MCP.AI for IDE agents (Cursor, etc.): log in in the browser, copy the access token. Best: add it to this server's config as a header Authorization: Bearer <token> for a permanent, non-expiring connection. Or paste it here for a session-only login: call with { token: "" } after the user pastes, or with no args to get the link.
| Name | Required | Description | Default |
|---|---|---|---|
| token | No |
Changes observed during successful MCP inspections. Dates show when Glama detected each change.
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description adds practical behavior details beyond the annotations: it explains how the login flow works, the difference between a permanent configured connection and a session-only pasted token, and what the no-args call returns. It does not describe the exact return format or the failure behavior for invalid/expired tokens.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is somewhat long but each sentence earns its place: it states the login method, config-based permanent option, session-based option, and exactly how to call with and without arguments. There is a bit of extra context ('MCP.AI for IDE agents...') that helps targeting but is not strictly necessary.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With only one schema property and no output schema, a summary of the full login flow is necessary, and the description covers it: get token in browser, use one-time token, or omit token for the link. It is missing only an explicit statement of what the tool returns, which would make it fully complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema only defines token as an optional string with no additional description. The description compensates by explaining that the token is a JWT access token, that it is passed after the user pastes it, and that omitting it triggers the link-returning flow. It could add expected token format or validation behavior, but it already gives substantial practical meaning.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly identifies the action: authenticate with MCP.AI by logging in through the browser and providing or obtaining an access token. It is specific about the two call modes, which distinguishes this tool from siblings like connect or show_version.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives explicit usage guidance: use no args to get the login link, or pass { token: "<jwt>" } once the user has pasted an access token. It also recommends the permanent config-based Authorization header over the session-only approach. It does not explicitly say when to avoid this tool versus other sibling tools.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Add one secure layer between your agents and this server.
The tools are mostly distinct in purpose: authenticate and connect handle credentials, marketplace handles discovery/execution, toolkit_info shows state, ecac_dctf_web_consultar does a specific query, report_bug and show_version are utility functions. However, connect and toolkit_info overlap in reporting connection status, and marketplace's invoke behavior might confuse with directly calling tools like ecac_dctf_web_consultar if not careful.
The naming is inconsistent: most tools use lowercase snake_case or simple verbs (authenticate, connect, marketplace, report_bug, show_version, toolkit_info), but ecac_dctf_web_consultar uses a mixed pattern with underscores and a domain-specific name, breaking the convention. It's readable but not uniform.
7 tools is reasonable for a combined MCP marketplace and specific query server. The count is not excessive, and each tool serves a distinct function, though some like report_bug and show_version are minor utilities.
The surface covers authentication, connection status, marketplace discovery/invocation, toolkit state, and a specific query tool. It lacks obvious operations like uninstall/subscribe are embedded in marketplace, and there's no tool for managing tokens directly (only via authenticate). Overall, the domain is covered adequately, though some marketplace operations are bundled into one mega-tool.