Skip to main content
Glama
Clamepending

ottoauthMCP

by Clamepending

ottoauthMCP

Standalone MCP stdio server that proxies tool calls to Ottoauth HTTP endpoints.

Features

  • Discovers service endpoints from GET /api/services docs.

  • Registers dynamic MCP tools per endpoint.

  • Refreshes discovered tools once every hour.

  • Includes a generic passthrough tool: ottoauth_http_request.

  • Includes a built-in account creation tool: ottoauth_create_account.

  • Runs an Ottoauth webhook receiver and relays incoming events to an agent gateway with retries.

Related MCP server: SentinelX Core MCP

Run

npm install
OTTOAUTH_BASE_URL=http://localhost:3000 npm start

Webhook receiver defaults:

  • host: 127.0.0.1

  • port: 3789

  • path: /webhooks/ottoauth

Important env vars:

  • OTTOAUTH_WEBHOOK_SECRET (recommended; validates x-ottoauth-signature)

  • OTTOAUTH_WEBHOOK_ALLOW_UNSIGNED=1 (dev only)

  • OTTOAUTH_WEBHOOK_PORT / OTTOAUTH_WEBHOOK_HOST / OTTOAUTH_WEBHOOK_PATH

  • AGENT_GATEWAY_URL (relay destination)

  • AGENT_GATEWAY_AUTH_TOKEN (optional bearer token to gateway)

  • WEBHOOK_RETRY_BASE_MS (default 2000)

  • WEBHOOK_RETRY_MAX (default 8)

  • WEBHOOK_EVENT_STORE_PATH (defaults to .ottoauth-webhook-events.json in cwd)

Tests

npm test

Test coverage includes:

  • parser and normalization edge cases

  • timeout and forwarding behavior

  • webhook signature, dedupe, retries, dead-letter

  • MCP stdio end-to-end flow

  • integration test using simple demo agent script from neighboring autoauth repo

MCP client config example

{
  "mcpServers": {
    "ottoauth": {
      "command": "node",
      "args": ["/absolute/path/to/ottoauthMCP/src/index.mjs"],
      "env": {
        "OTTOAUTH_BASE_URL": "https://your-ottoauth-domain.com"
      }
    }
  }
}

Available Tools

7 tools
ottoauth_create_accountOttoauth Create AccountA

Create a new Ottoauth account (agent) and return credentials, including the private key.

ParametersJSON Schema
NameRequiredDescriptionDefault
usernameYesAgent username to create (must be unique in Ottoauth).
descriptionNoOptional short profile description for the agent.
callback_urlNoOptional callback URL where Ottoauth can post account events.

TDQS

A3.7/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the burden of behavioral disclosure. It correctly states that this is a creation operation and that the response includes a private key, which is important context. However, it does not mention permission requirements, uniqueness failure behavior, or security handling of the returned private key.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is one sentence with no filler. It front-loads the action, names the resource, and mentions the important output. Every word contributes useful information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple create operation with no output schema and no annotations, the description is adequate but not rich. It states the core action and the critical output, but it omits return format details, error behavior, and any caveats about username uniqueness or private key handling.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so each parameter is already documented in the input schema. The description adds no parameter-specific meaning beyond noting that credentials and a private key will be returned, so a baseline score of 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb ('Create'), names the exact resource ('new Ottoauth account (agent)'), and states the key output ('return credentials, including the private key'). This clearly differentiates it from the sibling webhook and HTTP request tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies the tool's use case: creating a new account. However, it does not explicitly mention when to use this tool versus an alternative, nor does it state exclusions or prerequisites. The sibling tools are domains away, so the omission is not critical, but guidance is still minimal.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

ottoauth_http_requestOttoauth HTTP RequestA

Generic Ottoauth passthrough tool. Use this if no endpoint-specific tool matches your request.

ParametersJSON Schema
NameRequiredDescriptionDefault
bodyNoJSON body to forward as-is to Ottoauth.
pathYesAbsolute Ottoauth path like /api/services/amazon/buy.
queryNoOptional query string parameters.
methodYesHTTP method to call.
headersNoOptional additional HTTP headers.

