metrecept-opensource

Core: Register API service

metrecept_register_api_service

Registers or updates a third-party API service's non-secret shape so receipted GET calls can reach it. Credentials are supplied per call, not stored.

Instructions

Register or update a third-party API service so metrecept_call_api can make receipted GET calls to it. Use it once per vendor before metrecept_call_api; confirm with metrecept_list_api_services, remove with metrecept_unregister_api_service. Stores only the non-secret shape (base URL, path prefix, auth header name, purpose); the credential travels per call as metrecept_call_api's service_key and is never stored. Re-using a name overwrites that service. Private/internal base URLs are rejected. Not billed. Requires a Metrecept API key (METRECEPT_API_KEY env on stdio, or Authorization: Bearer on remote HTTP); results are scoped to that key's tenant only.

Input Schema

Name	Required	Description	Default
`name`	Yes	Service id matching [a-z0-9_-]{1,64}, e.g. "vehicle_data". Re-using a name overwrites it.
`purpose`	No	Compliance purpose label (default business_api_audit).	business_api_audit
`base_url`	Yes	Absolute public http(s) base URL of the vendor API, e.g. "https://api.vendor.example". Private/internal hosts are rejected.
`auth_header_name`	No	Header the vendor expects the credential in, e.g. "Authorization" or "X-Api-Key" (default "Authorization").	Authorization
`allowed_path_prefix`	No	Path prefix every call must stay under (default "/").	/

Output Schema

Name	Required	Description	Default
`result`	Yes

Schema Changelog

Changes observed during successful MCP inspections.

Changed5 schema fields changedv0.3.1Oct 25, 2026

addedInput schema / properties / allowed_path_prefix / description

Added value: +"Path prefix every call must stay under (default \"/\")."

addedInput schema / properties / auth_header_name / description

Added value: +"Header the vendor expects the credential in, e.g. \"Authorization\" or \"X-Api-Key\" (default \"Authorization\")."

addedInput schema / properties / base_url / description

Added value: +"Absolute public http(s) base URL of the vendor API, e.g. \"https://api.vendor.example\". Private/internal hosts are rejected."

addedInput schema / properties / name / description

Added value: +"Service id matching [a-z0-9_-]{1,64}, e.g. \"vehicle_data\". Re-using a name overwrites it."

addedInput schema / properties / purpose / description

Added value: +"Compliance purpose label (default business_api_audit)."

Changed2 schema fields changedOct 25, 2026

changedInput schema / title

Previous value: -"ohm_register_api_serviceArguments"New value: +"metrecept_register_api_serviceArguments"

changedOutput schema / title

Previous value: -"ohm_register_api_serviceOutput"New value: +"metrecept_register_api_serviceOutput"

First observedv0.1.0Oct 25, 2026

TDQS

A4.8/5.0

Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations exist, so the description carries the full burden and does: it discloses the security model (only non-secret shape stored, credential travels per call), idempotency (re-using a name overwrites), input validation (private/internal base URLs rejected), billing ('Not billed'), and auth/tenant scoping requirements. That is unusually complete disclosure for a mutation tool.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loads what it does and the primary sequencing constraint, then layers security, idempotency, validation, and billing in short clauses. Dense but every sentence adds a distinct fact; the long final sentence on auth/tenant scoping is the only mildly overloaded part.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With five parameters, no annotations, and an output schema present, this covers everything an agent needs: prerequisite ordering, credential handling, overwrite semantics, validation rejections, cost, and tenant auth. Nothing material is left to inference.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline is 3. The description still adds real meaning by grouping which fields constitute the stored non-secret shape (base URL, path prefix, auth header name, purpose) and clarifying that the credential is a call-time argument rather than a registration parameter — semantics the schema alone does not convey.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb pair (register/update) and resource (third-party API service), plus the downstream consumption by metrecept_call_api for 'receipted GET calls'. An agent can distinguish it from unregister/list siblings without reading schemas.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicit sequencing ('once per vendor before metrecept_call_api'), a verification path ('confirm with metrecept_list_api_services'), and the removal alternative ('remove with metrecept_unregister_api_service'). When-to-use and sibling routing are both spelled out.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.