Skip to main content
Glama

gateway

by io.github.toolhail

call_tool

Proxy one tool call to a discovered remote MCP server (paid). Every call passes pre-execution guards before anything runs: tools on TOOLHAIL_BLOCKED_TOOLS are always refused; when TOOLHAIL_ALLOWED_TOOLS is set (non-empty, no "*") only listed tools may fire; write/mutating-looking tool names are refused unless allowWrite:true is passed or the tool is allowlisted; and TOOLHAIL_ARG_LIMITS can cap specific argument values per tool (e.g. daily_budget<=500) so an allowlisted broad tool still cannot push a value past its ceiling. Any refusal executes nothing and bills nothing, and every receipt records the gate decision.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
urlYesRemote MCP server URL (the "remotes[].url" from a find_mcp_server result).
argsNoArguments object to pass to the tool.
toolNameYesName of the tool to call on that server.
allowWriteNoExplicit acknowledgement that a write/mutating call is intended. Tool names that look like writes (create/update/delete/send/pay/deploy/...) are refused by default — nothing executed, nothing billed — unless this is true or the tool is on TOOLHAIL_ALLOWED_TOOLS. Set it only when the mutation is deliberate and vetted; never set it reflexively to get past a refusal.
maxSpendUsdNoSpend cap. Refuse the call — nothing executed, nothing billed — if the gateway fee would exceed this many USD.

Schema Changelog

Changes observed during successful MCP inspections. Dates show when Glama detected each change.

  1. Changed1 schema field changed
    • addedInput schema / properties / allowWrite
      Added value: +{
+  "description": "Explicit acknowledgement that a write/mutating call is intended. Tool names that look like writes (create/update/delete/send/pay/deploy/...) are refused by default — nothing executed, nothing billed — unless this is true or the tool is on TOOLHAIL_ALLOWED_TOOLS. Set it only when the mutation is deliberate and vetted; never set it reflexively to get past a refusal.",
+  "type": "boolean"
+}
  2. First observed

TDQS

A4.5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description bears full responsibility for behavioral disclosure. It details pre-execution guards, refusal conditions, billing, and receipt recording. It explains that write tools are refused by default unless allowWrite or allowed, and that no execution or billing occurs on refusal. This is comprehensive and transparent.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is relatively long but every sentence adds unique value. It front-loads the core purpose and then elaborates on guards. While it could be restructured with bullet points for readability, it is not excessively verbose and earns its length.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity (5 parameters, no output schema, guards, billing), the description covers nearly all necessary aspects: purpose, guards, billing, refusal conditions. It does not detail the receipt structure but mentions it records the gate decision. This is reasonably complete for an agent.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the schema already documents all parameters. The description adds valuable context: it explains allowWrite's role in bypassing write refusal and maxSpendUsd as a spend cap, and it links url to results from find_mcp_server. This adds meaning beyond the schema, though the schema already does heavy lifting.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose: 'Proxy one tool call to a discovered remote MCP server (paid).' It uses a specific verb (proxy) and resource (tool call to remote MCP server), and the sibling tool find_mcp_server is for discovery, so this tool is clearly for execution after discovery.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides strong guidance on when to use (after discovering a server via find_mcp_server) and explicit conditions for refusal (blocked tools, allowed tools, write lookahead, argument limits). It could explicitly state 'use this after find_mcp_server' but the context makes it clear.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

All gateway toolsInspect
Try in Browser
RayrunBuild, deploy, and operate MCP servers without becoming an infrastructure team.ray.runAd

Glama MCP Gateway

Add one secure layer between your agents and this server.

TDQS

C2.6/5.0
Disambiguation5/5

The two tools have clearly distinct purposes: one for proxying tool calls with security guards, the other for discovering servers. No overlap.

Naming Consistency5/5

Both tool names follow a verb_noun pattern in snake_case, maintaining consistency.

Tool Count3/5

With only 2 tools, the surface is minimal, but they cover the core proxy and discovery functions. Could benefit from additional tools like listing available servers or managing connections.

Completeness2/5

The tool set lacks basic discovery functionality (e.g., listing servers) and management tools, making it incomplete for a gateway's full lifecycle.

Resources