Skip to main content
Glama

associate_mpa_team

Associate an AWS MPA approval team with a sensitive key-management operation to require multi-party sign-off before it completes, preventing any single custodian from acting alone.

Instructions

Call this to put a sensitive key-management operation behind Multi-Party Approval, so it requires sign-off from an AWS MPA approval team before it takes effect.

This is the APC equivalent of the dual-control requirement PCI PIN places on key management: no single custodian can complete the operation alone. Associating a team does not itself need approval; it changes how the named operation behaves from then on.

Once associated, calls to the covered operation return with an MpaStatus of PENDING rather than completing. See import_key for what that means in practice.

Args: action: The operation to protect. Currently only IMPORT_ROOT_PUBLIC_KEY_CERTIFICATE is supported by APC. mpa_team_arn: ARN of the AWS Multi-Party Approval team, of the form arn:aws:mpa:::approval-team/ requester_comment: Optional reason for the change, max 200 characters. Appears in CloudTrail in plaintext — no sensitive data.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
actionYes
mpa_team_arnYes
requester_commentNo

Schema Changelog

Changes observed during successful MCP inspections. Dates show when Glama detected each change.

  1. First observedv1.2.0

TDQS

A4.7/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden of behavioral disclosure and does so thoroughly. It reveals that the operation is persistent, not itself approval-requiring, causes covered calls to return MpaStatus PENDING, and logs requester_comment in CloudTrail plaintext. These are the non-obvious behavioral facts an agent needs.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is front-loaded with the main purpose, then covers behavioral consequences, then provides compact but complete parameter details. The PCI analogy is short and adds useful context without bloating the text. Every sentence earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a three-parameter tool with no output schema and no annotations, the description covers purpose, behavior, and all parameter constraints very well. The only minor gaps are that it doesn't describe the tool's own response—only the effect on future covered calls—and it doesn't explicitly mention how to undo the association. Still, an agent has enough to select and invoke it correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0%, so the parameter descriptions add essential meaning. The description gives the only currently supported action value, the exact ARN format for mpa_team_arn, and the max length plus plaintext-logging warning for requester_comment. This substantially exceeds what the bare schema provides.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The opening sentence states a specific action ('put a sensitive key-management operation behind Multi-Party Approval') and a specific resource (an AWS MPA approval team). It also distinguishes this from the related sibling tools by explaining that associating a team does not itself need approval but changes how the covered operation behaves from then on.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives clear invocation context: call this when you need to require MPA sign-off on a key-management operation. It also clarifies the timing—the association itself doesn't need approval, and future covered calls return PENDING—but it doesn't explicitly name alternatives or say when to use disassociate_mpa_team or get_mpa_team_association instead.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Latest Blog Posts

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/J8k3/aws-payment-cryptography-mcp'

If you have feedback or need assistance with the MCP directory API, please join our Discord server