TDQS

A3.6/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the burden of disclosing behavior. It only says 'passthrough' and 'fallback', but does not mention forwarding semantics, mutating effects of non-GET methods, authentication behavior, response format, or error handling. This is a significant gap for a generic tool.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, no filler, with the core purpose and usage guidance front-loaded. Every word earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a generic passthrough tool with no annotations and no output schema, the description is too terse. It omits what the response looks like, whether the request is forwarded as-is, potential side effects, and any constraints on acceptable paths beyond the schema. An agent would need to guess at behavior.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema fully documents all parameters. The description adds no additional parameter detail, which is acceptable but does not exceed the baseline for fully-covered schemas.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description explicitly identifies the tool as a generic passthrough for Ottoauth HTTP requests, which is a clear action+resource combination. It also distinguishes itself from endpoint-specific siblings by positioning itself as the fallback when no other tool matches.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives explicit usage context: use this tool only when no endpoint-specific tool matches the request. This implies the main exclusion (prefer specific siblings) without naming each alternative, which is adequate given the sibling list is available.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

webhook_get_eventWebhook Get EventB

Get a specific webhook event by id.

ParametersJSON Schema
NameRequiredDescriptionDefault
event_idYes

TDQS

B3.4/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden of behavioral disclosure. It only states the operation and does not mention read-only nature, error handling for missing IDs, rate limits, or response format.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, focused sentence with no wasted words. The core action and target are immediately clear.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple one-parameter get operation, the description covers the basic intent, but without an output schema or annotations it omits return-value details, possible errors, and behavioral context, leaving some ambiguity for the agent.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0% and the description only says 'by id', which adds minimal meaning beyond the already self-descriptive property name 'event_id'. It does not explain where the ID comes from or its format.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action ('Get'), the resource ('webhook event'), and the selection criterion ('by id'), which distinguishes it from siblings like webhook_list_events and webhook_replay_event.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The phrase 'by id' implies the tool is used when a specific event ID is known, but there is no explicit guidance about when to choose this over list or replay, or any mention of prerequisites.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

webhook_list_eventsWebhook List EventsA

List received webhook events with optional status filtering and pagination.

ParametersJSON Schema
NameRequiredDescriptionDefault
limitNo
offsetNo
statusNo

TDQS

A3.6/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden. It discloses that this is a read-style list operation with optional filtering and pagination, which conveys the core behavior. It does not mention ordering, defaults, response shape, or potential side effects, but for a list endpoint the main behavioral risks are minimal.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single sentence with no filler. It front-loads the primary action and appends the key modifiers. It is concise and easy to parse, though slightly under-specified for the zero-coverage schema.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool is a simple optional-parameter list operation, so a brief description is somewhat reasonable. Still, with no annotations and no output schema, the description could have provided more context about pagination behavior, default limits, or ordering. It is adequate for basic invocation but leaves some gaps for an agent to infer.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate. It does mention that status filtering is optional and that pagination is supported, which maps to the status, limit, and offset parameters. However, it does not explain the meaning of limit and offset beyond what their names already imply, nor does it describe defaults or edge cases.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb and resource: 'List received webhook events'. It also mentions optional status filtering and pagination, which distinguishes it from sibling tools like webhook_get_event, webhook_replay_event, and webhook_status. The scope is clear and the tool's purpose is immediately identifiable.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies the tool is for listing received webhook events, optionally filtered by status or paginated. However, it does not explicitly state when to choose this over webhook_get_event, webhook_replay_event, or other siblings. Usage context is implied rather than explicitly guided.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

webhook_replay_eventWebhook Replay EventA

Force a webhook event to be re-queued and relayed immediately to the configured gateway.

ParametersJSON Schema
NameRequiredDescriptionDefault
event_idYes

TDQS

A3.7/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the burden of behavioral disclosure. It explains the primary side effect (re-queuing and immediate relay) but does not mention idempotency, duplicate-delivery risk, behavior for unknown event IDs, or permission requirements.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, efficient sentence that front-loads the action and outcome. There is no redundant phrasing or unnecessary detail.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool is simple with one parameter, but with no annotations and no output schema, the description leaves gaps around failure behavior, prerequisites, and what response to expect. It is adequate for basic invocation but not fully self-sufficient.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema only defines event_id as a string with minLength 1, and the description adds no explicit parameter explanation. The connection between event_id and 'a webhook event' is inferable, but at 0% schema description coverage, the description should have directly identified event_id as the target event's ID.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific action ('force a webhook event to be re-queued and relayed immediately') with a clear resource and effect. It distinguishes itself from read-oriented siblings like webhook_get_event and webhook_list_events.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The intended use is implied by the tool name and the phrase 're-queued and relayed,' but there is no explicit guidance on when to use this tool versus alternatives like webhook_get_event or webhook_status. No exclusions, prerequisites, or conditions are stated.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

webhook_set_gatewayWebhook Set GatewayB

Update relay destination for webhook forwarding (can override env config at runtime).

