Skip to main content
Glama
Sign In
Kiln

Kiln

by codeofaxel
OverviewSchemaSourceRelated ServersDiscussionsAdmin
Python

confirm_action

Destructive

Approve and execute a previously requested action by passing the confirmation token returned when confirmation mode blocks destructive tool calls.

Instructions

Execute a previously requested action that requires confirmation.

When ``KILN_CONFIRM_MODE`` is enabled, destructive tools (safety level
``"confirm"`` or ``"emergency"``) return a confirmation token instead of
executing immediately.  Pass that token here to proceed.

Args:
    token: The confirmation token returned by the original tool call.

Tool call template

Replace each placeholder with a value matching the input schema. Only required parameters are included; add optional parameters as needed.

{
  "id": 1,
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "arguments": {
      "token": "<token>"
    },
    "name": "confirm_action"
  }
}

Input Schema

NameRequiredDescriptionDefault
tokenYesThe confirmation token returned by the original tool call.

Schema Changelog

Changes observed during successful MCP inspections.

  1. Changed1 schema field changedv1.5.1
    • addedInput schema / properties / token / description
      Added value: +"The confirmation token returned by the original tool call."
  2. First observedv0.1.0

TDQS

A3.9/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare destructiveHint=true and readOnlyHint=false, and the description adds real context beyond that: the env-flag gating, that the original call is deferred rather than executed, and that this call is what actually proceeds. It omits token lifetime, single-use semantics, and failure behavior, which matter for a destructive operation.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The two-sentence core is front-loaded and earns its place, with the gating condition stated before the mechanics. The trailing Args block duplicates the schema field and could be dropped without loss.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a one-parameter tool with no output schema, the description covers what it does, when it applies, and what input it needs. What is missing is post-call behavior (does the original action's result return, and what happens on an expired token), which is the last piece an agent would want.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% and the single token parameter is fully documented in the schema. The description's Args section restates that same sentence verbatim, adding no new meaning such as token format, expiry, or reuse rules; baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource: it executes a previously requested action by consuming a confirmation token. The mechanism (destructive tools returning a token under KILN_CONFIRM_MODE) makes the intent unambiguous, though it never distinguishes itself from specialized confirm siblings such as upload_file_confirm or confirm_print_recovery.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives a precise trigger condition: use this only when a prior destructive call returned a token because KILN_CONFIRM_MODE is enabled. It does not address the reverse case (what to do if no token was issued) or name sibling alternatives, so there is a small inference gap.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Deploy Server

Other Tools