Skip to main content
Glama
ilativity
by ilativity

Check Digital Asset Links

check_asset_links
Read-onlyIdempotent

Checks Trusted Web Activity asset links by fetching assetlinks.json and comparing SHA-256 fingerprints with Play's app-signing certificate to diagnose browser URL bar issues.

Instructions

For a Trusted Web Activity: fetches https:///.well-known/assetlinks.json and compares its SHA-256 fingerprints for this package with the app-signing certificate Play reports (generatedApks). A mismatch is the classic reason a TWA shows the browser URL bar. Sends no credentials to the domain. If Play reports no signing certificate, pass fingerprint instead.

Input Schema

NameRequiredDescriptionDefault
domainYesSite hostname only, e.g. example.com (no scheme, port or path).
fingerprintNoApp-signing SHA-256 fingerprint to compare against, instead of asking Play.
package_nameNoAndroid package name. Defaults to PLAY_MCP_PACKAGE.
version_codeNoVersion code to read the signing certificate from. Default: the highest on any track.

Schema Changelog

Changes observed during successful MCP inspections.

  1. First observedv1.0.0

TDQS

A4.4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already cover readOnly, idempotent, openWorld and non-destructive. The description goes beyond them by disclosing that it performs a network fetch of a specific well-known URL and 'Sends no credentials to the domain' — a meaningful security/behavior detail the annotations cannot express. It stops short of describing the result shape.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three dense sentences, front-loaded with the primary action, then the diagnostic rationale, then the parameter fallback. Every sentence carries information an agent needs; nothing is redundant with the title or schema.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema, the description implies the outcome (match vs mismatch and its consequence) but does not state the actual return structure or how many entries are compared. For a low-complexity diagnostic call this is nearly complete, leaving only a minor gap around the response format.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so baseline is 3, but the description adds real meaning: it explains why `fingerprint` exists as a substitute path when Play reports no signing certificate, and it ties the comparison target to 'generatedApks' from Play. This clarifies parameter interplay beyond the schema's per-field text.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a precise verb and resource flow: fetches https://<domain>/.well-known/assetlinks.json and compares SHA-256 fingerprints against Play's app-signing certificate. This is unmistakably distinct from every sibling (all Play tracks/bundles/vitals/reviews tools), so an agent can route to it without ambiguity.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Scopes the tool to Trusted Web Activity diagnostics and gives the payoff condition ('A mismatch is the classic reason a TWA shows the browser URL bar'), plus a fallback rule ('If Play reports no signing certificate, pass `fingerprint` instead'). No named alternatives because none exist among siblings, but there is no explicit when-not-to-use.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.