pwpush-mcp
Click on "Install Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@pwpush-mcpcreate a push with text 'Here is my confidential data'"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
pwpush-mcp
A Model Context Protocol (MCP) server for Password Pusher — create and manage self-destructing secret links from any MCP-compatible client (Claude Desktop, Claude Code, etc.).
Why a "preview but never retrieve" design?
Retrieving a push consumes a view and is irreversible. To keep secrets safe, this server never retrieves a push payload. It can create pushes and hand back the shareable URL, preview that URL (without consuming a view), and manage the lifecycle (expire, audit, list). The secret is only ever read by the human who opens the link.
Related MCP server: passwords-mcp
Tools
Tool | Description | Auth |
| Create a secret link (text / url / qr / file). Returns the share URL, never the secret. | optional* |
| Get a push's share URL without consuming a view. | optional* |
| Permanently expire a push. Irreversible. | optional* |
| View access log (IPs, user agents, events). | token |
| List active pushes for the account. | token |
| List expired pushes for the account. | token |
| Report the instance version and feature flags. | none |
* The bearer token is sent whenever PWPUSH_API_TOKEN is set. Whether it is
required depends on the instance: some allow anonymous push creation, preview,
and expiry (for pushes created with deletable_by_viewer). Listing and audit
are always account-scoped and need a token.
Defaults
New pushes expire after 1 view or 7 days (whichever comes first), with a
retrieval step enabled. Override per call via expire_after_views and duration.
File pushes
Attach one or more local files by passing file_paths; kind is forced to
file and the upload is sent as multipart. payload is optional in that case.
Prompts
User-controlled templates (slash-command style in clients that support MCP prompts). A prompt renders a message that guides the assistant to call the matching tool — it never touches the API itself.
Prompt | Arguments | Drives |
|
|
|
|
|
|
|
|
|
Prompts follow the same gating as tools: PWPUSH_READ_ONLY=true hides the
write prompts (create_push, expire_push), and PWPUSH_ENABLED_TOOLS
filters prompts by name too — a prompt is offered only when its tool is.
Configuration
Set via environment variables — the API token is never a tool argument:
Variable | Required | Default | Notes |
| depends on instance | — | Generate at |
| v1 auth only | — | Email tied to the token; legacy (v1) instances auth via |
| no |
| EU: |
| no |
|
|
| no |
| Set |
| no | — | Path to a CA bundle (preferred over disabling verification). |
| no |
| Remove write tools ( |
| no | — | Comma-separated |
| no |
| Emit one redacted JSON line per write-tool call on stderr. |
| no | — | Allowlist root for file pushes. Unset = file uploads disabled. When set, |
|
| — | Bearer token required on the |
| no |
| Opt out of the bearer requirement when fronting the server with your own auth proxy. |
| no | loopback | Comma-separated |
|
|
| Multi-tenant: let each client send its own pwpush credentials via the |
| no |
| Cap concurrent HTTP requests. |
| no |
| Retries for connection errors / |
| no |
| Per-request HTTP timeout, in seconds. |
Security & multi-tenant
PWPUSH_READ_ONLY=truestrips the write tools entirely — onlypreview_push,get_push_audit,list_*andget_versionremain.expire_pushis the one destructive tool (destructiveHint), so clients can warn on it.PWPUSH_ENABLED_TOOLSnarrows the exposed surface to an allowlist offnmatchglobs, e.g. expose only listing/preview to an auditor.PWPUSH_AUDIT_LOG(on by default) writes one JSON line per write call to thepwpush_mcp.auditlogger on stderr — ship it to Loki/CloudWatch/journald via your runtime. Secrets (payload,passphrase,note,name, file contents, token) are redacted;nameis hashed in the audittargetfor grep-ability. The token is also redacted fromConfigreprs and error text.PWPUSH_FILE_ROOTgates file pushes. File uploads are disabled by default because their bytes become retrievable via the returned share URL — an exfiltration vector for an over-eager or malicious client. Set it to a directory to enable uploads from that subtree only;~expansion and symlink resolution are applied before the containment check, so../traversal and symlink escapes are rejected.
HTTP transport (
--listen) is sensitive. The server may holdPWPUSH_API_TOKENand exposes account-scoped tools. The transport has no TLS of its own, so:
it binds
127.0.0.1by default — only bind a public interface behind a TLS + auth reverse proxy;it requires
MCP_HTTP_TOKEN(clients sendAuthorization: Bearer <token>) and refuses to start without it, unless you setMCP_HTTP_ALLOW_UNAUTHENTICATED=true;it validates the
Hostheader (MCP_HTTP_ALLOWED_HOSTS) to block DNS-rebinding from a browser.
stdiomode is unaffected by all of the above.
