partner-center-mcp

Lint a REST request

pc_validate_request

Read-onlyIdempotent

Validate a Partner Center REST request before sending: checks method and path against documented operations and flags missing required headers, unsupported auth types, and cloud mismatches.

Instructions

Check a Partner Center REST request you have already written against the documented operations and report what is wrong: unrecognised or mismatched method and path, missing Authorization or MS-RequestId, a retired token audience, app-only used where it is not supported, and sovereign-cloud host mismatches. Use this to catch mistakes before sending, or to explain a call that is failing. To build a correct request from scratch instead, use pc_build_request; to decode a response you already received, use pc_decode_error. Read-only, offline, deterministic: the request is analysed statically and never sent, so pass placeholder tokens rather than real ones. Findings are limited to what the bundled pack covers, so an empty list means no known problem — not a guarantee the call will succeed.

Input Schema

TableJSON Schema

Name	Required	Description
`url`	Yes	The request URL. A full URL or a bare path both work; the scheme and host are stripped before matching. Concrete ids in place of {placeholder} segments are expected and matched positionally, e.g. "https://api.partnercenter.microsoft.com/v1/customers/c7f6.../subscriptions". A query string is ignored.
`cloud`	No	Sovereign cloud the request targets. Defaults to "commercial". Supply a non-commercial value to get the correct base URL and login authority reported as an info finding.
`method`	Yes	HTTP verb of the request you are checking. Required — a verb that does not match the endpoint is one of the things this reports.
`headers`	No	Request headers as a flat string-to-string map, e.g. { "Authorization": "Bearer <token>", "MS-RequestId": "..." }. Names are compared case-insensitively. Omit to skip the header checks entirely — which also suppresses the missing-Authorization finding. Use placeholder token values; real ones are unnecessary.
`authType`	No	The token flavour you intend to use. Supply it to be told when the endpoint does not accept app-only. Omit to skip that check.

Output Schema

TableJSON Schema

Name	Required	Description
`ok`	Yes	True when the call succeeded and `data` is populated; false when `error` explains why not.
`data`	No	The result payload. Present only when `ok` is true.
`error`	No	Human-readable reason the call failed. Present only when `ok` is false.

Schema Changelog

Changes observed during successful MCP inspections.

Changed8 schema fields changedv0.13.0Aug 1, 2026

removedInput schema / additionalProperties
```
Removed value: -false
```

addedInput schema / properties / authType / description

Added value: +"The token flavour you intend to use. Supply it to be told when the endpoint does not accept app-only. Omit to skip that check."

addedInput schema / properties / cloud / description

Added value: +"Sovereign cloud the request targets. Defaults to \"commercial\". Supply a non-commercial value to get the correct base URL and login authority reported as an info finding."

addedInput schema / properties / headers / description

Added value: +"Request headers as a flat string-to-string map, e.g. { \"Authorization\": \"Bearer <token>\", \"MS-RequestId\": \"...\" }. Names are compared case-insensitively. Omit to skip the header checks entirely — which also suppresses the missing-Authorization finding. Use placeholder token values; real ones are unnecessary."

addedInput schema / properties / headers / propertyNames
```
Added value: +{
+  "type": "string"
+}
```

addedInput schema / properties / method / description

Added value: +"HTTP verb of the request you are checking. Required — a verb that does not match the endpoint is one of the things this reports."

addedInput schema / properties / url / description

Added value: +"The request URL. A full URL or a bare path both work; the scheme and host are stripped before matching. Concrete ids in place of {placeholder} segments are expected and matched positionally, e.g. \"https://api.partnercenter.microsoft.com/v1/customers/c7f6.../subscriptions\". A query string is ignored."

changedOutput schema / (root)

