Charming

get_app_source

Read-only

Return an app's raw persisted source (module, frontend ui script, and styles) plus its current revision for optimistic-concurrency edits. Pass that revision through update_app's expected_revision input. Use this when you need the source to inspect, debug, or edit an app the caller owns.

Input Schema

TableJSON Schema

Name	Required	Description	Default
`app_id`	Yes	The app ID (UUID)

Output Schema

TableJSON Schema

Name	Required	Description
`id`	Yes	UUID of the inspected app.
`ok`	Yes	Indicates success. Errors arrive as content with isError:true.
`url`	Yes	Public app URL without an access token, built from the OWNER's handle when available (friendly form) and the UUID form otherwise. Safe to show the user. Browsers open via session cookie; agents should call get_app to mint a per-app token for write access.
`source`	Yes	Persisted source bundle. The same fields accepted by create_app/update_app.
`$schema`	No	Exact dated canonical manifest schema URL. Omitted for legacy apps.
`claimed`	Yes	True if the app is owned by an authenticated account. False for anonymous apps still in the unclaimed grace window.
`revision`	Yes	Server-owned app source revision. Historical null counters read as 0; new apps start at 1; each successful source write advances it once. Pass this value through `expected_revision` when guarding update_app.
`expiresAt`	Yes	ISO timestamp when an unclaimed app will be hard-deleted. Null for claimed apps.
`advisories`	No	Structured non-fatal advisories, including authoring issues and unread staff feedback responses. Each advisory.summary is also appended to the text content for the LLM path.
`appVersion`	Yes	Canonical apps return decimal String(revision). Legacy apps return their stored effective SemVer.
`manifestId`	Yes	Effective manifest id. May differ from `sourceManifestId` when a conflicting id was rewritten on save.
`description`	Yes	Search-friendly summary set by the creating agent. Null on apps created before descriptions existed.
`displayName`	Yes	Human-readable name from the manifest.
`capabilities`	Yes	Capability declarations parsed from the app manifest.
`manifestVersion`	Yes	Deprecated public contract marker. Canonical apps return null; legacy apps return their stored contract date.
`sourceManifestId`	Yes	Manifest id as authored in the persisted module source.

Schema Changelog

Changes observed during successful MCP inspections.

Changed17 schema fields changedSep 10, 2026

addedOutput schema / properties / $schema

Added value: +{
+  "description": "Exact dated canonical manifest schema URL. Omitted for legacy apps.",
+  "enum": [
+    "https://charm.ing/schema/app-manifest/2026-07-31.json",
+    "https://charm.ing/schema/app-manifest/2026-09-05.json"
+  ],
+  "type": "string"
+}

changedOutput schema / properties / advisories / description

Previous value: -"Structured advisories attached when the tool detected a non-fatal authoring issue (e.g. legacy bridge usage). Each advisory.summary is also appended to the text content for the LLM path."New value: +"Structured non-fatal advisories, including authoring issues and unread staff feedback responses. Each advisory.summary is also appended to the text content for the LLM path."

changedOutput schema / properties / appVersion / description

Previous value: -"Author-declared version string for the app (whatever the manifest source set as `manifest.version`, e.g. \"0.0.1\"). Distinct from the concurrency `version` int and from `manifestVersion` (Charming contract date)."New value: +"Canonical apps return decimal String(revision). Legacy apps return their stored effective SemVer."

changedOutput schema / properties / capabilities / properties / imports / description

Previous value: -"WIT-style capability ids the app requests (e.g. \"buildy:storage/kv@1.0\"). Empty if the app declares none."New value: +"WIT-style capability ids the app requests (e.g. \"charming:storage/kv@1.0\"). Empty if the app declares none."

removedOutput schema / properties / description / anyOf

Removed value: -[
-  {
-    "type": "string"
-  },
-  {
-    "type": "null"
-  }
-]

addedOutput schema / properties / description / type
```
Added value: +[
+  "string",
+  "null"
+]
```

removedOutput schema / properties / expiresAt / anyOf

Removed value: -[
-  {
-    "type": "string"
-  },
-  {
-    "type": "null"
-  }
-]

addedOutput schema / properties / expiresAt / type
```
Added value: +[
+  "string",
+  "null"
+]
```

changedOutput schema / properties / manifestVersion / description

Previous value: -"Charming manifest contract date (`YYYY-MM-DD`) the app is pinned to. The runtime branches on this value to pick contract-specific behaviour."New value: +"Deprecated public contract marker. Canonical apps return null; legacy apps return their stored contract date."

