Alter Onboarding
Server Details
Guide developers from setup through a verified, policy-aware, audited Alter API call.
- Status
- Healthy
- Uptime
- 100.0% over the last 24 hours
- Last Tested
- Transport
- Streamable HTTP · MCP 2025-11-25
- URL
- ChatGPT
- –
- Claude
- –
TDQS
Scored across 14 tools
Most tools target distinct resources (docs, providers, operations, SDK, policy), but the onboarding-flow machinery is split across get_started, list_phases, and next_step with overlapping behavior — get_started with no args lists phases, and list_phases does the same thing. fetch_doc vs search_docs and sdk_integration vs sdk_pattern are adequately separated only because the descriptions go to unusual lengths to explain the ordering, which signals the boundaries aren't self-evident from the names.
Half the set follows verb_noun (fetch_doc, search_docs, list_providers, get_operation_schema, verify_integration), while the other half are bare noun phrases (policy_language, sdk_integration, sdk_pattern, next_step). Readable, but an agent can't reliably predict whether a tool is a getter or a noun-phrase content dump from its name alone.
14 tools sits comfortably in the well-scoped range and each maps to a recognizable onboarding concern (docs, catalog discovery, flows, SDK, policy, verification). The count is slightly inflated by the three-way split of flow navigation and the phase-listing duplication, which could have been two tools instead of four.
Coverage of the stated purpose is strong: doc search + fetch, provider/operation catalog with schemas, phased onboarding with per-step guidance, SDK wiring and patterns, policy grammar, error remediation, and verification recipes — no obvious dead ends for an agent guiding an integration. Minor gap: skills are listed via list_skills but read through a resource URI rather than a tool, so an agent that can't consume resources must fall back to fetch_doc and hope the skill is served in-band.
Available Tools
14 toolsfetch_docAInspect
Fetch Alter documentation by slug (e.g. "quickstart"). Guides, indexes and skills are served in-band; generated provider operation and model pages link to the full public reference. Accepts any spelling the docs use: a bare slug, a leading slash, a #section anchor, a full docs.alterauth.com URL, or an older path that now redirects. Omit the slug to list every page.
Inputs: slug.
get_operation_schemaAInspect
Fetch one provider API operation's full contract — method, path, parameters, request/response schemas — live from Alter's provider-spec catalog, plus the spec's source and freshness. Get operation ids from list_operations first.
Inputs: provider_id (required), operation_id (required), kind.
get_startedAInspect
Begin or change an Alter integration. Without args: lists the phases. With phase: returns that phase's flows + a heuristic hint — classify the use case YOURSELF and call again with goal for the plan. If the use case spans multiple flows, run them sequentially.
Inputs: goal, phase, use_case.
list_operationsAInspect
List the API operations a provider exposes, live from Alter's provider-spec catalog (e.g. "what can I call on google?"). Returns operation ids + methods/paths, plus the spec's source and freshness. Omit kind to auto-detect the provider family; when the id exists in both oauth and managed you'll be asked to pass kind. Machine-readable rows ride in structuredContent (see this tool's outputSchema) — read those rather than parsing the prose.
Inputs: provider_id (required), kind, limit, offset, +1 more. Returns: total, offset, operations, provider_id, +2 more
list_phasesAInspect
List the lifecycle phases this server serves (setup, modify) and what each is for.
Inputs: no named parameters.
list_providersAInspect
List every provider with an ingested API spec in Alter's provider-spec catalog, with each spec's source and freshness. Optionally filter by kind. Start here, then call list_operations for a provider's operations.
Inputs: kind.
list_skillsAInspect
List the guidance Skills available on this server, with the phase each serves. Read a skill via its resource (skill://alter/).
Inputs: no named parameters.
next_stepAInspect
Return the next step for a flow. Pass the goal (flow id) and the id of the last completed step (omit after for the first step). Run each step's detect command FIRST and skip the run command when detection passes. The design step also returns that flow's complete starter ALTER_INTEGRATION.md.
