Skip to main content
Glama

tide_doctor

Read-only

FIND AND FIX WHAT IS WRONG WITH A TIDE APP, IN ONE COMMAND. Returns the command that checks an app for the faults behind most broken logins and unprotected APIs. It REPAIRS the mechanical ones itself (re-copies the DPoP page byte-exact, corrects a wrong rewrite path, gitignores .env) and prints the exact fix for the rest, which YOU apply — do not pass the list to the user. Covers: DPoP page missing/stale/served without its headers, useDPoP passed as a JSX prop (silently OFF), createTideCloakProxy called without protectedRoutes (protects nothing), adapter without its embedded key, remote JWKS, Bearer-only token parsing, no server-side verification, secrets about to be committed, a destructive change request pending. CALL THIS after scaffolding or changing auth code, BEFORE telling the user it works, and FIRST whenever a login or an API check misbehaves. This tool call itself only returns the command.

Input Schema

NameRequiredDescriptionDefault
realmNoRealm name. Adds read-only realm checks (needs the admin password in .env).
appDirNoApp directory. Default: the current directory.
appUrlNoURL of the RUNNING app, e.g. http://localhost:3000. Adds checks of what is actually served.
checkOnlyNoReport only and change nothing (for CI). Default false: mechanical faults are repaired.

Schema Changelog

Changes observed during successful MCP inspections.

  1. Added

TDQS

A4.3/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Adds substantial context beyond the annotations: which faults it self-repairs (re-copies DPoP page byte-exact, corrects rewrite path, gitignores .env), which it only prints for the agent to apply, and the checkOnly CI mode. It also clarifies the call returns only a command, which reconciles the 'REPAIRS' language with readOnlyHint=true. The mild tension between 'repairs' and readOnly/destructive annotations is explained rather than contradicted, so no penalty beyond being slightly dense.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded with the core purpose and the imperative usage rule, then the coverage list. It is long and dense (long all-caps coverage sentence), but each listed fault earns its place by defining scope; only marginal trimming is possible.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema, the description carries the return-value burden and does so: it states the call returns only a command and that the agent applies the remaining fixes. Combined with coverage of what it checks and fixes, an agent has enough to invoke and act correctly, though the exact output shape is only loosely described.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the schema already documents all four parameters including their defaults. The description reinforces the realm/appUrl scoping and checkOnly behavior but adds no syntax or format detail beyond the schema, so the baseline of 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb+resource+scope: find and fix what is wrong with a Tide app in one command. It enumerates the concrete fault classes it covers (DPoP page, useDPoP JSX prop, createTideCloakProxy without protectedRoutes, etc.), so an agent can distinguish it from siblings like tide_dpop_asset or tide_security_analysis without opening any schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicit when-to-use: 'CALL THIS after scaffolding or changing auth code, BEFORE telling the user it works, and FIRST whenever a login or an API check misbehaves.' It also states the workflow constraint that the agent must apply the printed fixes and not forward the list to the user, which is genuine routing guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Try in Browser

Glama MCP Gateway

Add one secure layer between your agents and this server.