "^-?\\d+$",
-    "type": "string"
-  }
-]

addedInput schema / properties / expires / maximum
```
Added value: +9007199254740991
```
addedInput schema / properties / expires / minimum
```
Added value: +1
```
addedInput schema / properties / expires / type
```
Added value: +"integer"
```

Changed27 schema fields changedMay 5, 2026

changedInput schema / properties / action / description

Previous value: -"Operation to perform"New value: +"Operation. Use 'describe' for full action reference."

changedInput schema / properties / action / enum

Previous value: -[
-  "signin",
-  "signout",
-  "signup",
-  "check",
-  "session",
-  "status",
-  "set-api-key",
-  "email-check",
-  "email-verify",
-  "password-reset-request",
-  "password-reset",
-  "2fa-verify",
-  "2fa-status",
-  "2fa-enable",
-  "2fa-disable",
-  "2fa-send",
-  "2fa-verify-setup",
-  "pkce-login",
-  "pkce-complete",
-  "api-key-create",
-  "api-key-list",
-  "api-key-get",
-  "api-key-update",
-  "api-key-delete",
-  "oauth-list",
-  "oauth-details",
-  "oauth-revoke",
-  "oauth-revoke-all"
-]New value: +[
+  "describe",
+  "signin",
+  "signout",
+  "signup",
+  "check",
+  "session",
+  "status",
+  "set-api-key",
+  "email-check",
+  "email-verify",
+  "password-reset-request",
+  "password-reset",
+  "2fa-verify",
+  "2fa-status",
+  "2fa-enable",
+  "2fa-disable",
+  "2fa-send",
+  "2fa-verify-setup",
+  "pkce-login",
+  "pkce-complete",
+  "api-key-create",
+  "api-key-list",
+  "api-key-get",
+  "api-key-update",
+  "api-key-delete",
+  "oauth-list",
+  "oauth-details",
+  "oauth-revoke",
+  "oauth-revoke-all"
+]

changedInput schema / properties / agent_name / description

Previous value: -"Agent name shown in approval screen and audit logs. Defaults to MCP client name. (optional for: pkce-login, api-key-create, api-key-update)"New value: +"Agent name for approval screen and audit logs."

changedInput schema / properties / api_key / description

Previous value: -"Fast.io API key (required for: set-api-key)"New value: +"Fast.io API key."

changedInput schema / properties / channel / description

Previous value: -"2FA channel (required for: 2fa-enable, 2fa-send)"New value: +"2FA channel."

changedInput schema / properties / code / description

Previous value: -"Verification / authorization code (required for: password-reset, 2fa-verify, pkce-complete)"New value: +"Verification or authorization code."

changedInput schema / properties / current_session_id / description

Previous value: -"Session ID to preserve when exclude_current is true (optional for: oauth-revoke-all)"New value: +"Current session ID for exclusion."

changedInput schema / properties / email / description

Previous value: -"Email address (required for: signin, signup, email-check, email-verify, password-reset-request; optional for: pkce-login)"New value: +"Email address."

changedInput schema / properties / email_token / description

Previous value: -"Email verification code (optional for: email-verify)"New value: +"Email verification code."

changedInput schema / properties / exclude_current / description

Previous value: -"Exclude current session from revoke-all (optional for: oauth-revoke-all)"New value: +"Skip current session in revoke-all."

addedInput schema / properties / expires / anyOf

Added value: +[
+  {
+    "maximum": 9007199254740991,
+    "minimum": 1,
+    "type": "integer"
+  },
+  {
+    "pattern": "^-?\\d+$",
+    "type": "string"
+  }
+]

changedInput schema / properties / expires / description

Previous value: -"Custom token lifetime in seconds (optional for: signin)"New value: +"Token lifetime in seconds."

