Skip to main content
Glama

List connections

list_connections
Read-only

Review third-party OAuth connections with status, scopes, and expiry times to spot accounts needing reauthorization. No token secrets returned.

Instructions

List the authenticated account's third-party OAuth connections, including each provider's status, authorization and expiry times, and configured scopes. Read needs_reauth for whether a human has to go and reconnect one; status is the same fact spelled out (authorized needs no action, reconnect_needed and unauthorized do). Never derive it from expires_at: tokens refresh lazily when used, so an authorized row may have a past expires_at, and authorized with expires_at=null means the grant never expires. Token and client-secret material is never returned.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault

No arguments

Output Schema

TableJSON Schema
NameRequiredDescriptionDefault
connectionsYesThird-party OAuth connection status records; never secret material.

Schema Changelog

Changes observed during successful MCP inspections.

  1. Changed1 schema field changedv0.16.0
    • changedOutput schema / (root)
      Previous value: -nullNew value: +{
      +  "properties": {
      +    "connections": {
      +      "description": "Third-party OAuth connection status records; never secret material.",
      +      "items": {
      +        "additionalProperties": false,
      +        "properties": {
      +          "authorized_at": {
      +            "description": "When the grant was last authorized; null when there has never been one.",
      +            "type": [
      +              "null",
      +              "string"
      +            ]
      +          },
      +          "expires_at": {
      +            "description": "When the current access token expires; null when the grant does not expire. A past value on an authorized row is normal — tokens refresh lazily when used.",
      +            "type": [
      +              "null",
      +              "string"
      +            ]
      +          },
      +          "needs_reauth": {
      +            "description": "True when a human must reconnect this provider before it can be used. Read this rather than comparing expires_at to the clock.",
      +            "type": "boolean"
      +          },
      +          "provider": {
      +            "description": "The third-party provider this row is about.",
      +            "type": "string"
      +          },
      +          "scopes": {
      +            "description": "The scopes this provider is configured to request.",
      +            "items": {
      +              "type": "string"
      +            },
      +            "type": [
      +              "null",
      +              "array"
      +            ]
      +          },
      +          "status": {
      +            "description": "authorized, reconnect_needed, or unauthorized.",
      +            "type": "string"
      +          }
      +        },
      +        "required": [
      +          "provider",
      +          "status",
      +          "authorized_at",
      +          "expires_at",
      +          "scopes",
      +          "needs_reauth"
      +        ],
      +        "type": "object"
      +      },
      +      "type": [
      +        "null",
      +        "array"
      +      ]
      +    }
      +  },
      +  "required": [
      +    "connections"
      +  ],
      +  "type": "object"
      +}
  2. Addedv0.7.0

TDQS

A4.7/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond the readOnlyHint annotation, the description adds vital behavioral nuance: it explains how to interpret needs_reauth vs status, warns against deriving status from expires_at due to lazy token refresh, and explicitly states that token/client-secret material is never returned. This is exactly the kind of context an agent needs to use the response correctly.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is front-loaded with the core purpose, then adds concise but important behavioral caveats. Every sentence earns its place, and the warning about expires_at is structured as actionable guidance rather than filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the zero parameters, the readOnlyHint annotation, and the presence of an output schema, the description covers all relevant aspects an agent needs: what is returned, how to interpret ambiguous fields, and what is never returned. Nothing essential is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has zero parameters and the schema documents all of them (100% coverage), so there is no gap to compensate for. The baseline for a zero-parameter tool is 4, and the description has no need to add parameter-specific meaning.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb ('List') and a precise resource ('the authenticated account's third-party OAuth connections'), and enumerates the returned fields. This clearly distinguishes it from sibling tools like list_agents or list_runs, even though no sibling is named.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The first sentence provides clear context for when to call the tool: when you need a read-only view of the account's OAuth connections. It does not explicitly contrast with alternatives, but the resource is unambiguous and no closely related sibling exists, so the usage context is clear without formal exclusions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.