AgentValet is an identity and credential governance broker for AI agents, providing secure, scoped, and audited access to external platforms without exposing real credentials.
List accessible platforms (list_platforms): Discover which external platforms (e.g., Airtable, GitHub, Slack) the agent has been granted access to, along with specific permission scopes and whether human approval is required for each.
Call external platform APIs (use_platform): Make authenticated API calls (GET, POST, PUT, PATCH, DELETE) to connected platforms through the AgentValet proxy, which handles credential injection, scope enforcement, secret scanning, and audit logging. Supports human-in-the-loop approval for sensitive actions, blocking up to 50 seconds before returning a pending envelope.
Pre-check access authorization (authzen_evaluate): Evaluate whether the agent has permission for a specific platform scope before making an actual API call, returning a boolean decision and reason (approved, denied, revoked, or scope not granted).
Self-register as an agent (agent_register): Register a new agent under an owner account with a human-readable name and requested platform scopes, returning a registration token and polling URL.
Poll registration status (agent_status): Check whether a registration request is pending, approved, or rejected — and retrieve the agent ID and MCP config if approved.
List pending and recent actions (list_my_pending_actions): Retrieve currently pending human-approval requests and actions completed in the last 24 hours, useful for resuming sessions or checking outcomes of timed-out calls.
Report self-diagnostics (report_self_diagnostic): Lodge error, warning, or informational reports to the agent owner, optionally correlated with a specific audit log entry. Critical and error severities trigger owner notifications.
Allows agents to interact with GitHub APIs through the AgentValet proxy, providing scoped, audited access to GitHub resources such as repositories, issues, and pull requests.
Identity and credential governance broker for AI agents and MCP servers. It gives every agent its own cryptographic identity, scoped and short-lived credentials per platform, human approval gates on the actions that matter, and an immutable audit log of everything it did.
Open core. This repo holds the open-source MIT-licensed client surface: the MCP server, the CLI, the Claude Desktop bundle, and the runtime adapters. The managed proxy runs the credential vault, the policy engine, and the audit store. A self-host reference for the proxy is on the roadmap.
Live at agentvalet.ai. Docs at docs.agentvalet.ai.
npx @agentvalet/registerThat generates an RS256 keypair for your agent, registers it, and wires up the config. The private key never leaves your machine. From then on your agent signs a short-lived JWT per request and calls platforms through the AgentValet proxy. Approve the agent in the dashboard, grant it scopes, and you are running.
Related MCP server: AgentPay MCP Server
npx @agentvalet/register writes this block into your client's MCP config for you. To wire it up by hand — in Claude Desktop, Claude Code, Cursor, or any MCP-compatible client — add:
{
"mcpServers": {
"agentvalet": {
"command": "npx",
"args": ["-y", "@agentvalet/mcp-server"],
"env": {
"AGENT_ID": "agt_your_agent_id",
"OWNER_ID": "your_owner_id",
"PROXY_URL": "https://api.agentvalet.ai",
"AGENT_PRIVATE_KEY_PATH": "~/.agentvalet/agent.key"
}
}
}
}The server exposes seven tools: list_platforms, use_platform, authzen_evaluate, agent_register, agent_status, list_my_pending_actions, and report_self_diagnostic. The private key is read from AGENT_PRIVATE_KEY_PATH and never leaves your machine; every platform call goes through the proxy with scope checks, audit logging, and human approval on the actions that matter.
Credential inheritance is what happens when an AI agent runs on your credentials instead of its own. The moment a token lands in .mcp.json or an environment variable, every agent in that project inherits the full reach of that token. It can do anything you can do, on every platform the token touches, and nothing records which agent did what.
