Skip to main content
Glama

revoke_refresh_token

Destructive

Revoke a refresh token to invalidate it. The API always reports success, so treat as requested, not confirmed; access tokens remain valid up to 15 minutes.

Instructions

Revoke a refresh token. SUCCESS HERE IS NOT EVIDENCE THAT ANYTHING HAPPENED.

    `token` is the refresh token itself, not a client id and not an access token.

    THE ENDPOINT ANSWERS SUCCESS WHETHER OR NOT THE TOKEN EXISTED. RFC 7009 §2.2
    specifies that deliberately, so the endpoint cannot be used to discover whether a
    token is valid. A typo, an already-revoked token and a real revocation are
    indistinguishable in the response. Report that this was REQUESTED, never that it
    was confirmed.

    This is also the one call in this server that sends no credentials at all — the
    token is the authorization. Do not paste one into a transcript on the way here.

    Revoking a refresh token does not kill access tokens already issued from it;
    those live until they expire, which for this API is fifteen minutes.

    Requires the `admin` capability profile. No OAuth scope, because no token of ours
    is sent.
    

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
tokenYes
token_type_hintNorefresh_token

Output Schema

TableJSON Schema
NameRequiredDescriptionDefault
noteYes
requestedYes
Install Server

TDQS

A4.7/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description goes far beyond the destructiveHint annotation, disclosing that success is not evidence of action, that revoked and non-existent tokens are indistinguishable, that no credentials are sent, and that revoking a refresh token does not invalidate already-issued access tokens. This is exemplary behavioral disclosure.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Every sentence earns its place, from the critical 'SUCCESS HERE IS NOT EVIDENCE' warning to the access-token lifetime detail. The most important behavioral caveat is front-loaded, and the structure makes the tool's risks immediately visible.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description is complete for a destructive, side-effect-bearing operation: it covers expected behavior, false-success semantics, credential requirements, capability requirements, and downstream effects on access tokens. Nothing essential for safe invocation is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With 0% schema description coverage, the description carries the burden of explaining parameters. It clearly defines `token` as the refresh token itself and excludes common confusions like client id and access token. It does not explicitly explain `token_type_hint`, but its default of `refresh_token` reduces the gap.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource: 'Revoke a refresh token.' It immediately distinguishes the token from a client id and an access token, making the tool's scope unambiguous and separating it from OAuth client management siblings.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives clear context for how and when to use the call, including that it requires the admin capability profile and that it is the one call sending no credentials. It does not explicitly contrast with alternative sibling tools, but the uniqueness of refresh-token revocation is strongly implied.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Other Tools

Latest Blog Posts

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/CloudSecurityAlliance/csa-skilljar'

If you have feedback or need assistance with the MCP directory API, please join our Discord server