Skip to main content
Glama
growsurf

GrowSurf MCP Server

Official
by growsurf
OverviewSchemaSourceRelated ServersDiscussionsAdmin
TypeScript
Hybrid

Compute Participant Auth Hash

growsurf_participant_auth_hash
Read-onlyIdempotent

Computes a SHA-256 HMAC from an email and a caller-supplied participant auth secret to authenticate participants; optionally signs an affiliate join request when permitted, using no server secrets.

Instructions

Compute a SHA-256 HMAC using the caller-supplied participantAuthSecret. Server environment secrets are never used. Use a test secret during implementation; keep production signing in your backend. affiliateJoin requires permission for this signed-in user to join the affiliate program directly.

Input Schema

NameRequiredDescriptionDefault
emailYes
affiliateJoinNo
participantAuthSecretYes

Output Schema

NameRequiredDescriptionDefault
hashNoThe computed hash. Pass it to the GrowSurf client as the participant's `hash` value.

Schema Changelog

Changes observed during successful MCP inspections.

  1. Changed2 schema fields changedv0.19.15
    • addedInput schema / properties / participantAuthSecret / minLength
      Added value: +1
    • changedInput schema / required
      Previous value: -[
-  "email"
-]New value: +[
+  "email",
+  "participantAuthSecret"
+]
  2. First observedv0.12.2

TDQS

A4.1/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnly, idempotent, non-destructive, closed-world behavior, but the description adds security-critical context the annotations cannot convey: server environment secrets are never used, and the signing secret must come from the caller. It also discloses that affiliateJoin carries a permission prerequisite.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Four tight sentences with no filler; the core computation and the secret-source constraint are front-loaded. The affiliateJoin sentence feels slightly bolted on but still carries useful information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so return values need not be explained. The description covers the secret-handling model and the one side-effect-ish parameter, which is most of what an agent needs; only the 'email' input lacks any explanation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description carries the full documentation burden. It explains participantAuthSecret (caller-supplied, test vs. production usage) and affiliateJoin (requires program-join permission), but the required 'email' parameter is never described or exemplified, leaving one of three parameters undocumented.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description names a precise verb and resource ('Compute a SHA-256 HMAC') and immediately scopes it with 'using the caller-supplied participantAuthSecret'. No sibling tool performs hashing, so this is trivially distinguishable from the rest of the toolset.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It gives concrete guidance on how to use the tool in practice ('Use a test secret during implementation; keep production signing in your backend') and flags a conditional requirement for affiliateJoin. It does not name an alternative tool, but no plausible alternative exists in the sibling list.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Deploy Server

Other Tools