Skip to main content
Glama
rawtreedb

RawTree MCP Server

Official
by rawtreedb
OverviewSchemaSourceRelated ServersDiscussionsAdmin
TypeScript
Hybrid

Verify Database S3 Access

verify-database-s3-access
Idempotent

Purpose: Verify that RawTree can use a customer IAM role to access customer-owned S3 storage before creating a database.

Instructions

Purpose: Verify that RawTree can use a customer IAM role to access customer-owned S3 storage before creating a database.

Returns: Whether access was verified and a human-readable result message.

Behavior: RawTree assumes roleArn using the cluster's saved external_id, checks the data and backup bucket locations, lists each configured path, and writes, reads, then removes a temporary probe object under each path. Paths are optional and default to the bucket root. Both configured buckets must be in the cluster environment's AWS region.

Safety: This check temporarily writes to and deletes from both configured destinations. Confirm the exact organization, cluster, database name, buckets, paths, role ARN, and External ID before running it. The IAM trust policy's External ID must match the cluster's saved external_id exactly; this tool does not accept an identity override.

Auth: Organization-admin access is required. Authorization is enforced by the RawTree API.

Reliability: The check is safe to retry. Newly changed IAM policies may require a short propagation delay before verification succeeds.

Input Schema

NameRequiredDescriptionDefault
nameYesDatabase name to verify customer-owned S3 storage for.
clusterNoRawTree cluster to use for this operation.
s3StorageYesCustomer-owned S3 configuration to verify for the database.
organizationNoRawTree organization containing the target cluster.

Schema Changelog

Changes observed during successful MCP inspections.

  1. Changed13 schema fields changedv0.4.2
    • addedInput schema / additionalProperties
      Added value: +false
    • addedInput schema / properties / s3Storage / additionalProperties
      Added value: +false
    • addedInput schema / properties / s3Storage / properties / backups / additionalProperties
      Added value: +false
    • changedInput schema / properties / s3Storage / properties / backups / description
      Previous value: -"Customer-owned bucket and optional key prefix for backups."New value: +"Destination for backups."
    • addedInput schema / properties / s3Storage / properties / backups / properties / bucket / description
      Added value: +"Customer-owned S3 bucket."
    • addedInput schema / properties / s3Storage / properties / backups / properties / path / description
      Added value: +"Optional object-key prefix; defaults to the bucket root."
    • addedInput schema / properties / s3Storage / properties / data / additionalProperties
      Added value: +false
    • changedInput schema / properties / s3Storage / properties / data / description
      Previous value: -"Customer-owned bucket and optional key prefix for data."New value: +"Destination for table data."
    • addedInput schema / properties / s3Storage / properties / data / properties / bucket / description
      Added value: +"Customer-owned S3 bucket."
    • addedInput schema / properties / s3Storage / properties / data / properties / path / description
      Added value: +"Optional object-key prefix; defaults to the bucket root."
    • removedInput schema / properties / s3Storage / properties / externalId
      Removed value: -{
-  "description": "External ID required by the IAM role trust policy. It must exactly match the value configured in AWS.",
-  "maxLength": 1224,
-  "minLength": 2,
-  "pattern": "^[A-Za-z0-9_+=,.@:/-]+$",
-  "type": "string"
-}
    • changedInput schema / properties / s3Storage / properties / roleArn / description
      Previous value: -"ARN of the customer IAM role that RawTree may assume to access the configured buckets."New value: +"ARN of the customer IAM role RawTree may assume."
    • changedInput schema / properties / s3Storage / required
      Previous value: -[
-  "data",
-  "backups",
-  "roleArn",
-  "externalId"
-]New value: +[
+  "data",
+  "backups",
+  "roleArn"
+]
  2. Addedv0.3.2

TDQS

A4.3/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Goes well beyond the annotations by disclosing the actual mechanics: role assumption with the cluster's saved external_id, listing each path, and write/read/delete of a temporary probe object in both buckets. It also adds non-obvious constraints the annotations cannot express (both buckets must be in the cluster's AWS region, external_id must match exactly, no identity override, admin auth required, retry-safe, IAM propagation delay) and is consistent with idempotentHint=true.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Bold headers (Purpose/Returns/Behavior/Safety/Auth/Reliability) front-load the essentials and make scanning easy. The Safety paragraph is slightly repetitive in listing every identifier to confirm, but the redundancy is defensible for a tool that writes to customer buckets.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema, the description still explains the return value (verification boolean plus human-readable message). Combined with auth requirements, retry semantics, region constraints, and the exact probe behavior, an agent has everything needed to decide whether to call it and what will happen on disk.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline is 3, but the description adds real semantics: paths are optional and default to bucket root, roleArn is assumed using the cluster's saved external_id (not a caller-supplied value), and both configured buckets must reside in the cluster environment's region. It does not mention the optional `cluster` parameter or how organization/cluster resolution interacts, which is the main remaining gap.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb (verify), resource (customer IAM role access to customer-owned S3 via RawTree), and the pre-condition context (before creating a database). It does not explicitly distinguish itself from the sibling verify-cluster-s3-access, which covers a nearly identical check at the cluster level, leaving that differentiation to inference from the name.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Clearly frames the tool as a pre-flight check to run before create-database, and the Safety section tells the agent to confirm all identifiers before running. It does not name verify-cluster-s3-access as the alternative for cluster-level verification, so the cluster-vs-database routing decision is only implied.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Deploy Server

Other Tools