Firedrill operator MCP
OfficialServer Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| FIREDRILL_TOKEN | No | For CI, supply an authorized scoped FIREDRILL_TOKEN through the environment from your secret store. It takes precedence over saved login; CI never prompts or opens a browser. | |
| FIREDRILL_MCP_READONLY | No | Set to true to remove mutation tools while the API still checks current authority on every request. |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {
"listChanged": true
} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| firedrill_authenticateA | Authorize the coding-agent operator to use Firedrill on the human's behalf using WorkOS device approval. Shares the CLI's protected login; never returns tokens. Does not authenticate the coding-agent provider or the target application. status reads progress; start explicitly initiates approval or resumes the same protected sign-in after external action; choose selects a legal organization choice; cancel stops this local wait without discarding protected state. Do not start in CI. |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 1 tool
With only one tool, there is no possibility of confusing it with another tool. The tool's internal multi-mode nature (start/status/choose/cancel) affects parameter selection, not tool selection, so disambiguation across the set is trivially perfect.
The single tool name 'firedrill_authenticate' follows a clear snake_case verb_noun convention. With only one tool, there is no inconsistency to penalize.
A single tool is borderline thin for an MCP server, even if authentication is the primary purpose. The server is named 'Firedrill operator MCP', suggesting a broader operator scope that one tool cannot reasonably cover.
The surface covers only the authentication flow (start/status/choose/cancel) and lacks any logout, refresh, or actual operator actions implied by the server name. For an 'operator' server, this is a significant gap that would leave agents unable to perform most domain tasks.