removedInput schema / properties / expires / maximum
```
Removed value: -9007199254740991
```
removedInput schema / properties / expires / minimum
```
Removed value: --9007199254740991
```
removedInput schema / properties / expires / type
```
Removed value: -"integer"
```

changedInput schema / properties / first_name / description

Previous value: -"User's first / given name (optional for: signup)"New value: +"Given name."

changedInput schema / properties / key_expires / description

Previous value: -"Expiration datetime in ISO 8601 format for API keys (e.g., '2026-12-31T23:59:59Z'). (optional for: api-key-create, api-key-update)"New value: +"ISO 8601 expiration datetime."

changedInput schema / properties / key_id / description

Previous value: -"API key identifier (required for: api-key-get, api-key-update, api-key-delete)"New value: +"API key identifier."

changedInput schema / properties / last_name / description

Previous value: -"User's last / family name (optional for: signup)"New value: +"Family name."

changedInput schema / properties / name / description

Previous value: -"API key label / memo (optional for: api-key-create, api-key-update)"New value: +"API key label."

changedInput schema / properties / password / description

Previous value: -"Account password (required for: signin, signup)"New value: +"Account password."

changedInput schema / properties / password1 / description

Previous value: -"New password (required for: password-reset)"New value: +"New password."

changedInput schema / properties / password2 / description

Previous value: -"New password confirmation (required for: password-reset)"New value: +"New password confirmation."

changedInput schema / properties / scope_type / description

Previous value: -"Scope type for PKCE login. 'user' = full access (default). 'org'/'workspace' = user picks entities. 'all_orgs'/'all_workspaces'/'all_shares' = all of that type. (optional for: pkce-login)"New value: +"PKCE scope type. Default 'user' (full access)."

changedInput schema / properties / scopes / description

Previous value: -"Array of scope strings for scoped API keys (e.g., ['org:123:rw', 'workspace:456:r']). Omit for full access. (optional for: api-key-create, api-key-update)"New value: +"Scope strings, e.g. ['org:123:rw']. Omit for full access."

changedInput schema / properties / session_id / description

Previous value: -"OAuth session identifier (required for: oauth-details, oauth-revoke)"New value: +"OAuth session identifier."

changedInput schema / properties / token / description

Previous value: -"2FA token or verification code (required for: 2fa-disable, 2fa-verify-setup; optional for: api-key-create, api-key-delete — required when account has 2FA enabled)"New value: +"2FA token or verification token."

First observedApr 15, 2026

TDQS

A4.4/5.0

Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Explicitly flags destructive operations (api-key-delete, oauth-revoke, oauth-revoke-all), which is critical behavior disclosure. It also implies session side-effects through the listed operations. It could say more about persistence or user-visible effects, but for a dispatcher it covers the high-risk cases well.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two dense sentences lead with the tool's domain, immediately route the agent to 'describe' for details, and close with an explicit destructive-action warning. No filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a dispatcher covering 17 actions, the description plus the rich schema gives the agent a clear entry path and boundary. It could be slightly more explicit about common pitfalls (e.g. which params are mutually exclusive), but the pointer to 'describe' fills that gap.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema already documents every parameter with detailed, action-specific descriptions split across fields - in particular the 'code' and 'token' fields explain ambiguity and point to action='describe'. The description adds the convention of using describe for the full per-action reference, but doesn't need to restate parameter details.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description names a clear resource ('auth & sessions') and enumerates the operation families (signin, signup, signout, 2FA, PKCE, API keys, OAuth) that the tool covers bel. This distinguishes it from sibling tools at a glance and tells an agent exactly what domain it owns.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It tells the agent to call action='describe' for the full action/parameter reference)SkipThat is a concrete usage instruction for navigating a large dispatcher surface, and it lists destructive operations. It doesn't name conditions for choosing this over siblings, but the domain statement ('Auth & sessions') makes that clear enough.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

All Fast.io tools Inspect

Try in Browser

One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

Glama MCP Gateway

Add one secure layer between your agents and this server.

Resources

Need Help?