Skip to main content
Glama

Pushary

by com.pushary

Propose Run Scope

propose_scope
Destructive

Propose what this run will touch and block until the user ratifies it. Call ONCE at the start of a multi-step run, before doing work. The user sees the paths you intend to change, the areas you promise to leave alone, and your definition of done, and approves the whole thing in one tap. After that, editing a file outside the agreed scope stops being auto-approvable: it becomes a separate "wants to widen scope" question instead of a silent approval, so you are asked once about the boundary rather than repeatedly about each file. Use glob syntax ("src/", "/*.test.ts"). Shell commands are NOT scoped here, they stay governed by the permission policy. Scope lives for this session only and is never inherited by another run. Returns { correlationId, ratified, answered, value }; only ratified:true means the contract is enforced. If the first wait times out, poll its correlationId once; a late phone yes ratifies the stored proposal. If that poll is also pending, cancel it before asking in the current chat whether to continue without an enforced scope. If cancellation loses a race, honor the phone answer instead. Never describe a client-only agreement as ratification. SIDE EFFECT: sends a real push notification.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
doneWhenYesWhat "finished" means for this run, one or two lines. Carried for the human to judge against; never enforced automatically.
agentNameNoName of the agent asking, format "{Agent} - {project}".
machineIdNoStable machine id, so two machines never collapse into one session.
sessionIdYesYour per-session id. Required: a scope with no session cannot be enforced, and must never leak into another run.
timeoutMsNoHow long this call blocks, in milliseconds (max 55000).
allowedPathsNoGlobs you intend to change, e.g. ["src/**", "docs/*.md"]. Omit or leave empty to propose no path restriction, which the user is told plainly.
offLimitsPathsNoGlobs you promise not to touch, e.g. ["**/.env*", "infra/**"]. These win wherever they overlap allowedPaths.

Output Schema

TableJSON Schema
NameRequiredDescriptionDefault
noteNoPresent only when the scope is not in force, saying what to do instead of proceeding.
valueNoThe raw answer behind ratified, "yes" or "no".
statusNoThe underlying scope-question state.
answeredYesTrue when the user responded at all. Answered but not ratified means they declined, so ask what scope they want rather than proceeding.
contractYesThe scope exactly as it was put to the user, echoed back so the agent and the human are holding the same contract.
ratifiedYesTrue only on an explicit yes. The contract is in force for this session only when this is true; anything else means proceed as if no scope was agreed.
nextActionNoPoll one live question once; otherwise ask in the current chat whether to continue without an enforced scope.
correlationIdYesId of the scope question. Pass it to wait_for_answer once when the first wait times out.
handoffActionNoRace-safe directive for updated clients. Takes precedence over nextAction.

Schema Changelog

Changes observed during successful MCP inspections. Dates show when Glama detected each change.

  1. Changed5 schema fields changed
    • addedOutput schema / properties / correlationId
      Added value: +{
+  "description": "Id of the scope question. Pass it to wait_for_answer once when the first wait times out.",
+  "type": "string"
+}
    • addedOutput schema / properties / handoffAction
      Added value: +{
+  "description": "Race-safe directive for updated clients. Takes precedence over nextAction.",
+  "enum": [
+    "cancel_then_ask_in_current_client",
+    "stop"
+  ],
+  "type": "string"
+}
    • addedOutput schema / properties / nextAction
      Added value: +{
+  "description": "Poll one live question once; otherwise ask in the current chat whether to continue without an enforced scope.",
+  "enum": [
+    "wait_for_answer",
+    "ask_in_current_client"
+  ],
+  "type": "string"
+}
    • addedOutput schema / properties / status
      Added value: +{
+  "description": "The underlying scope-question state.",
+  "enum": [
+    "answered",
+    "pending",
+    "cancelled",
+    "expired",
+    "missing",
+    "unavailable",
+    "notified",
+    "terminal",
+    "stopped"
+  ],
+  "type": "string"
+}
    • changedOutput schema / required
      Previous value: -[
-  "ratified",
-  "answered",
-  "contract"
-]New value: +[
+  "correlationId",
+  "ratified",
+  "answered",
+  "contract"
+]
  2. Changed1 schema field changed
    • changedOutput schema / (root)
      Previous value: -nullNew value: +{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "additionalProperties": false,
+  "properties": {
+    "answered": {
+      "description": "True when the user responded at all. Answered but not ratified means they declined, so ask what scope they want rather than proceeding.",
+      "type": "boolean"
+    },
+    "contract": {
+      "additionalProperties": false,
+      "description": "The scope exactly as it was put to the user, echoed back so the agent and the human are holding the same contract.",
+      "properties": {
+        "allowedPaths": {
+          "description": "Globs the run may change. Empty means no path restriction was proposed, which the user was told plainly.",
+          "items": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "doneWhen": {
+          "description": "What finished means for this run, as the user saw it.",
+          "type": "string"
+        },
+        "offLimitsPaths": {
+          "description": "Globs the run promised not to touch. These win wherever they overlap allowedPaths.",
+          "items": {
+            "type": "string"
+          },
+          "type": "array"
+        }
+      },
+      "required": [
+        "allowedPaths",
+        "offLimitsPaths",
+        "doneWhen"
+      ],
+      "type": "object"
+    },
+    "note": {
+      "description": "Present only when the scope is not in force, saying what to do instead of proceeding.",
+      "type": "string"
+    },
+    "ratified": {
+      "description": "True only on an explicit yes. The contract is in force for this session only when this is true; anything else means proceed as if no scope was agreed.",
+      "type": "boolean"
+    },
+    "value": {
+      "description": "The raw answer behind ratified, \"yes\" or \"no\".",
+      "type": "string"
+    }
+  },
+  "required": [
+    "ratified",
+    "answered",
+    "contract"
+  ],
+  "type": "object"
+}
  3. First observed

