MCP.AI for IDE agents (Cursor, etc.): log in in the browser, copy the access token. Best: add it to this server's config as a header Authorization: Bearer <token> for a permanent, non-expiring connection. Or paste it here for a session-only login: call with { token: "" } after the user pastes, or with no args to get the link.
| Name | Required | Description | Default |
|---|---|---|---|
| token | No |
Changes observed during successful MCP inspections. Dates show when Glama detected each change.
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already indicate idempotent, non-destructive behavior. The description adds context about the two operational modes (link generation and session token) and the difference between permanent and session-only connections. No contradiction with annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is informative but somewhat verbose and awkwardly structured, mixing user instructions with tool invocation details. It could be tightened to a clearer, more front-loaded format.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For an authentication tool, it covers the main scenarios (config vs session, token vs no token). It doesn't mention return values or potential errors, but given the simplicity and available annotations, it is largely complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema provides only a 'token' string with no description (0% coverage), but the description fully explains it as a JWT from the browser and how to use it, adding complete meaning beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool authenticates to MCP.AI, with specific verbs like 'log in' and explicit resource. It distinguishes from sibling tools by being the only auth tool, though it doesn't name them.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides clear context for when to call with no args (get link) vs with token (session login), and recommends the config header approach for permanent access. Does not explicitly contrast with alternatives, but the usage modes are well explained.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Add one secure layer between your agents and this server.
The marketplace tool is a catch-all that overlaps with report_bug (which it also mentions it can do), connect, and toolkit_info in terms of status and management. The single domain-specific tool, sancoes_canada_consultar, is clearly distinct from the platform utilities, but the utility tools have unclear boundaries among themselves.
Names mix single verbs (authenticate, connect), nouns (marketplace, toolkit_info), and snake_case (report_bug, show_version, sancoes_canada_consultar). The Portuguese domain tool breaks the otherwise English naming convention, and there is no consistent verb_noun pattern across the set.
Seven tools is a reasonable count, but six are generic platform utilities (auth, connection, marketplace, bug reporting, version, state) while only one serves the Canada sanctions domain. The scope feels split between a platform admin toolkit and a specific data service, making the count less coherent for the server's stated purpose.
The domain surface is extremely thin: only a single lookup operation for Canada sanctions, with no additional query types, listing options, or batch operations. The other tools address platform lifecycle, not the sanctions domain, leaving obvious gaps for a compliance-focused server (e.g., different sanction lists, detailed results, watchlists).