MCP.AI for IDE agents (Cursor, etc.): log in in the browser, copy the access token. Best: add it to this server's config as a header Authorization: Bearer <token> for a permanent, non-expiring connection. Or paste it here for a session-only login: call with { token: "" } after the user pastes, or with no args to get the link.
| Name | Required | Description | Default |
|---|---|---|---|
| token | No |
Changes observed during successful MCP inspections. Dates show when Glama detected each change.
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Beyond the annotations (idempotent, non-destructive), the description discloses the behavioral flow: calling with no args generates a login link, and calling with token performs session-only authentication. It also clarifies the permanence difference between the config header and the token input. This adds useful context not captured by annotations, though it doesn't describe the exact return value or failure modes.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is information-dense and covers all necessary points in a single (albeit long) sentence. It is not as cleanly structured as it could be, but every clause adds value, and the length is appropriate for the content.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple tool with one optional parameter and no output schema, the description is largely complete. It explains the login flow, token usage, and provides a best-practice alternative (config header). It doesn't cover error scenarios or post-auth behavior, but these are not critical given the tool's simplicity and the existing annotations.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema only defines `token` as a string with no description. The description compensates fully: it explains the token is a JWT obtained from the browser, that it is optional, and that omitting it yields a login link while providing it enables session authentication. This gives complete semantic meaning to the parameter.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose: to log in via browser and obtain an access token for authentication. It distinguishes itself from siblings by being the only authentication-related tool, and it details two usage modes (config header vs. token parameter). The verb 'log in' and resource (server authentication) are specific and unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides explicit when-to-use guidance: it recommends adding the token to the server config for permanent connection (alternative to using the tool) and using the tool for session-only login. It also specifies exactly when to pass `token` versus call with no args to get the link, covering both invocation paths and the alternative.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Add one secure layer between your agents and this server.
The platform tools (authenticate, connect, marketplace, report_bug, show_version, toolkit_info) are individually distinct, but the server is named 'OFAC (Sanções EUA)' and contains a single OFAC-specific tool alongside six generic MCP platform tools, creating a confusing mix. An agent could easily misselect a platform tool when the intent is sanctions checking, and the marketplace tool's broad multi-purpose nature adds further ambiguity.
Naming conventions are inconsistent: 'ofac_consultar' is Portuguese snake_case, while the others are English and use varied forms (single verbs like 'connect', noun-based like 'toolkit_info', and verb_noun like 'report_bug'). There is no unifying pattern that reflects a coherent server purpose.
Seven tools is a reasonable count in general, but for an OFAC sanctions server the count is inappropriate: six of the seven are generic MCP platform utilities, leaving only one actual sanctions-related tool. The tool surface is cluttered with irrelevant functionality rather than being scoped to the server's stated purpose.
The OFAC domain is severely incomplete: only one tool (ofac_consultar) addresses sanctions, with no support for other common operations like batch checks, list selection, or detailed record retrieval. The remaining tools cover a different domain entirely (MCP platform management), leaving the intended purpose almost entirely unserved.