Skip to main content
Glama
rawtreedb

RawTree MCP Server

Official
by rawtreedb

Verify Cluster S3 Access

verify-cluster-s3-access
Idempotent

Verify RawTree can access customer S3 buckets via IAM role before cluster creation. Tests write, read, and delete permissions for data and backup paths.

Instructions

Purpose: Verify that RawTree can use a customer IAM role to access customer-owned S3 storage before cluster creation.

Returns: Whether access was verified and a human-readable result message.

Behavior: RawTree assumes roleArn using externalId, checks the data and backup bucket locations, lists each configured path, and writes, reads, then removes a temporary probe object under each path. Paths are optional and default to the bucket root. Both configured buckets must be in the cluster environment's AWS region.

Auth: The RawTree API requires a user access token with organization admin access. Authorization is enforced by the API.

When to use: Use this tool after the IAM trust and permissions policies are configured and immediately before create-cluster whenever its optional s3Storage field will be provided. It is unnecessary when RawTree-managed storage will be used.

Safety: This check temporarily writes to and deletes from both configured destinations. Confirm the exact organization, buckets, paths, role ARN, and External ID before running it. The IAM trust policy's External ID must match externalId exactly.

Reliability: The check is safe to retry. Newly changed IAM policies may require a short propagation delay before verification succeeds.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
s3StorageYesCustomer-owned S3 configuration to verify before cluster creation.
organizationYesOrganization that will own the cluster.

Schema Changelog

Changes observed during successful MCP inspections.

  1. Addedv0.3.2

TDQS

A4.6/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Despite annotations covering non-read-only and idempotency, the description adds rich value: it explains the assume-role flow, that it writes/reads/deletes a probe object under each path, the region constraint, and that it is safe to retry. It explicitly warns the probe writes to and deletes from both destinations and notes IAM propagation delays, which annotations cannot convey.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Well front-loaded with bolded section headers (Purpose, Returns, Behavior, Auth, When to use, Safety, Reliability) that make it scannable. It is somewhat long, but each section earns its place for a mutating verification tool with nested parameters and no output schema.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 2-param mutation tool with nested objects, no output schema, and 100% schema coverage, the description supplies the missing return summary, auth requirements, ordering relative to create-cluster, region constraint, safety warnings, and retry behavior. Nothing an agent needs to call it correctly is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema documents organization, s3Storage, data/backups, roleArn, and externalId. The description adds behavioral meaning (paths default to bucket root, externalId must exactly match the trust policy, region constraint) but does not extend schema syntax beyond structured fields. Baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb (verify), resource (cluster S3 access via a customer IAM role), and scope (before cluster creation). It is clearly distinguishable from the sibling verify-database-s3-access and create-cluster by naming cluster/S3/storage context explicitly.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It gives explicit when-to-use ('after the IAM trust and permissions policies are configured and immediately before create-cluster whenever its optional s3Storage field will be provided') and when-not ('unnecessary when RawTree-managed storage will be used'), leaving nothing to inference.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.