Inputs: goal (required), after.
policy_languageAInspect
The authoritative grammar of Alter's runtime-policy language, live from the deployed backend: every authorable rule type with its JSON body schema, caps, authorable levels, worked examples, and fail-closed semantics. Call with no arguments for the overview; pass rule_type (e.g. "content_match") for one type's full grammar. Use it before authoring rules with alter policy rules create — never guess a body shape. Vocabulary: the dashboard's "Runtime policies" surface, the docs' "policy", and alter policy are one feature, and the dashboard's "Require human approval" type is the require_approval rule type (its grant-editor block is the grant-level baseline of the same gate). The same grammar is what policy files carry: alter policy validate|test|plan|apply review rules in Git and CI, and a rule with a code_owner is changed through its file, never with rules update. Workflow prose: the set-policy modify flow (get_started with phase=modify), fetch_doc("guides/set-policies"), fetch_doc("guides/add-human-in-the-loop-approvals"), fetch_doc("guides/policy-as-code"), and fetch_doc("reference/cli/commands/policy").
Inputs: rule_type.
sdk_integrationAInspect
Return the Alter SDK wiring (install + client init + request) to write into the developer's codebase, for a language and setup goal.
Inputs: goal (required), language (required).
sdk_patternAInspect
Return a runnable Alter SDK call pattern for a language: proxy-call (zero-egress proxy_request + HITL), resolve-grant-by-user (call as an end user via their delegated grant), delegate-managed-secret (the operator-side delegation step), or resolve-ambiguous-grant (an identity-mode call matched several of one user's grants: choose deliberately, never the first, and persist it; ask the developer at design time whether users can hold several accounts per provider). Use AFTER sdk_integration has wired the client.
Inputs: pattern (required), language (required).
search_docsAInspect
Search every bundled page of the Alter documentation (docs and skill pages) by keywords: returns the best-matching pages with the section and a snippet that matched. Use it when a flow step or doc did not point you at the page you need, instead of guessing slugs or listing every page; then read one with fetch_doc and its slug.
Inputs: query (required), limit.
troubleshootAInspect
Map a @alter-ai/cli exit code or error message to a remediation.
Inputs: error, exit_code.
verify_integrationAInspect
Return a copy-pasteable recipe to VERIFY an integration works: first-call (code↔design, an audit row, correct attribution) or per-user-isolation (a multi-user/broker server runs two users under different credentials and rejects cross-user access). Guidance only — you run the commands.
Inputs: scenario (required).
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
Loading tool schema changelog…
Related MCP Connectors
Scan a public GitHub repo, explain risks, get fix prompts and rescan to confirm fixes.
Statically audits MCP tool surfaces for token cost, schema quality, and design issues.
Scans schema metadata to classify PHI, score HIPAA readiness, and generate compliant migrations.
Detects database migration table locks, terraform cost leaks, and OWASP API flaws.
Related MCP Servers
- AlicenseAqualityCmaintenanceEnables policy-governed MCP interactions with deterministic authorization, tenant isolation, minimized PII exposure, and human approval gates for sensitive mutations, while producing structured audit events.3MIT
- AlicenseNot gradedqualityBmaintenanceEnables MCP clients to carry out a compliant, non-destructive, auditable authorized security-testing workflow — project intake, scope reading, asset discovery, non-destructive verification, evidence collection, and report-draft generation with manual submission tracking — where every outbound action is gated by scope checks, one-time human confirmation tokens, rate limits, and append-only audit logging.MIT
- AlicenseNot gradedqualityBmaintenanceEnables approval-gated actions for Alexa+ by exposing MCP tools that plan changes, require explicit user approval, execute only after precondition checks, and verify results with SHA-256 evidence digests.MIT

MCP Security scannerofficial
AlicenseAqualityBmaintenanceEnables users to deterministically audit MCP servers for security issues across manifests, source, runtime responses, multi-call state, identity, and install scripts, and to run an inline gateway that gates tool calls and scans responses before returning them.317 PyPI1Apache 2.0
Glama MCP Gateway
Add one secure layer between your agents and this server.