Skip to main content
Glama

Add or replace a release policy

set_policy
DestructiveIdempotent

Add a release policy to an organization, or replace the one with the same name. A policy runs its checker on every publish. It monitors by default: it records findings and never refuses a release. enforcement "block" with block_at refuses a release that has a finding at or above that severity, or that the checker could not evaluate. list_policies shows the checkers and their settings.

Replacing a policy replaces its settings: pass every non-secret setting again. A secret setting you leave out keeps its stored value when the checker is unchanged. A change to a policy applies to releases not yet decided. Changing a policy's enforcement or settings never changes a decided evaluation, and a running policy evaluation keeps the checker and enforcement it started with. A running policy evaluation whose checker hasn't started yet uses the current settings. Removing a policy, or changing its checker, cancels its running policy evaluations, so releases that waited only on it go ahead.

A secret passed in secrets travels through this conversation. That is the user's call to make: if they hand you the key, use it, and say that they could instead run valet policies add, which prompts for it without echoing, so it goes straight to Valet. The answer names the fields that were set and never their values. Requires connecting a Valet account.

Input Schema

NameRequiredDescriptionDefault
policyYesRequired. The policy's name: lowercase letters, digits, and hyphens, such as dependencies. An existing name is replaced.
checkerYesRequired. The checker to run, spelled as list_policies reports it, such as catalog:secrets.
secretsNoThe checker's secret settings, as field name to value. A value passed here travels through this conversation; leave it out and point the user at valet policies add when they would rather it did not. A field you leave out keeps its stored value.
block_atNoThe lowest severity that blocks. Required with enforcement block.
org_nameNoThe Valet organization that owns the policy. Omit to use the organization the account joined first.
settingsNoThe checker's non-secret settings, as field name to value.
enforcementNomonitor (the default) records findings and never refuses a release. block refuses one with a finding at or above block_at.

Schema Changelog

Changes observed during successful MCP inspections.

  1. Added

TDQS

A4.6/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Goes well beyond the annotations: discloses that default enforcement is monitor, that replace resets settings unless secrets are omitted, that running evaluations keep their original checker/enforcement, that removing a policy or changing its checker cancels running evaluations, and that an auth account is required. The secret-handling caveat (travels through conversation; answer never echoes values) is genuinely useful behavioral context.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loads the create-or-replace purpose and is organized into logical paragraphs, but is dense and lengthy; the running-evaluation cancellation details, while useful, could be tightened. For a tool with this much subtle semantics the length is largely justified, and no sentence is pure filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 7-parameter, nested-object mutation tool with no output schema and an idempotent+destructive profile, the description covers the mutation semantics, defaults, secret handling, auth prerequisite, and what the response reports. Nothing an agent must know to invoke it correctly appears to be missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline is 3, but the description adds real meaning not in the schema: block requires block_at, org_name defaults to the first-joined org, omitted secrets keep stored values, and enforcement's monitor/block distinctions. This meaningfully compensates for schema-only documentation of the two enums.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb+resource and scope: 'Add a release policy to an organization, or replace the one with the same name.' It distinguishes itself from siblings by naming list_policies for checker discovery and implicitly contrasting with destroy_policy's removal semantics. An agent can tell exactly what this does without opening the schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Routes the agent to list_policies for checker names and settings, and to the `valet policies add` CLI path when a secret should not travel through the conversation. These are explicit alternatives for real sub-decisions. It stops short of a crisp when-not-to-use statement for the tool as a whole, but context is clear.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Try in Browser

Glama MCP Gateway

Add one secure layer between your agents and this server.

Resources