Multi-tenant (per-client credentials)
By default the HTTP server uses one shared identity (PWPUSH_API_TOKEN). Set
PWPUSH_PER_REQUEST_CREDENTIALS=true to instead let each client supply its
own pwpush credentials, so one hosted server serves many accounts:
the client sends
X-Pwpush-Token(andX-Pwpush-Emailfor v1 instances) as HTTP headers; the server builds a per-request, per-tenant client from them;credentials ride the transport, never a tool argument — they are never seen by the language model and are kept out of logs (the header is scrubbed);
only the credentials are per-request.
base_url,read_only,enabled_toolsandfile_rootstay operator-controlled, so a tenant can neither redirect the instance nor widen its own permissions;if a request sends no
X-Pwpush-Token, it falls back to the env token (so you can run a pure multi-tenant server with noPWPUSH_API_TOKENat all — account-scoped calls then simply require the header).
Credentials in headers travel in clear text: serve only behind TLS.
MCP_HTTP_TOKEN(transport gate) andX-Pwpush-Token(tenant identity) are independent — keep both for a shared hosted deployment.
Example client config (MCP client that supports HTTP headers):
{
"mcpServers": {
"pwpush": {
"url": "https://pwpush-mcp.example.com/mcp",
"headers": {
"Authorization": "Bearer <MCP_HTTP_TOKEN>",
"X-Pwpush-Token": "<this-client's-pwpush-token>",
"X-Pwpush-Email": "<this-client's-email, v1 only>"
}
}
}
}API v1 / v2
The server speaks both the modern v2 API (pwpush.com, eu.pwpush.com,
recent self-hosted) and the legacy v1 API (older self-hosted instances).
It auto-detects which one the instance exposes. Note for v1: expiry is
day-granular, so sub-day duration values round up to one day, and file/URL
pushes are only available if the instance enables them.
Both paths are exercised end-to-end: v1 against a live legacy instance,
v2 against pwpush.com (API 2.1). v2 calls target the .json endpoints
deliberately — the suffix-less paths issue a cross-host redirect, so they are
avoided to keep the payload from leaking to another host.
duration accepts a human label (15m, 30m, 45m, 1h, 6h, 12h, 1d,
2d, 3d, 4d, 5d, 6d, 1w, 2w, 3w, 1mo, 2mo, 3mo) or the raw
enum index 0–17.
Install & run
Published as
pwpush-mcpon PyPI andghcr.io/k9fr4n/pwpush-mcpon GHCR, produced by the release workflow on each version tag (latest:v0.5.0).
With uv (recommended):
uvx pwpush-mcpOr with pipx:
pipx run pwpush-mcpFrom source:
pip install -e ".[dev]"
python -m pwpush_mcpTransports
stdio is the default (Claude Desktop / Claude Code / Docker MCP Gateway). To
expose the server over the network as Streamable HTTP (single /mcp
endpoint, MCP spec revision 2025-03-26+ — the legacy HTTP+SSE transport it
replaces is deprecated):
# Requires MCP_HTTP_TOKEN; binds 127.0.0.1:8000 by default, endpoint at /mcp.
MCP_HTTP_TOKEN=$(openssl rand -hex 32) pwpush-mcp --listen 8000
# Clients then send: Authorization: Bearer <MCP_HTTP_TOKEN> to http://127.0.0.1:8000/mcpDocker
docker run --rm -i \
-e PWPUSH_BASE_URL="https://pwpush.com" \
-e PWPUSH_API_TOKEN="your-token-here" \
ghcr.io/k9fr4n/pwpush-mcp:latest # stdio (default)HTTP mode via compose.yml (override the entrypoint with --listen):
cp .env.example .env && $EDITOR .env
docker compose up # serves Streamable HTTP on http://localhost:8000/mcpFor v1 (legacy self-hosted) instances also pass -e PWPUSH_API_EMAIL=....
Docker MCP Gateway
The image ships the io.docker.server.metadata label and a catalog entry so the
Docker MCP Gateway can spawn it
natively. See catalog/readme.md:
docker mcp catalog create pwpush-private
docker mcp catalog add pwpush-private pwpush-mcp ./catalog/server.yaml
docker mcp server enable pwpush-mcp
docker mcp gateway run --catalog pwpush-privateClient configuration
Claude Desktop / Claude Code (mcp config)
{
"mcpServers": {
"pwpush": {
"command": "uvx",
"args": ["pwpush-mcp"],
"env": {
"PWPUSH_API_TOKEN": "your-token-here",
"PWPUSH_BASE_URL": "https://eu.pwpush.com"
}
}
}
}Development
pip install -e ".[dev]"
ruff check src tests && ruff format --check src tests
mypy src
pytest -q --cov=pwpush_mcp --cov-fail-under=80See CONTRIBUTING.md for the tool/env-var checklists and the release process, and CHANGELOG.md / UPGRADING.md for version history.
