Skip to main content
Glama

Eight Sleep Privacy Audit

eight_sleep_privacy_audit
Read-onlyIdempotent

Audit the Eight Sleep MCP server's privacy posture by checking cache, token paths, environment variables, mutation gates, and redaction status—without revealing secret values.

Instructions

Return local privacy, cache, token-path, env-presence, mutation gate and redaction posture without revealing secret values.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
response_formatNomarkdown

Output Schema

TableJSON Schema
NameRequiredDescriptionDefault
notesYes
projectYes
cache_pathYes
token_pathYes
unofficialYes
stdout_safeYes
cache_enabledYes
config_sourceYes
secret_env_varsYes
local_config_pathYes
mutations_enabledYes
local_config_existsYes
raw_payloads_opt_inYes
privacy_mode_defaultYes
required_env_presentYes
redacted_key_patternsYes
local_config_secure_permissionsNo

Schema Changelog

Changes observed during successful MCP inspections.

  1. Addedv0.2.13
  2. Removedv0.2.6
  3. First observedv0.2.5

TDQS

A3.9/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already mark it read-only, idempotent, and non-destructive. The description adds important behavioral context by saying it returns 'local privacy, cache, token-path, env-presence, mutation gate and redaction posture' and explicitly guarantees that it does not 'reveal secret values'. This goes beyond the annotations and clarifies the tool's safety posture without contradicting any hint.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single focused sentence that front-loads the action and then lists the exact information categories the tool returns. There is no filler, no repetition of the title, and every phrase carries meaning, including the important caveat about not revealing secret values.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given a simple optional parameter, a rich output schema, and annotations covering read-only/idempotent behavior, the description provides the essential context: what the audit covers and the secret-redaction guarantee. It does not explicitly define the output format or mention when to use this over siblings, but the output schema and the concise scope keep the tool invokable by an agent.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, and the description does not mention the single response_format parameter or explain how 'markdown' versus 'json' affects the output. The schema's enum and default provide the structural meaning, but the description adds no additional value for choosing between the formats, so it fails to compensate for the parameter documentation gap.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description names a specific verb ('Return'), a specific resource ('privacy audit'), and enumerates the exact facets it reports: offal privacy, cache, token-path, env-presence, mutation gate, and redaction posture. This distinguishes it from sibling tools like cache_status or connection_status because it covers a broader posture instead of a single status.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies the tool is for auditing privacy and redaction posture, but it does not explicitly state when to prefer this tool over sibling tools such as eight_sleep_cache_status, eight_sleep_connection_status, or eight_sleep_agent_manifest. There is no when-not-to-use guidance or naming of alternatives, leaving the agent to infer the appropriate context.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.