TDQS

A4.4/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description goes well beyond what the annotations already declare by disclosing the blocking behavior, the timeout/poll/retry flow, late ratification, cancellation race handling, and the exact retry semantics. It also surfaces a real side effect: "SIDE EFFECT: sends a real push notification." The caveat "Never describe a client-only agreement as ratification" and the session-only contract both add a strong trust boundary. No contradiction with annotations; in fact, the detail explains why destructiveHint=true.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is front-loaded with the purpose and then each subsequent sentence carries nonzero behavioral content, covering call timing, scope contract, enforcement, exclusions, session lifetime, return semantics, and runtime edge cases. Sentences are not redundant with the parameters. It is a long single paragraph and the race-condition logic could be tightened into structured subpoints, but no sentence is wasted.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a complex tool with 7 parameters, an output schema, 4 annotations, and 4 siblings, this description covers the full agent lifecycle: call site, the blocking wait behavior, what the return object means, how to recover on timeout, when to cancel, how to handle a racing late answer, and what is explicitly out of scope (shell commands). An agent given this description would be able to use the tool correctly without accessing any other documentation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the baseline is 3 per the rubric. The description adds a glob syntax hint ("src/**", "**/*.test.ts") that the schema doesn't spell out, and it maps the narrative terms (paths you intend to change, areas you promise to leave alone, definition of done) to allowedPaths, offLimitsPaths, and doneWhen. However, the schema already carries the full per-parameter meaning, so the description only marginally adds semantic value.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The opening line states a specific verb-resource behavior: "Propose what this run will touch and block until the user ratifies it." This identifies the tool as a human-ratification contract for work boundaries, clearly distinct from sibling tools like ask_user, send_notification, or wait_for_answer. The first sentence and the "Call ONCE at the start of a multi-step run" instruction make the purpose impossible to miss.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

When to use is explicit: "Call ONCE at the start of a multi-step run, before doing work." When-not logic is also specified: "Shell commands are NOT scoped here, they stay governed by the permission policy" and "Scope lives for this session only and is never inherited by another run." It never names an alternative sibling tool (e.g., ask_user or wait_for_answer) as the substitute to use instead, so it stops just short of full alternative routing.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

All Pushary toolsInspect
Try in Browser
RayrunBuild, deploy, and operate MCP servers without becoming an infrastructure team.ray.runAd

Glama MCP Gateway

Add one secure layer between your agents and this server.

TDQS

A4.6/5.0
Disambiguation5/5

Each tool has a clearly distinct responsibility: ask_user blocks for an answer, wait_for_answer polls an existing question, cancel_question retracts a pending one, send_notification is one-way, and propose_scope handles a specific scope-ratification workflow. Even though propose_scope is a form of asking, its contract-enforcement semantics are clearly separated from a general ask_user call.

Naming Consistency5/5

All tool names follow a consistent snake_case verb_noun pattern: ask_user, cancel_question, propose_scope, send_notification, wait_for_answer. The naming is predictable and makes the action and target of each tool immediately clear.

Tool Count5/5

Five tools is well-scoped for a push-notification and user-question server. Each tool covers a distinct part of the interaction lifecycle without redundant or filler operations.

Completeness4/5

The core lifecycle is well covered: create a question, wait for an answer, cancel a stale question, send a one-way notification, and propose a scope contract. A minor gap is the lack of a way to list or inspect all pending questions, though wait_for_answer and cancel_question handle the primary workflows adequately.

Resources