Skip to main content
Glama
Sign In

secureflows-mcp

by io.github.michal-lefler
OverviewDiscussionsAdmin

Revoke a session owned by the current user

post_sessions_revoke_session_id

Self-service dashboard endpoint. Revokes a session owned by the caller in the current workspace. The session ends and its stored data is destroyed permanently; this is not sign-out. Requires workspace enableSelfService: true.

Source: POST /api/v1/sessions/revoke/{sessionId} Requires auth.userToken and forwards it as a Bearer token. Prefer connection.workspaceName and connection.appId as stable config instead of generating identity fields dynamically.

Tool call template

Replace each placeholder with a value matching the input schema. Only required parameters are included; add optional parameters as needed.

{
  "id": 1,
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "arguments": {
      "connection": "<connection>",
      "params": "<params>"
    },
    "name": "post_sessions_revoke_session_id"
  }
}

Input Schema

NameRequiredDescriptionDefault
authNo
bodyNo
queryNo
paramsYes
connectionYes

Schema Changelog

Changes observed during successful MCP inspections.

  1. First observed

TDQS

A4.3/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden and does well: it discloses the destructive consequence ('stored data is destroyed permanently'), clarifies that the session ends, states the auth requirement ('auth.userToken ... forwards it as a Bearer token'), and gives a config-stability hint about workspaceName/appId. It omits idempotency/error behavior for an already-revoked session.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded with the operation and its destructive nature, followed by prerequisites and source endpoint. Five sentences is slightly long for a single-purpose revocation tool, and the trailing 'Prefer connection.workspaceName and connection.appId...' guidance is mildly tangential, but nothing is redundant.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a mutation tool with no annotations and no output schema, the description supplies the safety profile, auth requirement, prerequisite flag and endpoint. Remaining gaps -- return shape and behavior when the session is already revoked -- are minor and largely inferable from the destructive semantics it states.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate, and it does: it names sessionId (the path param), auth.userToken, connection.workspaceName and connection.appId, effectively covering the meaningful parameters. The empty body/query objects carry no semantics to explain, so little is left undocumented.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb ('revokes') and resource ('a session owned by the caller in the current workspace'), plus the transport endpoint POST /api/v1/sessions/revoke/{sessionId}. That scope distinguishes it from the sibling post_sessions_revoke and the delete_sessions_delete_key tools without opening either schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives real routing context: 'Self-service dashboard endpoint', the prerequisite 'Requires workspace enableSelfService: true', and an explicit exclusion -- 'this is not sign-out' -- which steers the agent away from post_auth_logout / secureflows_build_logout_url. It stops short of naming a concrete alternative tool, so it is a strong 4 rather than a 5.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

All secureflows-mcp toolsInspect
Try in Browser
Claude Code, inside the Godot 4 editorFlockbay puts an AI agent in the real Godot 4 editor: it writes GDScript, runs your game and fixes what breaks. Free, or bring your own Claude Code or Codex.flockbay.comAd

Glama MCP Gateway

Add one secure layer between your agents and this server.

Resources