Skip to main content
Glama
wiroai

Wiro MCP Server

Official
by wiroai

Set agent credentials

set_agent_credentials
Destructive

Save API keys, bot tokens, account IDs, and OAuth app keys to a deployed agent, or inspect a credential's required fields first. Values are validated before writing and restart the agent to load them.

Instructions

Save credential fields on a deployed agent: API keys, bot tokens, account IDs, allow lists, your own OAuth app keys, or the token for a browser-free connection. Call with only credential (no fields) to see that credential's field keys, formats, which are required, how it connects, and what is already set on this agent; nothing is written then. Skip that call when list_agent_skills with name already showed the fields. Then call with fields. Every field is checked before anything is written; unknown or Wiro-managed fields are refused. A key file, such as a Google service account JSON or an App Store .p8 key, takes the file's text, never a link: never ask for a public link to a key (the user can also upload it on the agent's page in the Wiro dashboard). Other file fields take a public URL and the file is uploaded. Values are never echoed back. A running agent restarts to load the values. Channels such as Telegram, Slack and Discord turn on by themselves once all their required fields are set, and turn off when one is cleared. Saving a credential turns on the scheduled tasks that need it; turn off any you do not want. Sign-in integrations (such as Google Ads, YouTube, Meta and HubSpot) are then connected with connect_agent_oauth; Gmail, Google Calendar and Google Drive are not sign-ins and are set here. Only save a Wiro project API key (credential "wiro") that the user gave you: model runs are billed to its wallet. On a team agent this needs a team admin or the person who deployed it; other team members can read the agent with get_my_agent and message it, so do not ask them for values they cannot save. The agents playbook (get_playbook) has the full setup walkthrough.

Input Schema

NameRequiredDescriptionDefault
fieldsNoFields to save. Send the fields of one credential together.
agent_guidYesThe deployed agent's guid, from list_my_agents.
credentialNoDescribe mode: a credential key such as "telegram" or "google-ads". Used when fields is empty.

Output Schema

NameRequiredDescriptionDefault
modeYes
notesYes
errorsNo
appliedNo
channelsNo
agentGuidYes
credentialNo
nextActionNo
agentStatusNo
credentialsNo
uploadedFilesNo

Schema Changelog

Changes observed during successful MCP inspections.

  1. Addedv1.4.1

TDQS

A4.8/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Goes well beyond the annotations: all fields are validated before any write, unknown/Wiro-managed fields are refused, values are never echoed back, a running agent restarts to load new values, channels self-enable/disable based on required fields, saving turns on dependent scheduled tasks, and the Wiro project key is billed to the user's wallet. Authorization scope (team admin or deployer only) is also disclosed.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Purpose and the describe-then-write protocol are front-loaded, and nearly every sentence carries a distinct rule. It is dense and long (~300 words) with a few soft edges (dashboard upload aside, playbook pointer) that could be trimmed, but the length is largely justified by the tool's side effects.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a destructive, open-world mutation with side effects, the description covers prerequisites, validation behavior, permission model, hidden consequences (restarts, channel toggles, schedule activation, billing), and where to go next. An output schema exists, so return values need not be explained.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the schema already documents the three parameters; the description still adds meaning by explaining that `credential` alone triggers describe mode with no write, and that fields of one credential should be sent together. It does not add much on `fields` internals (parent_field/ordinal), which the schema handles.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ("Save credential fields on a deployed agent") and immediately enumerates the concrete credential kinds (API keys, bot tokens, account IDs, allow lists, OAuth app keys, browser-free tokens). An agent can distinguish this from update_agent or connect_agent_oauth without opening any schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives explicit two-step protocol (describe-mode call with only `credential`, then call with `fields`), an exclusion rule ("Skip that call when list_agent_skills with name already showed the fields"), and a routing rule separating sign-in integrations handled by connect_agent_oauth from Gmail/Calendar/Drive, which are set here. It even names the read-only fallback (get_my_agent) for team members who lack save rights.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.