Skip to main content
Glama

agentView

by de.agentview

Authenticate Session

authenticate
Idempotent

Validates a JWT agent token and reports the identity and scope it carries. It caches NOTHING: no server-side state remembers this call, so the credential still travels on every protected call afterwards. Use only when your client cannot send an Authorization: Bearer header; prefer session_request_id-based auth via create_auth_session. Not needed after get_auth_session returned 'active'.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
jwtNoAlias for token. Use this if your wrapper cannot send the 'token' field reliably.
tokenNoThe raw JWT token string returned by get_auth_session or an OAuth access token. Pass the opaque token exactly as received — do not add a 'Bearer ' prefix and do not expand or decode the JWT claims.
access_tokenNoAlias for token. Use this if your wrapper follows OAuth naming conventions.

Output Schema

TableJSON Schema
NameRequiredDescriptionDefault
nameNo
emailNo
scopeNo
userIdNo
isAgentNo
expiresAtNo
sessionBoundNo
authenticatedNo
transportAuthRequiredNo

Schema Changelog

Changes observed during successful MCP inspections. Dates show when Glama detected each change.

  1. Changed9 schema fields changed
    • changedOutput schema / properties / authenticated / type
      Previous value: -"boolean"New value: +[
+  "boolean",
+  "null"
+]
    • changedOutput schema / properties / email / type
      Previous value: -"string"New value: +[
+  "string",
+  "null"
+]
    • changedOutput schema / properties / expiresAt / type
      Previous value: -"string"New value: +[
+  "string",
+  "null"
+]
    • changedOutput schema / properties / isAgent / type
      Previous value: -"boolean"New value: +[
+  "boolean",
+  "null"
+]
    • changedOutput schema / properties / name / type
      Previous value: -"string"New value: +[
+  "string",
+  "null"
+]
    • changedOutput schema / properties / scope / type
      Previous value: -"string"New value: +[
+  "string",
+  "null"
+]
    • changedOutput schema / properties / sessionBound / type
      Previous value: -"boolean"New value: +[
+  "boolean",
+  "null"
+]
    • changedOutput schema / properties / transportAuthRequired / type
      Previous value: -"boolean"New value: +[
+  "boolean",
+  "null"
+]
    • changedOutput schema / properties / userId / type
      Previous value: -"string"New value: +[
+  "string",
+  "null"
+]
  2. Changed4 schema fields changed
    • addedInput schema / properties / access_token
      Added value: +{
+  "description": "Alias for token. Use this if your wrapper follows OAuth naming conventions.",
+  "type": "string"
+}
    • addedInput schema / properties / jwt
      Added value: +{
+  "description": "Alias for token. Use this if your wrapper cannot send the 'token' field reliably.",
+  "type": "string"
+}
    • removedInput schema / required
      Removed value: -[
-  "token"
-]
    • changedOutput schema / (root)
      Previous value: -nullNew value: +{
+  "properties": {
+    "authenticated": {
+      "type": "boolean"
+    },
+    "email": {
+      "type": "string"
+    },
+    "expiresAt": {
+      "format": "date-time",
+      "type": "string"
+    },
+    "isAgent": {
+      "type": "boolean"
+    },
+    "name": {
+      "type": "string"
+    },
+    "scope": {
+      "type": "string"
+    },
+    "sessionBound": {
+      "type": "boolean"
+    },
+    "transportAuthRequired": {
+      "type": "boolean"
+    },
+    "userId": {
+      "type": "string"
+    }
+  },
+  "type": "object"
+}
  3. First observed

TDQS

A4.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description adds a valuable behavioral trait beyond the annotations: 'It caches NOTHING: no server-side state remembers this call, so the credential still travels on every protected call afterwards.' This explains the statelessness and its practical consequence. Annotations already provide idempotentHint and destructiveHint, so the description's extra context earns a 4 rather than a 5.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three sentences, each with a distinct purpose: purpose, behavioral caveat, and usage routing. No filler words, and the most important information is front-loaded.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description covers what the tool does, when it should and shouldn't be used, and the crucial consequence of its statelessness. With an output schema available to describe return values, nothing essential is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, with all three parameters (jwt, token, access_token) fully described, including aliases and usage warnings. The description does not add parameter-level detail, so the baseline of 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The first sentence states a specific verb and resource: 'Validates a JWT agent token and reports the identity and scope it carries.' It clearly distinguishes this tool from create_auth_session (session_request_id-based auth) and get_auth_session (active status) in the same description.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly states when to use it ('Use only when your client cannot send an Authorization: Bearer header'), names the preferred alternative (create_auth_session), and gives a negative condition ('Not needed after get_auth_session returned active'). This is complete routing guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

All agentView toolsInspect
Try in Browser
RayrunBuild, deploy, and operate MCP servers without becoming an infrastructure team.ray.runAd

Glama MCP Gateway

Add one secure layer between your agents and this server.

TDQS

A4/5.0
Disambiguation4/5

Most tools map cleanly to distinct resource-action pairs (displays, organizations, assets, data slots, store templates, auth). A few clusters like the get_store_template_* family and the auth/session tools could still confuse an agent, but their descriptions are explicit enough to separate them.

Naming Consistency4/5

The dominant pattern is consistent verb_noun snake_case (list_*, get_*, create_*, delete_*, send_*, set_*, manage_*). Deviations like fetch, search, authenticate, logout, and pair_by_code are understandable but break the otherwise uniform naming scheme.

Tool Count1/5

With 57 tools this server far exceeds the 50+ threshold, creating an extreme tool-set size for an MCP server. Even though the underlying platform is feature-rich, the sheer number of tools heavily taxes context and selection.

Completeness4/5

The surface covers display, organization, asset, data slot, store template, auth, API key, and licensing lifecycles in impressive depth. Minor gaps exist, such as no delete operation for display categories and no reboot/power control for displays.

Resources