Skip to main content
Glama
Sign In
Kiln

Kiln

by codeofaxel
OverviewSchemaSourceRelated ServersDiscussionsAdmin
Python

kiln_spend_caps_confirm_change

Destructive

Confirms a spend-cap change by verifying the person's six-digit authenticator code after a change request. Use the challenge ID from step 1; returns the new caps or a refusal reason.

Instructions

Confirm a cap change with the person's six-digit code (step 2 of 2).

        Args:
            challenge_id: From ``kiln_spend_caps_request_change``.
            totp_code: The six-digit code the PERSON reads from their own
                authenticator app.  Never produce or guess it.

        Returns the new caps on success.  A refusal names its case: a
        wrong code (they may try again within the daily limit), a
        challenge that expired or was already used (ask again from step
        1), no authenticator set up on the account, or too many attempts.

Tool call template

Replace each placeholder with a value matching the input schema. Only required parameters are included; add optional parameters as needed.

{
  "id": 1,
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "arguments": {
      "challenge_id": "<challenge_id>",
      "totp_code": "<totp_code>"
    },
    "name": "kiln_spend_caps_confirm_change"
  }
}

Input Schema

NameRequiredDescriptionDefault
totp_codeYesThe six-digit code the PERSON reads from their own authenticator app. Never produce or guess it.
challenge_idYesFrom ``kiln_spend_caps_request_change``.

Output Schema

NameRequiredDescriptionDefault

No arguments

Schema Changelog

Changes observed during successful MCP inspections.

  1. Changed2 schema fields changedv1.5.1
    • addedInput schema / properties / challenge_id / description
      Added value: +"From ``kiln_spend_caps_request_change``."
    • addedInput schema / properties / totp_code / description
      Added value: +"The six-digit code the PERSON reads from their own authenticator app.  Never produce or guess it."
  2. Addedv1.5.0

TDQS

A4.6/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare this is a non-read-only, destructive operation; the description adds the behavior the agent cannot infer from them: the code must come from the human and must never be produced or guessed, and the outcome taxonomy (wrong code, expired/used challenge, no authenticator configured, too many attempts). It also states that success returns the new caps, closing the loop on what the mutation did.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loads the key framing ('step 2 of 2') and keeps the failure list tight and scannable. The docstring-style Args/Returns blocks duplicate the input schema and output schema somewhat, so a small amount of text does not earn its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a two-parameter, security-sensitive confirmation tool, the agent gets the flow position, parameter provenance, human-in-the-loop constraint, success result, and every refusal case with its recovery path. Nothing needed to call it correctly or to handle a failure is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so both parameters are already documented, and the description's Args block largely restates those schema descriptions verbatim. The only added meaning is lifecycle context — a wrong code is retryable within a daily limit, an expired challenge requires restarting at step 1 — which is useful but sits at the baseline for a fully-documented schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource (confirm a cap change) and immediately scopes it as 'step 2 of 2' of a named two-step flow. It explicitly ties itself to the sibling `kiln_spend_caps_request_change`, so an agent can distinguish this confirm step from the request step without reading either schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives explicit preconditions (challenge_id must come from `kiln_spend_caps_request_change`) and explicit recovery routing: a wrong code is retryable within the daily limit, while an expired or already-used challenge means restarting from step 1. That is when-to-use and when-not-to-retry guidance in concrete terms.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Deploy Server

Other Tools