House key agent (today's default) | Valet key agent (AgentValet) |
Holds your real token | Holds a short-lived signed token, never your credential |
Full scope on every platform the token reaches | Scoped to exactly the actions you granted |
A leaked config leaks everything | A leaked config leaks nothing reusable |
No record of which agent did what | Every call attributed to one agent identity |
Revoking means rotating the token everywhere | One revoke, instant, no rotation |
Agent (holds its RS256 private key)
|
| signs a 60-second JWT per request
v
+-------------------------------------------+
| AgentValet proxy |
| 1. verify JWT signature |
| 2. check scope grant (deny by default) |
| 3. scan request for leaked secrets |
| 4. AuthZEN policy evaluation |
| 5. human approval gate, if required |
| 6. inject real credential in memory |---> SaaS platform
| 7. append-only audit log entry |
+-------------------------------------------+
|
v
Dashboard: approve registrations, manage scopes, review the audit log, monitor usage
MCP server: exposes AgentValet as tools for Claude and any MCP-compatible agentCredentials use envelope encryption: a unique AES-256 data key per credential, wrapped by a master key held in a Key Vault HSM, decrypted in memory only at call time and never written to a log.
Per-agent RS256 cryptographic identity, SPIFFE-format URIs, 60-second signed JWTs
Deny-by-default scopes, granular per-agent-per-platform-per-action grants
Human-in-the-loop approval for destructive or financial scopes, one-click magic-link
Immutable, append-only audit log, filterable and exportable
Three-strike circuit breaker that auto-suspends a misbehaving agent
Native MCP server plus a one-command CLI
Self-hostable: PostgreSQL-backed, runs in your own infrastructure
Standards-aligned: SPIFFE, RFC 7591 Dynamic Client Registration, AuthZEN 1.0, IETF AIMS
Honest framing. These are strong tools that reached agent governance from an adjacent starting point.
AgentValet | Aembit | Akeyless | Infisical Agent Vault | |
Starting point | Agent-first identity and governance | Workload identity | Secrets management | Secrets vault |
Where it sits | Identity-layer credential broker | Edge proxy near workloads | Gateway in your network | Network-layer forwarding proxy |
Onboarding | Self-serve, under 5 minutes | Enterprise sales-led | Enterprise sales-led | Self-host or cloud |
Open source | Open core, MIT* | No | No | Core open source |
Standout strength | AIMS-aligned, approval gates, audit, cheap entry | Attestation-based identity | Distributed fragments cryptography | Network-level interception |
* The client surface (MCP server, CLI, bundle, adapters) is MIT in this repo. The proxy is a managed service today, with a self-host reference on the roadmap.
If you already run Aembit or Akeyless at enterprise scale, AgentValet is not trying to replace your identity provider. If you are a developer or small team shipping agents this week, AgentValet is built for you.
Building in public, so the rough edges are listed here rather than discovered.
Known limitations today
The SSE stream for approval status can close prematurely on long waits. Reconnect logic is planned.
CLI rate limiting is rudimentary.
There is no clear or delete UI yet for expired pending registrations.
On the roadmap
Self-host reference for the proxy (the open client surface already runs anywhere)
SIEM export for the audit log (Enterprise)
Multi-region self-hosting guides
Custom integrations UI (today these are requested through the roadmap system)
PII handling Phase 2: detection at the broker layer
Open source in this repo, MIT licensed: the MCP server, the @agentvalet/register CLI, the Claude Desktop bundle, the runtime adapters, and @agentvalet/mcp-broker.
The two MCP packages are mirror images of each other: @agentvalet/mcp-server lets an agent call platforms through the AgentValet proxy, whereas @agentvalet/mcp-broker lets you embed AgentValet policy and credential enforcement inside your own MCP server, with a genuinely useful local mode and zero required account.
Managed service today: the proxy that holds the credential vault, runs the policy engine, and writes the audit log. A self-host reference for the proxy is on the roadmap. See CONTRIBUTING.md for local development of the open packages.
Found a vulnerability? Please report it privately, see SECURITY.md. Do not open a public issue for security reports.
MIT. See LICENSE.
agent_register: Self-register this agent with an owner. No auth required. Input: owner_id (string), agent_name (string), requested_scopes (array of {platformId, scopes}). Returns: registration_token, poll_url, client_id, scope, expires_in. Auth: None.
