Skip to main content
Glama

simplepractice_verify_sign_in_pin

Destructive

Exchange a 6-digit Client Portal sign-in PIN for a session when a practice emails a code instead of a link; single-use.

Instructions

Exchange a 6-digit Client Portal sign-in PIN for a session, for practices that email a code instead of a link. Single-use.

Input Schema

NameRequiredDescriptionDefault
pinYes
emailYesThe address the PIN was sent to.

Schema Changelog

Changes observed during successful MCP inspections.

  1. Changed1 schema field changedv1.0.0
    • changedInput schema / $schema
      Previous value: -"http://json-schema.org/draft-07/schema#"New value: +"https://json-schema.org/draft/2020-12/schema"
  2. Changed1 schema field changedv0.4.2
    • changedInput schema / properties / email / pattern
      Previous value: -"^(?!\\.)(?!.*\\.\\.)([A-Za-z0-9_'+\\-\\.]*)[A-Za-z0-9_+-]@([A-Za-z0-9][A-Za-z0-9\\-]*\\.)+[A-Za-z]{2,}$"New value: +"^(?:[A-Za-z0-9_'+\\-]+\\.)*[A-Za-z0-9_'+\\-]*[A-Za-z0-9_+-]@(?:[A-Za-z0-9][A-Za-z0-9\\-]*\\.)+[A-Za-z]{2,}$"
  3. First observedv0.1.0

TDQS

A4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare destructiveHint=true, idempotentHint=false, and openWorldHint=true, so the safety profile is covered. The description usefully adds 'Single-use,' which reinforces the non-idempotent nature of the PIN, but it says nothing about what a 'session' means, whether it mutates server state, or any expiry/auth constraints. No contradiction with the annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two short sentences with the action and scope front-loaded and the single-use constraint appended. Every clause earns its place; there is no filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a no-output-schema tool, the description conveys both the input semantics (6-digit PIN, email) and the outcome (a session). What the returned session looks like and its lifetime are unstated, but the annotations carry the mutation/safety context, so the gap is minor.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 50%: email is documented in the schema, while pin has only a regex pattern and no description. The description compensates minimally by restating '6-digit PIN', which aligns with the schema pattern but adds no new format or source information. Baseline 3 is appropriate given the schema does most of the work.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb+resource (exchange a 6-digit PIN for a session) with a clear scope qualifier ('for practices that email a code instead of a link'). This cleanly distinguishes it from the sibling verify_sign_in_token, which handles link-based sign-in.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The phrase 'for practices that email a code instead of a link' tells the agent the exact condition under which this tool applies rather than its siblings. It stops short of naming the alternatives (request_sign_in_link, verify_sign_in_token) or stating when not to use it, so it is clear context but not fully explicit routing.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.