Skip to main content
Glama

Set Outside Expectations (daily re-check)

set_expectations

Record and monitor a domain's expected DNS, TLS, HTTP, and email settings, then report any that fail re-checks.

Instructions

Record what a domain should show from outside and check it now — HSTS or another header present, DMARC enforcing, an issue key no longer reported, an HTTP or TLS grade at or above a level, a certificate with enough days left, a DNS record present, absent or containing a value, HTTPS answering. DechoNet reads the domain fresh (not from cache) with its public dns / ssl / http / email tools, from its own servers and the Seoul observation point, and then re-checks the set every day. Each result is pass, fail or unknown; unknown (a tool or part of it did not answer) is never a pass. Without an API key the set is anonymous: no alerts, kept 30 days after its last check, reachable by id and status page. With an API key (Authorization: Bearer dn_…) the set belongs to that key's account, and a set that held and stops holding is reported in the account's daily mail. Not read-only (it stores the set); public checks only, so any domain is accepted. Typical use: after changing DNS, TLS, headers or mail settings, to state the intended result and be told if it is ever reverted. Returns the set id, status page, per-check results with where to fix what does not hold (for the platform the site runs on), and signed observation receipts.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
labelNoOptional short name for the set (shown on its page and in the mail)
domainYesDomain the checks are about (e.g. 'example.com'); scheme and path are stripped
expectYesChecks, 1-20

Output Schema

TableJSON Schema
NameRequiredDescriptionDefault
idNoExpectation set id (stored sets)
urlNoStatus page of the set: last results and recent checks
ownerNo'account' (alerts by the API key account's daily mail) or 'anonymous' (no alerts)
stateYes'pass' (every check holds) | 'fail' (at least one does not) | 'unknown' (some could not be read — not a pass)
domainYes
storedYesWhether DechoNet keeps re-checking this set daily
resultsYes
receiptsNoSigned observation receipts behind this result, one per lookup: when, from where and under which rules version DechoNet observed it. Each url shows the record and checks its Ed25519 signature.
checkedAtNo
expiresAtNoAnonymous sets: removed after this unless checked again

Schema Changelog

Changes observed during successful MCP inspections.

  1. Addedv1.5.14

TDQS

A4.4/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations only give the safety profile (readOnlyHint=false, openWorldHint=true, idempotentHint=false, destructiveHint=false). The description adds real behavioral depth beyond that: fresh non-cached reads from its own servers plus a Seoul observation point, daily re-check cadence, pass/fail/unknown semantics where unknown is never a pass, anonymous-vs-API-key behavior including 30-day retention and daily mail, and the explicit 'stores the set' mutation disclosure that reinforces destructiveHint=false.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded with the core action, and each subsequent sentence carries distinct information (execution model, result semantics, auth tiers, use case). It is a single dense paragraph of long clauses rather than a bulleted, scannable structure, which costs a point but not efficiency.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a mutation tool with nested check definitions and an output schema, the description covers what's needed: what is stored, how results are produced, auth/retention differences, and the daily re-check behavior. Return details (set id, status page, receipts) can be read from the output schema, so the description is complete without repeating it.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already documents domain, label, and the full expect item structure including its per-check kinds. The description restates check examples in prose (HSTS/DMARC/grade/cert days/DNS) rather than adding syntax the schema lacks. It adds a small amount — 'any domain is accepted' and the meaning of unknown — but largely echoes the structured fields, so the baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb+resource ('Record what a domain should show from outside and check it now') and then enumerates the concrete check kinds (HSTS header, DMARC enforcing, issue key absent, TLS grade, cert days, DNS records). An agent can distinguish this from verify_expectations and watch_domain from the description alone: this tool creates the set, the others re-check or watch.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives an explicit triggering scenario — 'after changing DNS, TLS, headers or mail settings, to state the intended result and be told if it is ever reverted.' That is clear context. It stops short of naming exclusions or the sibling it replaces (verify_expectations vs watch_domain), so it misses the 5 bar.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.