changedOutput schema / properties / manifestVersion / type

Previous value: -"string"New value: +[
+  "string",
+  "null"
+]

addedOutput schema / properties / revision

Added value: +{
+  "description": "Server-owned app source revision. Historical null counters read as 0; new apps start at 1; each successful source write advances it once. Pass this value through `expected_revision` when guarding update_app.",
+  "maximum": 9007199254740991,
+  "minimum": 0,
+  "type": "integer"
+}

removedOutput schema / properties / source / properties / styles / anyOf

Removed value: -[
-  {
-    "type": "string"
-  },
-  {
-    "type": "null"
-  }
-]

addedOutput schema / properties / source / properties / styles / type
```
Added value: +[
+  "string",
+  "null"
+]
```

removedOutput schema / properties / source / properties / ui / anyOf

Removed value: -[
-  {
-    "type": "string"
-  },
-  {
-    "type": "null"
-  }
-]

addedOutput schema / properties / source / properties / ui / type
```
Added value: +[
+  "string",
+  "null"
+]
```

removedOutput schema / properties / version

Removed value: -{
-  "description": "Monotonic int version of the app. 0 on truly-legacy rows that predate versioning (still editable — pass `expected_version: 0`); otherwise a positive int bumped on every successful update_app/PUT. Pass back as `expected_version` on edits-aware update_app and as `If-Match: \"v<N>\"` on PATCH /app/:id/source.",
-  "maximum": 9007199254740991,
-  "minimum": -9007199254740991,
-  "type": "integer"
-}

changedOutput schema / required

Previous value: -[
-  "ok",
-  "id",
-  "url",
-  "manifestId",
-  "sourceManifestId",
-  "displayName",
-  "description",
-  "version",
-  "appVersion",
-  "manifestVersion",
-  "capabilities",
-  "claimed",
-  "expiresAt",
-  "source"
-]New value: +[
+  "ok",
+  "id",
+  "url",
+  "manifestId",
+  "sourceManifestId",
+  "displayName",
+  "description",
+  "revision",
+  "appVersion",
+  "manifestVersion",
+  "capabilities",
+  "claimed",
+  "expiresAt",
+  "source"
+]

First observedJul 15, 2026

TDQS

A4.2/5.0

Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and destructiveHint=false, so the safe-read profile is conveyed. The description adds value beyond that by disclosing that the result includes a revision token intended for optimistic-concurrency edits and by naming the next-step integration with update_app. Failure/auth behavior is missing, but it is a minor complete a minor gap given annotations and output schema.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three short sentences, each earning its place: first defines the exact return current revision, second gives the downstream update_app instruction, third states the when-to-use context. No filler or repeated annotation.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a one-parameter read tool with a known output schema, this description covers the return contents, the purpose of the revision, the downstream update call, and the caller-ownership condition. Failure/error behavior (e.g., invalid app_id or non-owned app) is omitted, but calling the tool correctly does not require that.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%: the sole required app_id is already fully documented as a UUID in the schema. The description contributes fewer intro fields names (e.g., module, ui script, styles, revision) to provide context, but does not add per-parameter syntax or constraints. With high schema coverage, baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description's verb 'Return' and resource specification is precise: 'raw persisted source (module, frontend ui script, and styles)' plus 'current revision for optimistic-concurrency edits.' It further distinguishes this tool from siblings by naming the downstream consumer (update_app) and use cases (inspect, debug, edit), so no other schema or description is needed to tell it apart.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It explicitly states when to use this tool: 'Use this when you require the source to inspect, debug, or edit an app the caller owns.' It also gives concrete downstream instruction by having the returned revision passed into update_app's expected_revision. It does not enumerate alternative tools or when not to use it, but the context is clear and actionable.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

All Charming tools Inspect

Try in Browser

One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

Glama MCP Gateway

Add one secure layer between your agents and this server.