Skip to main content
Glama

ethora-mcp-server

Rotate App Token

ethora-app-tokens-rotate-v2
DestructiveIdempotent

Rotate an app token: revoke an existing token and issue a replacement in one step. The old tokenId is revoked immediately — anything using it stops working at once. The new secret value is returned exactly once — capture it immediately. Auth: B2B mode (ethora-auth-use-b2b + a configured b2bToken). Errors: 401/403 not in B2B mode; 400 no appId and none selected; 404 unknown appId or tokenId. Related: ethora-app-tokens-revoke-v2 to revoke without a replacement.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
appIdNo24-char hex appId the token belongs to. Optional — defaults to the app set via `ethora-app-select`.
labelNoLabel for the replacement token. Omit to inherit the old token's label.
tokenIdYesId of the token to revoke and replace. Get it from `ethora-app-tokens-list-v2`.
timeoutMsNoHTTP timeout for this request, in milliseconds. Default 10000.

Schema Changelog

Changes observed during successful MCP inspections.

  1. First observed

TDQS

A3.7/5.0
Behavior1/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description states that the old token is revoked immediately and the new secret is returned exactly once, implying that repeating the call with the same `tokenId` would not yield the same secret again. This contradicts the annotation `idempotentHint: true`, which claims the operation is idempotent. Because the description contradicts a stated annotation, it earns a score of 1 and flags an annotation contradiction.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured and front-loaded with the core purpose. It packs essential operational details (immediate revocation, one-time secret, auth requirements, error codes) into a concise block without unnecessary fluff. It earns a 4 rather than a 5 because it could be slightly more streamlined (e.g., the error list is a bit verbose), but it is still efficient and clear.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description covers operational consequences (immediate revocation, one-time secret), auth constraints, and likely error codes. Since there is no output schema, it explains the critical output ('new secret value is returned exactly once') adequately. However, it leaves some ambiguity about idempotency (a conflict with annotations) and does not describe the response format beyond the secret, so it is not fully complete. Given the tool's destructive nature and the absence of an output schema, a 4 is reasonable.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has 100% description coverage for all four parameters, so the schema already explains their meanings. The description adds a little extra context (e.g., that `tokenId` is the token to revoke, and that `appId` defaults to the selected app), but this is largely redundant with the schema. Baseline 3 is appropriate because the description does not significantly deepen parameter understanding beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the specific action: 'Rotate an app token: revoke an existing token and issue a replacement in one step.' It names the resource and the verb, and it distinguishes itself from the sibling `ethora-app-tokens-revoke-v2` which revokes without a replacement. This makes the tool's purpose immediately obvious.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives explicit usage context: it mentions the required B2B auth mode and the prerequisite of having a `b2bToken`. It also explicitly names a related alternative (`ethora-app-tokens-revoke-v2`) and the condition for choosing it ('to revoke without a replacement'). This is clear, actionable guidance on when to use this tool versus alternatives.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Try in Browser

Glama MCP Gateway

Add one secure layer between your agents and this server.