Skip to main content
Glama

WorldAPI tokens

list_tokens
Read-onlyIdempotent

List and inspect each WorldAPI token's configuration details, including groups, permissions, and expiry, without exposing the tokens themselves. Use it to audit token setups and permission resolutions.

Instructions

Every WorldAPI token: its name, the groups and permissions in its config, the permissions they resolve to, where it came from, who made it, and when it expires. The tokens themselves never show. groups adds every group with what it resolves to, and every permission with what it allows. Needs tokens:manage. Tokens are made in game (/worldapi token create) or in WorldAPI's admin panel, not here.

Input Schema

NameRequiredDescriptionDefault
groupsNoAdd the groups and permissions

Schema Changelog

Changes observed during successful MCP inspections.

  1. First observedv4.1.0

TDQS

A4.4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already cover read-only, idempotent, non-destructive, so the description's added value is the secrets policy (token values are withheld) and the permission gate — genuinely useful context beyond the annotations. It does not mention result size, pagination, or ordering for large token sets.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded with the returned fields, then the flag semantics, then the permission gate, then the creation note. Four sentences with no filler, though the first two sentences partly overlap in listing group/permission data twice.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

There is no output schema, so the description carries the return-shape burden and does so by enumerating the fields and noting that token secrets are excluded. Combined with the permission requirement and the creation-location note, an agent has everything needed to call it correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% and the schema says only "Add the groups and permissions"; the description expands this meaningfully by explaining that groups adds each group with its resolution and each permission with what it allows, i.e. the effect of the flag and the extra data. Slightly above the baseline 3 for a documented single flag.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description names the resource (WorldAPI tokens) and enumerates exactly what is returned: name, config groups/permissions, resolved permissions, origin, creator, expiry. It also states what is NOT returned ("The tokens themselves never show"), which sharply distinguishes this from any credential-dumping tool.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It states the prerequisite ("Needs tokens:manage") and explicitly rules out the create path by pointing to the in-game command and admin panel "not here". There is no token-related sibling to route against, so no alternative tool comparison is possible, which keeps this at 4 rather than 5.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.