Skip to main content
Glama
takleb3rry

Zitadel MCP

by takleb3rry

zitadel_set_hosted_login_translation

Idempotent

Override hosted login (Login V2) texts for a locale via Settings v2, deep-merging only your keys into existing org or instance overrides.

Instructions

Override texts of the Login V2 (new "hosted login" / TypeScript login) for a locale, via the Settings v2 API — the correct lever for the new login (the legacy Management "Custom Login Texts" are ignored by it). Pass translations as flat dot-path keys mirroring apps/login/locales/.json in zitadel/zitadel, e.g. {"password.errors.couldNotCreateSessionForUser":"Benutzername oder Passwort falsch."}. Only the keys you send are changed: the tool reads this level's existing overrides, deep-merges yours in, and writes the result — so other overrides and untouched defaults stay intact (idempotent). Defaults to the configured org (ORG-LEVEL — affects every app whose login resolves to this org); pass level:"instance" for the whole instance (needs an IAM-level grant). Set one locale per call; repeat for each language you support.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
levelNoScope to write: "organization" (default) or "instance".
localeYesBCP-47 language tag to write, e.g. "de" or "en".
translationsYesMap of override keys to text. Keys are flat dot-paths mirroring the login locale file (e.g. "password.errors.couldNotCreateSessionForUser"); an already-nested object is also accepted. Values may contain login-app placeholders like {failedAttempts}.

Schema Changelog

Changes observed during successful MCP inspections.

  1. Addedv2.0.0

TDQS

A4.5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Goes well beyond the annotations (readOnlyHint=false, idempotentHint=true, destructiveHint=false): it explains the read-deep-merge-write mechanics, that only supplied keys change and other overrides/defaults survive, the org-level default scope affecting every app tied to the org, and the IAM-level grant needed for instance scope. That is exactly the behavioral context an agent needs before mutating shared login text.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Dense but front-loaded, leading with what is overridden and the critical scope warning before mechanics. Some clauses (the JSON example, the deep-merge explanation) are long, but each carries actionable information rather than filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a mutation tool with no output schema, the description covers scope, merge semantics, idempotency, permissions, and per-call granularity. The only omission is any indication of the return payload or error behavior, which is minor given the annotations.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is already 100%, but the description adds real meaning: the flat dot-path key format mirroring apps/login/locales/<locale>.json, a concrete example, placeholder support like {failedAttempts}, and the defaulting/grant semantics of the level parameter. This exceeds the baseline 3 for fully documented schemas.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a precise verb+resource+scope: overriding Login V2 / hosted login texts for a locale via the Settings v2 API. It also distinguishes itself from the legacy Management 'Custom Login Texts' path, which an agent could otherwise pick by mistake.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives clear when-to-use context (the correct lever for the new login) and an explicit when-not (legacy Management custom texts are ignored by it), plus operational guidance to set one locale per call and repeat per language. It does not name the sibling get_hosted_login_translation as the read counterpart, which is the only notable gap.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.