| Name | Required | Description | Default |
|---|---|---|---|
| owner_id | Yes | The owner ID to register this agent under | |
| agent_name | Yes | Human-readable name for this agent | |
| requested_scopes | Yes | Array of platform scope requests |
| Name | Required | Description |
|---|---|---|
| registration_token | Yes | |
| poll_url | No | |
| client_id | No | |
| scope | No | |
| expires_in | No |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries full responsibility. It discloses that no authentication is required and lists return fields. However, it does not mention side effects (e.g., whether registration is idempotent, if it overwrites existing registration, or any limits). The transparency is adequate but not thorough.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise, using a single paragraph to state purpose, no-auth requirement, inputs, and outputs. It is front-loaded with the core action. Some redundancy (repeating the tool name) is minor, but overall it efficiently conveys necessary information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's simplicity, the description covers key elements: purpose, required inputs, and output fields. The output schema exists, so return values are fully specified. Minor gaps (e.g., expected behavior if agent is already registered) exist, but completeness is good for a registration tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has 100% description coverage, so each parameter is already documented. The description merely repeats the parameter names and types without adding new semantic meaning, such as format constraints or example values. Baseline score of 3 is appropriate given high schema coverage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action: 'Self-register this agent with an owner.' It identifies the resource (this agent) and the action (register), making the purpose evident. However, there is no explicit differentiation from sibling tools like agent_status or authzen_evaluate, though the purpose itself is distinct enough.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage context by stating 'No auth required' and listing inputs/outputs. However, it does not provide explicit guidance on when to use this tool versus alternatives (e.g., agent_status for checking registration status). Usage is implied but not clarified with exclusions or comparisons.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
agent_status: Poll registration status using the token from agent_register. Input: token (string, required). Returns: status ("pending_approval"|"approved"|"rejected"), agent_id (if approved), mcp_config (if approved). Auth: None.
| Name | Required | Description | Default |
|---|---|---|---|
| token | Yes | Registration token returned by agent_register |
| Name | Required | Description |
|---|---|---|
| status | Yes | |
| agent_id | No | |
| mcp_config | No |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Without annotations, the description details possible statuses and response fields, including conditional returns (agent_id, mcp_config if approved), and states auth is None.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three concise sentences with no wasted words, front-loaded with the tool's purpose.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description covers input, output possibilities, and authentication. Despite the presence of an output schema, it provides a clear summary of return fields.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% with a description for 'token', but the description adds important context that the token is from agent_register, beyond the schema's generic description.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it polls registration status using a token from agent_register, specifying the verb ('poll'), resource ('registration status'), and relationship to a sibling tool.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It explicitly mentions the token comes from agent_register, implying use only after registration. However, no explicit 'when not to use' statement is provided.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
authzen_evaluate: Evaluate whether this agent has access to a specific platform scope. Call this BEFORE use_platform when you want to pre-check without making the upstream call. Input: platform_id (string), scope (string). Returns: decision (boolean), reason ("approved"|"denied"|"revoked"|"scope_not_granted"). Auth: Bearer agent JWT (sent automatically by this MCP server).
| Name | Required | Description | Default |
|---|---|---|---|
| platform_id | Yes | The platform identifier (e.g. airtable, github) | |
| scope | Yes | The permission scope to evaluate (e.g. records:read) |
| Name | Required | Description |
|---|---|---|
| decision | Yes | |
| context | No |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations, so description carries full burden. It discloses return values (decision and reason) and authentication mechanism. Implies no side effects as it's a read-only evaluation. Lacks explicit mention of non-destructiveness, but context makes it clear.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three sentences, no wasted words. Front-loaded with purpose, then usage, then output description. Perfectly concise and structured.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With output schema present (context signal), description covers purpose, usage, parameters, and return values completely. No missing context for an evaluation tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema has 100% coverage, so baseline is 3. Description adds value by specifying the return format (decision boolean, reason string with enumerated values) which is not in schema. Redundant listing of parameter types but overall adds meaning.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description clearly states 'Evaluate whether this agent has access to a specific platform scope' with specific verb and resource. It differentiates from sibling 'use_platform' by noting to call before and that it avoids making the upstream call.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly says 'Call this BEFORE use_platform when you want to pre-check without making the upstream call', providing clear context for when to use. Could be improved by stating when not to use or alternatives, but sufficient.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_my_pending_actions: Returns this agent's currently-pending approval requests AND any that completed in the last 24 hours. Use this at session start when the user mentions an earlier action, or when use_platform's long-poll timed out and the user comes back asking what happened. Input: None. Returns: { pending: [{approval_id, platform_id, scope, created_at, expires_at}], recently_completed: [{approval_id, platform_id, scope, status, executed_at, result_summary, execution_error}] }. Auth: Bearer agent JWT (sent automatically).
