Skip to main content
Glama
Sign In
VPSnet

VPSnet

by bacarrdy
OverviewSchemaSourceRelated ServersDiscussionsAdmin
TypeScript
Hybrid

Set network VPN peer grants

set_network_vpn_peer_grants
DestructiveIdempotent

Replace a VPN peer's server-access grants to allow selected servers, grant all eligible current and future network servers, or revoke access; confirm scope and required route updates.

Instructions

Replace the peer's complete server-access choice using the gateway generation. Read the gateway and current grant_scope first. Omitted grant_scope means servers: supply the full 0-16 address list; this also disables a device's previous network-wide access to future servers, even if today's list is unchanged. Empty grants removes a device's server access; a site still needs at least one grant. grant_scope=network is device-only: omit grants or send [] to allow every eligible current and future server of the network, subject to network security policy. Confirm that scope and its effects. Check routes_update for required customer router/client changes. Requires explicit networking:read for reads or networking:manage for changes; full/read defaults do not grant networking. The backend enforces ownership, feature availability and service 2FA locks. Read current capabilities and owned resource state first; obtain approval for the exact change. An accepted operation is pending, not proof of connectivity. Poll the returned operation/resource on its in_progress flag, waiting next_check_seconds between reads: while in_progress is true its reason_code is what is awaited (reason_kind waiting, e.g. a queued or pending reason, or a control plane that has not answered yet), never an error; only in_progress false with reason_kind failure is a failure. Preserve reason_code. On transport uncertainty inspect state and reuse only the original key and unchanged request; never automatically retry.

Input Schema

NameRequiredDescriptionDefault
grantsNo
peer_idYesExact lowercase UUID returned by an owned networking resource
gateway_idYesExact lowercase UUID returned by an owned networking resource
grant_scopeNoservers (default) chooses individual grants; network grants a device every eligible current and future server of this network, subject to network security policy. Network scope requires empty grants and is unavailable for sites.
idempotencyKeyYesIdempotency-Key for this exact change; preserve it and the unchanged body on uncertain recovery
expected_generationYes

Schema Changelog

Changes observed during successful MCP inspections.

  1. Changed2 schema fields changedv2.3.20
    • addedInput schema / properties / grant_scope
      Added value: +{
+  "description": "servers (default) chooses individual grants; network grants a device every eligible current and future server of this network, subject to network security policy. Network scope requires empty grants and is unavailable for sites.",
+  "enum": [
+    "servers",
+    "network"
+  ],
+  "type": "string"
+}
    • changedInput schema / required
      Previous value: -[
-  "gateway_id",
-  "peer_id",
-  "expected_generation",
-  "grants",
-  "idempotencyKey"
-]New value: +[
+  "gateway_id",
+  "peer_id",
+  "expected_generation",
+  "idempotencyKey"
+]
  2. First observedv2.3.16

TDQS

A4.2/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Discloses substantial behavior beyond the annotations: replacement (not merge) semantics, that omitting grant_scope silently defaults to servers and disables prior network-wide access even when today's list is unchanged, that empty grants revokes access, that sites must retain at least one grant, and the exact permission scopes (networking:read vs networking:manage) plus 2FA/ownership enforcement. It also explains async acceptance semantics — in_progress with reason_kind waiting is never an error, only in_progress false with reason_kind failure is — and mandates polling with next_check_seconds and idempotency-key reuse on transport uncertainty.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The core mutation and its destructive default are front-loaded, but the paragraph becomes a dense wall of clauses mixing permissions, async polling protocol, and retry rules. Most sentences earn their place individually, yet the polling/idempotency guidance could be shortened and partially duplicates the idempotencyKey and grant_scope schema text.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a destructive, idempotent, async mutation with no output schema, the description covers everything needed to call it safely: preconditions, defaults, revocation edge cases, required permission scopes, acceptance-vs-success semantics, and recovery on transport failure. Nothing material is left to guess.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 67%, and the description compensates by explaining that omitted grant_scope means servers with a full 0-16 address list, that network scope requires omitted/[] grants, and that expected_generation is the stale-write guard. Some of this repeats the schema's own grant_scope description, so it adds meaning but not without overlap.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource: it replaces a peer's complete server-access choice, and pins which generation is being superseded. It is distinguishable from sibling mutations like set_vpn_server_access and set_network_vpn_peer_egress by the 'grants' scope, though it never names those siblings directly.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives strong procedural context: read the gateway and current grant_scope first, confirm scope and its effects, check routes_update, obtain approval, and note that network scope is device-only and unavailable for sites. It stops short of explicit routing such as 'use set_vpn_server_access for sites instead', so the when-not case is only implied by 'a site still needs at least one grant'.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Deploy Server

Other Tools