Skip to main content
Glama

schwab_check_oauth_status

Check whether the OAuth2 authorization flow has completed.

Call after opening the authorization URL from begin_oauth and completing the login in your browser. Free. Proof of npub ownership is required: OAuth status exposes which upstream services a patron has connected.

A 'pending' result here does NOT prove an existing session has lapsed — it only reports this authorization attempt. To find out whether a session still works, attempt the live call; fall back to begin_oauth only on an explicit upstream_auth_refresh_needed error.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
npubYesThe same Nostr public key (npub1...) used in begin_oauth.
dpop_tokenYesRaw JSON of a kind-27235 Nostr event signed by npub — not base64, not NIP-98 'Authorization: Nostr <b64>' framing. Its `u` tag must hold THIS tool's exact name (from tools/list), not the endpoint URL; content:"", created_at within 60s of now, and a random `nonce` tag recommended. Or a cached dpop_token phrase.

Output Schema

TableJSON Schema
NameRequiredDescriptionDefault

No arguments

Schema Changelog

Changes observed during successful MCP inspections.

  1. Changed1 schema field changed
    • changedInput schema / properties / dpop_token / description
      Previous value: -"A kind-27235 Nostr event signed by npub for this tool."New value: +"Raw JSON of a kind-27235 Nostr event signed by npub —\nnot base64, not NIP-98 'Authorization: Nostr <b64>' framing.\nIts `u` tag must hold THIS tool's exact name (from\ntools/list), not the endpoint URL; content:\"\", created_at\nwithin 60s of now, and a random `nonce` tag recommended. Or a\ncached dpop_token phrase."
  2. First observed

TDQS

A4.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden. It discloses that the tool is free, requires proof of npub ownership, and that OAuth status exposes connected upstream services. It also clarifies that a 'pending' result only reports this authorization attempt, not session validity. The description is transparent about these behavioral traits, though it could mention side effects or rate limits if any.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise, consisting of three short paragraphs. The first sentence is front-loaded with the tool's purpose. Every sentence adds value, and there is no redundant or irrelevant information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's simplicity (checking OAuth status), the description covers the key aspects: when to call, required proof, result interpretation, and handling of 'pending'. An output schema exists to describe return values, so the description is complete for effective use.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has 100% coverage with descriptions for both parameters. The description adds context by stating that the npub should be the same as used in begin_oauth, which is already implied in the schema. No additional parameter meaning beyond the schema is provided, placing it at the baseline of 3.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose: 'Check whether the OAuth2 authorization flow has completed.' It uses a specific verb ('check') and resource ('OAuth2 authorization flow'), and it distinguishes itself from siblings like schwab_begin_oauth by advising when to call it and how to interpret results.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicit usage guidance is provided: 'Call after opening the authorization URL from begin_oauth and completing the login in your browser.' It also warns against misinterpreting 'pending' and provides fallback instructions ('attempt the live call; fall back to begin_oauth only on an explicit upstream_auth_refresh_needed error').

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Try in Browser

Glama MCP Gateway

Add one secure layer between your agents and this server.