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
| Name | Required | Description |
|---|---|---|
| pending | Yes | |
| recently_completed | Yes |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It discloses that the tool returns pending and recently completed actions (within 24 hours) and mentions authentication details ('Auth: Bearer agent JWT (sent automatically)'). However, it does not specify rate limits or pagination behavior, which would make it more complete.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is relatively concise and front-loaded with the main purpose. It includes the output format and usage guidance in a clear structure, though some redundancy could be trimmed.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given that an output schema is present (from context signals), the description still explicitly provides the return structure and includes authentication context. It fully explains the tool's behavior for its simple scope.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has no parameters (100% coverage), so the baseline is 3. The description states 'Input: None,' which merely restates the schema and adds no extra meaning.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states that the tool returns the agent's currently-pending approval requests and any completed in the last 24 hours. It uses specific verb 'returns' and specifies the resource, distinguishing from siblings like 'use_platform' which is for performing actions.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides explicit usage scenarios: 'at session start when the user mentions an earlier action, or when use_platform's long-poll timed out and the user comes back asking what happened.' This guides the agent on when to use this tool versus alternatives.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_platforms: List the platforms and permission scopes this agent has access to. Input: None. Returns: { platforms: [{ platformId, platformName, scopes, requireApproval }], version: "" }. Version: a deterministic hash that only changes when the platform set or scopes change. Cache the value across calls in the same session — only refresh when you suspect platforms have changed (e.g. user mentions a new connection). Auth: Bearer JWT.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
| Name | Required | Description |
|---|---|---|
| platforms | Yes | |
| version | No |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description bears full responsibility. It discloses input (none), output structure, version caching behavior, and auth method. This is sufficiently transparent for a read-only list tool, though it doesn't explicitly state idempotency or rate limits.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is highly concise and well-structured with separate lines for input, output, version notes, and auth. Every sentence provides essential information with no redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given there are no input parameters and an output schema is described, the description is complete. It includes caching guidance and auth details, which are valuable for correct usage.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
There are no parameters, and the schema coverage is 100% (empty). The description correctly states 'Input: None', meeting the baseline for zero parameters. No additional semantic info is needed.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it lists platforms and permission scopes the agent has access to. The verb 'List' and resource 'platforms' are specific, and it distinguishes from sibling tools like use_platform which involves using a platform.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage for retrieving platform information and caching advice, but it does not explicitly contrast with sibling tools or provide when-not-to-use scenarios. However, the context is clear enough given the sibling names.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
report_self_diagnostic: Lodge a self-report (error/warning/info) with the AgentValet owner. Use after a use_platform error returns a report_hint, OR proactively when you encounter a problem the user should know about. Input: severity (debug|info|warn|error|critical), message (string, required, max 4096 bytes), code (string, optional, max 128 chars), platform (string, optional), endpoint (string, optional), correlation_id (uuid string, optional — copy from the failing call's report_hint to stitch this report to the broker-side audit row), context (object, optional, JSON-serialised must be < 16 KiB). Returns: { id, received_at } on success. Auth: Bearer agent JWT (sent automatically).