ParametersJSON Schema
NameRequiredDescriptionDefault
gateway_urlNo
gateway_auth_tokenNo

TDQS

B3.1/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations available, the description carries the full burden of behavioral disclosure. It does reveal one meaningful behavior—that the call can override environment configuration at runtime—but it does not disclose side effects, persistence, whether the change is reversible, or any security implications of setting a gateway auth token.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single, tight sentence with no filler. The core action is front-loaded, and the important runtime-override caveat is included efficiently. Every word earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool that mutates webhook forwarding configuration, the description omits important context such as when this should be called, what the consequences of changing the destination are, and what happens to existing in-flight or future webhook deliveries. The absence of annotations and output schema makes these omissions more significant.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate for both parameters. It adds meaning for gateway_url by calling it a 'relay destination,' but it never explains gateway_auth_token or how the two parameters interact with the runtime override behavior.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb and resource: 'Update relay destination for webhook forwarding.' This clearly distinguishes it from sibling tools like webhook_list_events, webhook_get_event, and webhook_status, which are read-oriented, and webhook_replay_event, which deals with replay rather than configuration.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no guidance about when to use this tool versus alternatives, and no exclusions or prerequisites are mentioned. The phrase 'can override env config at runtime' hints at a use case, but it does not tell the agent when this override is appropriate or when to prefer another configuration path.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

webhook_statusWebhook StatusA

Get webhook receiver and relay status, including configured gateway and event counts.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A4.2/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden of conveying behavior. The verb 'Get' and the word 'status' imply a read-only, non-mutating operation, but the description does not explicitly state that it has no side effects or prerequisites. It provides useful content detail but leaves some safety inference to the agent.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single sentence that starts with the action and object, then concisely adds the two key data categories. No filler, redundancy, or unnecessary explanation.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a zero-parameter status tool with no output schema, the description gives the essential information: what status is returned and the included details. It does not specify the response shape, but the simplicity of a status read and the explicit content list make this sufficient for correct invocation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has zero parameters, so there is nothing for the description to explain about inputs. The empty schema already covers 100% of parameters, and the baseline for zero-parameter tools is 4.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific action ('Get') and resource ('webhook receiver and relay status'), and adds concrete detail about the returned data (configured gateway, event counts). This clearly differentiates it from sibling tools like webhook_list_events, webhook_get_event, and webhook_set_gateway.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The phrase 'Get webhook receiver and relay status' makes the primary use case obvious: checking the current state of webhook infrastructure. It does not explicitly name alternatives or state when not to use it, but the context is clear enough that an agent can select it appropriately among the event-focused siblings.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 7 tool updatesv0.1.0
    • First observedottoauth_create_account
    • First observedottoauth_http_request
    • First observedwebhook_get_event
    • First observedwebhook_list_events
    • First observedwebhook_replay_event
    • First observedwebhook_set_gateway
    • First observedwebhook_status

TDQS

A3.6/5.0

Scored across 7 tools

Disambiguation4/5

The webhook-specific tools are clearly distinct in purpose, and the generic passthrough tool explicitly defers to endpoint-specific tools. However, webhook_status and webhook_list_events both involve event counts/status, which could cause some initial confusion.

Naming Consistency3/5

Most tools use snake_case with a domain prefix, but the pattern is inconsistent: some are verb-first (ottoauth_create_account), some are noun-phrases (webhook_status), and ottoauth_http_request breaks the verb_noun convention. The mixed prefixes make the set feel less uniform.

Tool Count5/5

Seven tools is a well-scoped size for this server. Each tool covers a meaningful operation without redundancy, and the generic passthrough fills edge cases without bloating the surface.

Completeness4/5

The webhook event lifecycle is well covered with list, get, replay, and gateway configuration, plus account creation. Minor gaps exist such as no explicit account deletion or webhook clearing, but the generic HTTP passthrough mitigates dead ends.

Maintenance

ActivityInactive
ResponsivenessNo issues

Related MCP Connectors

Related MCP Servers