pocketbase-mcp

Confirm password reset

confirm_password_reset

Reset a forgotten password by submitting the email token with a new password and matching confirmation.

Instructions

Set a new password using the reset token from the password reset email.

Tool call template

Replace each placeholder with a value matching the input schema. Only required parameters are included; add optional parameters as needed.

{
  "id": 1,
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "arguments": {
      "token": "<token>",
      "password": "<password>",
      "passwordConfirm": "<passwordConfirm>"
    },
    "name": "confirm_password_reset"
  }
}

Input Schema

Name	Required	Description
`token`	Yes	Password reset token.
`password`	Yes	New password.
`collection`	No	Auth collection (default 'users').
`passwordConfirm`	Yes	New password confirmation (must match).

Schema Changelog

Changes observed during successful MCP inspections.

First observedv1.0.0Sep 6, 2026

TDQS

A3.7/5.0

Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

There are no annotations, so the description carries the full burden of behavioral disclosure. It indicates a state-changing action ('Set a new password') but does not disclose whether the token is single-use, whether authentication is required, whether the reset token becomes invalid, or how password conflicts are handled. This is a meaningful gap for a security-sensitive mutation tool.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, front-loaded sentence with no filler. It communicates the action, the object, and the key prerequisite without wasting tokens.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool is simple enough that the description plus fully documented parameters are minimally viable for calling it. However, with no annotations and no output schema, important behavioral context such as token consumption, auth requirements, and response shape is missing, making this adequate but not complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the parameter names and descriptions already document token, password, passwordConfirm, and collection. The description adds modest context by saying the token comes from the password reset email, but it does not add meaning beyond what the schema already provides.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific action ('Set a new password') with a specific resource and prerequisite ('using the reset token from the password reset email'). This clearly distinguishes it from sibling tools like request_password_reset, which would start the flow rather than complete it.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description clearly places the tool in the password-reset flow: it is used after the user has received a reset token by email. It does not explicitly name alternatives or state when not to use it, but the usage context is strong enough for an agent to choose this over request_password_reset or confirm_verification.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Deploy Server