| Name | Required | Description | Default |
|---|---|---|---|
| severity | Yes | Severity level. error/critical trigger an owner notification. | |
| message | Yes | One-sentence agent narrative describing what happened. | |
| code | No | Optional short machine code (e.g. 'permission_denied'). | |
| platform | No | Optional platform id this report relates to. | |
| endpoint | No | Optional endpoint that failed. | |
| correlation_id | No | Optional UUID — copy from a use_platform error's report_hint to stitch this report to the audit row. | |
| context | No | Optional structured context (request params, error details). Avoid secrets. |
| Name | Required | Description |
|---|---|---|
| id | Yes | |
| received_at | No |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
In the absence of annotations, the description covers key behavioral traits: notification trigger for error/critical severity, correlation stitching to audit rows, and size limits. However, it does not explicitly state safety or idempotency, which is acceptable for a reporting tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is well-structured with a clear purpose, usage trigger, parameter list, return type, and auth note. It is slightly verbose in listing parameters (which are already in the schema), but the front-loading of purpose and usage makes it effective.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given 7 parameters (2 required), an enum, nested objects, and an output schema, the description covers all essential aspects: purpose, usage, parameter details, return format, and authentication. It lacks explicit mention of error handling but is otherwise complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With 100% schema coverage, the baseline is 3. The description adds meaningful context beyond the schema: max sizes for message and code, the purpose of correlation_id, and the constraint on context size. It also clarifies that error/critical trigger owner notifications, which the schema does not convey.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose: 'Lodge a self-report (error/warning/info) with the AgentValet owner.' This is a specific action on a distinct resource, and it is well differentiated from sibling tools like agent_register or use_platform.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly describes when to use: 'Use after a use_platform error returns a report_hint, OR proactively when you encounter a problem.' This provides clear trigger conditions and references a specific sibling tool, leaving no ambiguity about alternatives.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
use_platform: Call an external platform API (Airtable, GitHub, Slack, Metabase, etc.) through the AgentValet proxy.
Input: platform (string), endpoint (string), method (GET|POST|PUT|PATCH|DELETE), scope (string), body (object, optional — JSON request body for POST/PUT/PATCH/DELETE).
Returns: upstream API response body. May take up to 50 seconds when the action requires owner approval — the call will block while we wait, then return the approved result transparently. If approval doesn't land in time, returns a pending_approval envelope and the action runs asynchronously; the user is notified when it completes.
Auth: Bearer JWT.
Note: legacy clients passing data instead of body are still accepted for backwards compatibility, but body is the canonical name.
| Name | Required | Description | Default |
|---|---|---|---|
| platform | Yes | Platform ID (e.g. airtable, github, slack, metabase) | |
| endpoint | Yes | API path on the target platform (e.g. /v0/meta/bases or /api/dataset) | |
| method | Yes | HTTP method to use | |
| scope | Yes | Permission scope required for this action (e.g. records:read) | |
| body | No | JSON request body for POST/PUT/PATCH/DELETE. Optional. Forwarded verbatim to the upstream API. | |
| data | No | Deprecated alias for `body` — prefer `body`. Kept for backwards compatibility. |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations, but description comprehensively discloses blocking behavior up to 50 seconds, approval workflow, asynchronous fallback, return envelopes, auth method, and backwards compatibility with `data` parameter.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Single focused paragraph, front-loaded with purpose, then covers inputs, behavior, auth, and backwards compatibility. Every sentence earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Despite no output schema, description explains return values (upstream response or pending_approval). Covers all needed aspects for a proxy tool with complex async behavior.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Input schema fully describes parameters; description adds context by grouping inputs and clarifying the role of each, plus deprecation note for `data`. Adds value beyond schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description clearly states the tool calls external platform APIs through a proxy, listing example platforms and inputs. It distinguishes from sibling tools which handle registration, status, etc.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly states the tool is for calling external APIs, with clear input requirements. No when-not-to-use guidance, but siblings are unrelated so not needed.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
v0.1.0agent_registeragent_statusauthzen_evaluatelist_my_pending_actionslist_platformsreport_self_diagnosticuse_platformScored across 7 tools
Each tool has a distinct purpose: registration, polling status, auth evaluation, listing pending actions, listing platforms, reporting diagnostics, and calling external APIs. No overlap or ambiguity.
All tool names follow a consistent verb_noun snake_case pattern (e.g., agent_register, authzen_evaluate, list_platforms), making them predictable and easy to understand.
With 7 tools, the server is well-scoped for an agent authentication and proxy service. Each tool earns its place without being overwhelming or insufficient.
The tool surface covers the full registration-to-use flow, including auth checks and diagnostics. Minor gap: no explicit tool for token refresh or logout, but the JWT handling is automatic so it's not critical.
Credential broker for AI agents: scoped, revocable API access with policy enforcement and audit.
Command your AI agents: verifiable passports, credential injection, full audit, revoke in 60s.
Give your AI hands. Identity, credential vault, and API gateway for autonomous agents.
Security gateway for AI agents: policy, approval, and audited execution, no secrets shared.
