Skip to main content
Glama

bowire.auth-recording.capture-flow

Runs a scriptable login-to-token auth flow, captures the token, and stores it as a named auth recording for mocks. Requires flow-capture enabled and confirmation by default.

Instructions

Run an auth flow (a scriptable login → token chain) and store the captured token as a named auth recording. Bowire EXECUTES the flow — an outbound HTTP call — so this is two-step by default (confirm=true / confirmationToken). Secrets in the flow are read from {{env.NAME}}, never inlined. Requires a host with flow-capture enabled; returns an error otherwise. Parity with bowire auth-recording capture --flow and the workbench's flow-capture.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
idYesRecording id, referenced by a mock's auth.authRecordingId.
flowYesThe auth-flow definition as JSON (ordered request steps + a token capture). Same shape as `bowire scan --auth-flow`.
nameNoHuman label for the picker (default: the id).
confirmNoSkip the pending-confirmation step.
workspaceNoWorkspace to store under. Empty = the shared, unscoped store.
confirmationTokenNoConfirmation token returned by a prior pending call.

Schema Changelog

Changes observed during successful MCP inspections.

  1. First observedv0.1.0

TDQS

A4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden, and it does substantial work: it discloses that Bowire EXECUTES the flow as an outbound HTTP call, that confirmation is required by default, that secrets come from {{env.NAME}} rather than being inlined, and that an unsupported host produces an error. It does not address idempotency or what happens to an existing recording under the same id.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Dense but front-loaded: the core action and its scope lead, followed by execution semantics, safety mechanics, and the host prerequisite. Every sentence carries information; the CLI/workbench parity clause is the only mildly expendable part.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 6-parameter mutating tool with no annotations and no output schema, the description covers the important ground: side effects, confirmation protocol, secret handling, and failure mode on unsupported hosts. Remaining gaps (overwrite behavior on duplicate id, where the token is persisted) are minor but real.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline is 3, but the description adds semantics the schema does not: confirm/confirmationToken implement a two-step pending-confirmation flow, and flow secrets resolve from env vars. It does not clarify id/name/workspace interaction beyond what the schema already says.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb + resource: it runs an auth flow (defined parenthetically as a scriptable login → token chain) and stores the captured token as a named recording. The parenthetical definition of 'flow' implicitly separates it from the single-request sibling bowire.auth-recording.capture, but the sibling is never named, so the distinction still takes a small inference.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives real operating context: it is two-step by default (confirm=true / confirmationToken) and requires a host with flow-capture enabled, otherwise it errors. It never states when to prefer this over bowire.auth-recording.capture or how to obtain the confirmation token, so there is context but no explicit alternative selection.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.