Skip to main content
Glama

Revoke an owner token

revoke_token
DestructiveIdempotent

Revokes owner tokens. Inputs: token, and optional scope. Scope "current" (the default) revokes the token that was sent. Scope "all" revokes every token for that principal, including any overlap window. A later request with a revoked token returns 401 token_revoked, which is distinct from 403 suspended. Sites stay online. Without a recovery email, a revoked token cannot update them.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
scopeNocurrent revokes only this token. all revokes every token for the principal. Default current.
tokenNoBearer token returned by your first publish (deed_tok_...). Optional if the MCP client sends Authorization: Bearer.

Schema Changelog

Changes observed during successful MCP inspections.

  1. Added

TDQS

A4/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations declare destructiveHint=true and idempotentHint=true, but the description goes well beyond them by disclosing the post-revocation error contract (401 token_revoked, distinct from 403 suspended), the fact that sites stay online, and the consequence that a revoked token cannot update sites without a recovery email. That is exactly the kind of downstream effect an agent needs before committing to a destructive call.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is dense, front-loaded with the core action, and nearly every clause carries information (scopes, error codes, side effects). The only slack is the "Inputs: token, and optional scope" clause, which restates what the schema already lists.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

There is no output schema, so the description must cover the return contract, and it does disclose the key failure mode (401 token_revoked vs 403 suspended) plus the effect on live sites. It stops short of describing the successful response shape, leaving a small gap for a mutation tool with no output schema.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline is 3, but the description adds real meaning the schema lacks: scope="all" also covers "any overlap window" of tokens, and it clarifies the distinction between the default current scope and the principal-wide behavior. It goes slightly beyond restating the enum.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource ("Revokes owner tokens") and immediately defines what each scope value does, so the agent knows exactly what operation is performed. It does not, however, differentiate itself from the lifecycle sibling rotate_token, which is the closest alternative in the toolset — so it falls short of a 5.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage is only implied: the scope semantics tell the agent which variant of the revocation to pick, but nothing states when an agent should revoke versus rotate a token, nor are prerequisites or alternatives named. There is no explicit "use this when…" or "use rotate_token instead when…" guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Try in Browser

Glama MCP Gateway

Add one secure layer between your agents and this server.

Resources