Opsphere — DevOps & SRE Intelligence

AWS SSO Global Start (nonprod + prod)

aws_sso_login_global_start

Start remote SSO login for global coverage (typically nonprod + prod SSO profiles). When profiles are omitted, uses SSO profiles from the cloud catalog for this tenant. Returns a batch with device code logins (flow_type=device_code_batch).

Input Schema

Name	Required	Description
`profiles`	No	Optional AWS profile names; when omitted, defaults are resolved from the cloud catalog.
`context_id`	No	Optional explicit Connection Hub work context (ctx_*). Omit to use the conversation's active workspace; global Hub tools ignore it.
`dedupeBySsoSession`	No	Si true (default), evita login duplicado cuando perfiles comparten la misma sso_session.

Output Schema

Name	Required	Description	Default
`ok`	Yes
`data`	Yes
`contractVersion`	Yes
`dataSchemaVersion`	Yes

Schema Changelog

Changes observed during successful MCP inspections.

Changed3 schema fields changedOct 26, 2026
- addedOutput schema / properties / data / properties / errorCode
```
Added value: +{
+  "type": "string"
+}
```
- addedOutput schema / properties / data / properties / retryable
```
Added value: +{
+  "type": "boolean"
+}
```
- addedOutput schema / properties / data / properties / status
```
Added value: +{
+  "type": "string"
+}
```
Changed18 schema fields changedOct 26, 2026
- addedOutput schema / properties / data / properties / deviceCode
```
Added value: +{
+  "type": "string"
+}
```
- addedOutput schema / properties / data / properties / expiresIn
```
Added value: +{
+  "type": "integer"
+}
```
- addedOutput schema / properties / data / properties / flowType
```
Added value: +{
+  "enum": [
+    "completed",
+    "device_code",
+    "oauth_pkce",
+    "unknown"
+  ],
+  "type": "string"
+}
```
- removedOutput schema / properties / data / properties / format
```
Removed value: -{
-  "enum": [
-    "plain",
-    "markdown",
-    "json"
-  ],
-  "type": "string"
-}
```
- addedOutput schema / properties / data / properties / instructions
```
Added value: +{
+  "type": "string"
+}
```
- addedOutput schema / properties / data / properties / message
```
Added value: +{
+  "type": "string"
+}
```
- addedOutput schema / properties / data / properties / oauthUrl
```
Added value: +{
+  "type": "string"
+}
```
- addedOutput schema / properties / data / properties / profile
```
Added value: +{
+  "type": "string"
+}
```
- addedOutput schema / properties / data / properties / ssoRequired
```
Added value: +{
+  "type": "boolean"
+}
```
- addedOutput schema / properties / data / properties / success
```
Added value: +{
+  "type": "boolean"
+}
```
- removedOutput schema / properties / data / properties / text
```
Removed value: -{
-  "type": "string"
-}
```
- addedOutput schema / properties / data / properties / userCode
```
Added value: +{
+  "type": "string"
+}
```
- addedOutput schema / properties / data / properties / verificationUri
```
Added value: +{
+  "type": "string"
+}
```
- addedOutput schema / properties / data / properties / verificationUriComplete
```
Added value: +{
+  "type": "string"
+}
```
- addedOutput schema / properties / data / properties / workaround
```
Added value: +{
+  "type": "string"
+}
```
- changedOutput schema / properties / data / required
```
Previous value: -[
-  "text"
-]New value: +[
+  "flowType",
+  "profile"
+]
```
- addedOutput schema / properties / dataSchemaVersion
```
Added value: +{
+  "const": 2,
+  "type": "number"
+}
```
- changedOutput schema / required
```
Previous value: -[
-  "contractVersion",
-  "ok",
-  "data"
-]New value: +[
+  "contractVersion",
+  "dataSchemaVersion",
+  "ok",
+  "data"
+]
```
First observedOct 15, 2026

TDQS

A3.6/5.0

Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With annotations already declaring non-readonly, non-destructive, non-open-world behavior, the description adds useful context: it returns a batch with device code logins (flow_type=device_code_batch) and resolves omitted profiles from the cloud catalog. It does not state auth prerequisites or whether starting a login creates persistent state, but the added return-flow detail is meaningful beyond annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is three tight sentences, front-loaded with the action and scope, followed by default resolution and return shape. Every sentence contributes information without repetition.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description covers the core operation, default resolution, and return shape, which is adequate given the output schema and annotations. However, it omits explicit guidance on choosing this tool over the several other SSO login siblings, leaving a meaningful selection gap for an agent.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already documents all three parameters. The description restates the profiles default behavior and adds 'typically nonprod + prod' context, but does not clarify dedupeBySsoSession or context_id beyond what the schema provides. Baseline 3 applies when the schema carries parameter documentation.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description gives a specific verb and resource ('Start remote SSO login') plus a scope ('global coverage, typically nonprod + prod SSO profiles'). It does not explicitly name the sibling alternatives (e.g., aws_sso_login_remote, aws_sso_login_device_start) that an agent must choose between, so differentiation is implied rather than stated.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The only usage rule is 'When profiles are omitted, uses SSO profiles from the cloud catalog for this tenant', which is parameter default behavior rather than when to choose this tool over siblings. The name and title imply global login, but there are no explicit when/when-not conditions or named alternatives.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

All Opsphere — DevOps & SRE Intelligence tools Inspect

Try in Browser

One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

Glama MCP Gateway

Add one secure layer between your agents and this server.

Resources

Need Help?