Skip to main content
Glama
Sign In
MCP Object-Authz Lab

MCP Object-Authz Lab

by WRG-11
OverviewSchemaSourceRelated ServersDiscussionsAdmin
JavaScript
Local

note_export

Export all notes for an organization to enable backups or audits. Use org_id='*' for a global export, available to admins only.

Instructions

Export all notes for an organization. Pass org_id='*' for a global export (admin only).

Tool call template

Replace each placeholder with a value matching the input schema. Only required parameters are included; add optional parameters as needed.

{
  "id": 1,
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "arguments": {
      "token": "<token>"
    },
    "name": "note_export"
  }
}

Input Schema

NameRequiredDescriptionDefault
tokenYes
org_idNo

Schema Changelog

Changes observed during successful MCP inspections.

  1. Addedv3.10.0

TDQS

B3/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden of behavioral disclosure. It only mentions the admin-only restriction for the wildcard org_id; it does not reveal whether the operation is read-only, returns a downloadable file, triggers a side effect, or produces a large payload, and it offers no information about rate limits or failure modes.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two short sentences with no fluff: the core purpose is front-loaded, and the admin-only caveat is a natural follow-up. Every word earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with no annotations and no output schema, this description is incomplete. The required token parameter is undocumented, the export output format is entirely unspecified, and the behavior when org_id is omitted is not addressed. The only complete context is the wildcard global-export path.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate for both parameters. It explains org_id's special '*' value and the admin constraint, but it never mentions token—the only required parameter—or even what a normal org_id should look like. This leaves a significant gap for the required parameter.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb ('export') and a clear resource ('all notes for an organization'), and it adds the wildcard behavior for global exports. However, it does not explicitly contrast itself with sibling tools like note_list or note_get, so the agent must infer the distinction from the word 'export' alone.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It provides a clear context for org-scoped exports and flags global export as admin-only, which gives some usage boundary. But it does not state when to use this tool over alternatives like note_list or note_search, nor does it explain what happens when org_id is omitted.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Deploy Server

Other Tools