Skip to main content
Glama

Add or replace an organization checker

set_checker
DestructiveIdempotent

Add an organization checker, or replace the one with the same name. A checker is the organization's own HTTPS endpoint that implements Valet's Checker API. Once saved, a release policy can run it as org:: set_policy with that checker. Valet calls the endpoint's describe operation before saving and saves nothing if the call fails.

Saving a checker agrees, for the organization, to send the release files the endpoint asks for (the source, the build, or both) to the URL, for every release that a policy naming the checker evaluates. Once fetched, the files are outside Valet's control. Confirm that with the user before you call this tool. The answer names the files the endpoint asked for; those become the approved files. An endpoint that later asks for more is unavailable until the checker is saved again.

A credential goes in headers only as a {{NAME}} reference to a secret env var of the organization, such as {"Authorization": "Bearer {{SNYK_TOKEN}}"}. Valet resolves the reference at each call. Never put a credential's value in a header: headers are stored and listed as written. Have the user set the variable first with valet env set SNYK_TOKEN=... --org <org>, so the value never passes through this conversation. A reference to a variable that is not a secret of the organization is refused. list_policies shows the organization's checkers. Requires connecting a Valet account.

Input Schema

NameRequiredDescriptionDefault
urlYesRequired. The endpoint's base URL, https only, with no query or fragment, such as https://checks.example.com/snyk. Valet appends /v1/describe and so on. It must be a public address.
checkerYesRequired. The checker's name: lowercase letters, digits, and hyphens, such as snyk. Policies name it org:snyk, and org:snyk is accepted here too. An existing name is replaced.
headersNoHeaders Valet sends on every call, as name to value. A credential's value must be a {{NAME}} reference to a secret env var of the organization, such as Bearer {{SNYK_TOKEN}}. Up to 16.
org_nameNoThe Valet organization that owns the checker. Omit to use the organization the account joined first.

Schema Changelog

Changes observed during successful MCP inspections.

  1. Added

TDQS

A4.6/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Goes well beyond the annotations: it discloses that Valet calls the endpoint's describe operation before saving and saves nothing on failure, that release files leave Valet's control once fetched (substantiating destructiveHint/openWorldHint), that later-requested files render the endpoint unavailable until re-saved, and that non-secret {{NAME}} references are refused. This is exactly the kind of side-effect and irreversibility detail an agent needs before invoking.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The core action is front-loaded in the first sentence, and the four paragraphs map cleanly to purpose, data-sharing consent, credential handling, and account requirements. It is dense but long, and the {{NAME}} example plus the 'list_policies shows checkers' aside are repeated/tangential enough to keep it off a 5.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Despite having no output schema, the description explains the return value ('The answer names the files the endpoint asked for'), covers auth/prerequisite setup, header credential format, replacement semantics, and the failure/atomicity behavior. Nothing meaningful for correct invocation is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the schema already documents url, checker, headers, and org_name; baseline would be 3. The description adds genuine value beyond it by explaining {{NAME}} resolution timing, the prohibition on literal credential values, the refusal rule for non-secret variables, and the org_name default behavior.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description names a specific verb pair (add or replace) and resource (organization checker), then defines what a checker actually is — an org-owned HTTPS endpoint implementing Valet's Checker API. It implicitly separates itself from destroy_checker (removal) and list_policies (viewing), so an agent can identify the operation without opening the schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It gives strong contextual guidance: prerequisites ('Requires connecting a Valet account'), an explicit user-confirmation step, and a preparatory step (have the user set the secret env var first). It references set_policy and list_policies as related tools, but never states an explicit 'do not use this when…' exclusion, so it stops short of a 5.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Try in Browser

Glama MCP Gateway

Add one secure layer between your agents and this server.

Resources