Previous value: -nullNew value: +{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "additionalProperties": false,
+  "properties": {
+    "data": {
+      "additionalProperties": false,
+      "description": "The result payload. Present only when `ok` is true.",
+      "properties": {
+        "findings": {
+          "description": "Everything detected, in the order the checks ran. Empty means nothing known was wrong.",
+          "items": {
+            "additionalProperties": false,
+            "properties": {
+              "fix": {
+                "description": "The concrete change to make, when there is one.",
+                "type": "string"
+              },
+              "message": {
+                "description": "What is wrong.",
+                "type": "string"
+              },
+              "severity": {
+                "description": "\"error\" will break the call; \"warning\" is risky but works; \"info\" is contextual guidance.",
+                "enum": [
+                  "error",
+                  "warning",
+                  "info"
+                ],
+                "type": "string"
+              }
+            },
+            "required": [
+              "severity",
+              "message"
+            ],
+            "type": "object"
+          },
+          "type": "array"
+        },
+        "matched": {
+          "anyOf": [
+            {
+              "additionalProperties": false,
+              "properties": {
+                "authType": {
+                  "description": "Token flavour the operation requires.",
+                  "enum": [
+                    "app-only",
+                    "app+user"
+                  ],
+                  "type": "string"
+                },
+                "docUrl": {
+                  "description": "Microsoft Learn page documenting the operation.",
+                  "type": "string"
+                },
+                "id": {
+                  "description": "Scenario id of the matched operation.",
+                  "type": "string"
+                },
+                "method": {
+                  "description": "The verb the operation actually expects.",
+                  "type": "string"
+                },
+                "path": {
+                  "description": "The path template it matched against.",
+                  "type": "string"
+                },
+                "title": {
+                  "description": "Human-readable name of the operation.",
+                  "type": "string"
+                },
+                "url": {
+                  "description": "Fully resolved URL for the operation against its correct host.",
+                  "type": "string"
+                }
+              },
+              "required": [
+                "id",
+                "title",
+                "method",
+                "path",
+                "url",
+                "authType",
+                "docUrl"
+              ],
+              "type": "object"
+            },
+            {
+              "type": "null"
+            }
+          ],
+          "description": "The documented operation this request was matched to, or null when no known endpoint has that shape."
+        },
+        "ok": {
+          "description": "True when no finding has severity \"error\". Warnings and info findings can still be present.",
+          "type": "boolean"
+        }
+      },
+      "required": [
+        "ok",
+        "matched",
+        "findings"
+      ],
+      "type": "object"
+    },
+    "error": {
+      "description": "Human-readable reason the call failed. Present only when `ok` is false.",
+      "type": "string"
+    },
+    "ok": {
+      "description": "True when the call succeeded and `data` is populated; false when `error` explains why not.",
+      "type": "boolean"
+    }
+  },
+  "required": [
+    "ok"
+  ],
+  "type": "object"
+}

Addedv0.5.0Jun 21, 2026

TDQS

A4.9/5.0

Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond the annotations (read-only, idempotent, non-destructive), the description discloses that the tool is offline and deterministic, never sends the request, and recommends placeholder tokens. It also notes the limitation that an empty result does not guarantee success, which is valuable honesty about the tool's coverage.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is dense yet well-structured: it opens with the main purpose and checks, then gives usage context and alternatives, then safety behavior and limitations. Every sentence earns its place, and the length is appropriate for a tool with this complexity.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the output schema and annotations, the description covers all necessary context: purpose, when to use, key behaviors, safety, and limitations. It is sufficient for an agent to select and invoke the tool correctly among many siblings, with no major gaps.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so a baseline of 3 applies. The description adds meaning by linking parameters to the checks performed (e.g., omitting headers skips header checks, omitting authType skips the app-only check, cloud influences sovereign-cloud findings), which goes beyond the individual field descriptions.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly identifies the tool as a linter for an already-written Partner Center REST request, enumerating specific validations (method/path, headers, auth audience, app-only support, cloud host). It explicitly contrasts with sibling tools pc_build_request and pc_decode_error, making the tool's unique role unmistakable.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description states precisely when to use the tool: to catch mistakes before sending or to explain a failing call. It also names alternatives for adjacent tasks (building a request with pc_build_request, decoding a response with pc_decode_error), providing clear decision guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.