License
MIT — see LICENSE.
Available Tools
7 toolscreate_pushA
Create a Password Pusher secret link and return its sharing URL. The secret payload is NOT echoed back. Share the returned html_url with the recipient. A token is sent if PWPUSH_API_TOKEN is set; some instances also allow anonymous push creation. Pass file_paths to attach one or more local files (a file push). For a text/url/qr push, set payload and kind.
| Name | Required | Description | Default |
|---|---|---|---|
| kind | No | Push type: 'text', 'url', or 'qr'. Ignored when file_paths are given (forced to 'file'). On v1 (legacy) instances 'qr' is created as a text push. | text |
| name | No | Optional name for the push. | |
| note | No | Optional private note, visible only to the creator. | |
| payload | No | The secret to push (text, a URL, or QR content). Optional when file_paths are given. | |
| duration | No | Time before the push expires. Accepts a label (15m, 30m, 45m, 1h, 6h, 12h, 1d, 2d, 3d, 4d, 5d, 6d, 1w, 2w, 3w, 1mo, 2mo, 3mo) or the raw enum index 0..17. | 7d |
| file_paths | No | Local file path(s) to attach as a file push (multipart upload). | |
| passphrase | No | Optional passphrase required to view the secret. | |
| retrieval_step | No | Require an extra click before the secret is revealed. | |
| expire_after_views | No | Number of views before expiry (1-100). | |
| deletable_by_viewer | No | Allow the recipient to delete the push. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Beyond annotations (readOnlyHint=false, destructiveHint=false), the description discloses important behaviors: the secret payload is NOT echoed back, a token is sent if PWPUSH_API_TOKEN is set, some instances allow anonymous push creation, and v1 instances treat 'qr' as text. These details add value beyond the structured annotation fields and help set expectations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is efficiently structured: purpose first, then key behavioral notes, then file vs. text/url/qr usage. Every sentence carries distinct information, and the length is appropriate for the tool's complexity. No redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given 10 parameters and no output schema, the description adequately covers critical context: return URL, non-echo behavior, auth token/anonymous option, file push mechanics, and legacy v1 quirk. It is complete enough for an agent to correctly select and invoke the tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the baseline is 3. The description adds meaning by explaining parameter interactions: file_paths forces a 'file' kind, payload is optional when file_paths are given, and 'qr' behaves differently on v1. This goes beyond individual parameter descriptions and clarifies the overall use.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a clear verb+resource: 'Create a Password Pusher secret link and return its sharing URL.' It explicitly states the tool's primary function and distinguishes it from siblings like expire_push and list_active_pushes by focusing on creation. The purpose is unmistakable.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides clear context on when to use the tool: share the returned html_url with the recipient, use file_paths for file pushes, set payload and kind for text/url/qr pushes. It also notes token/anonymous modes. Lacks an explicit 'use this instead of X' alternative comparison, but the guidance is contextually strong.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
expire_pushADestructive
Permanently expire (delete) a push. IRREVERSIBLE. This destroys the payload and any attached files for good. Requires PWPUSH_API_TOKEN (or a push created with deletable_by_viewer).
| Name | Required | Description | Default |
|---|---|---|---|
| url_token | Yes | The url_token of the push to expire. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Beyond the destructiveHint annotation, the description adds critical details: 'IRREVERSIBLE' and 'destroys the payload and any attached files for good'. It also mentions the auth requirement, providing meaningful context for a destructive operation.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is brief and impactful, with each sentence providing essential information: the action, irreversibility, and required credentials. It is well-structured with the warning front-loaded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple destructive tool with one parameter and no output schema, the description covers all necessary aspects: what it does, irreversible consequences, and authentication requirements. No additional information is needed for correct invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema already provides 100% coverage for the single parameter url_token with a clear description. The tool description does not add additional meaning about the parameter, so the baseline score of 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb 'expire' and resource 'push', and explicitly says 'delete' and 'IRREVERSIBLE'. It distinguishes itself from siblings by being the destructive action, while other tools like create_push and preview_push are non-destructive.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage for permanently deleting a push and notes the required authentication (PWPUSH_API_TOKEN). It does not explicitly name alternatives or state when not to use, but the sibling context makes the purpose clear.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_push_auditARead-only
Return the audit log (views, IPs, user agents) for a push. Requires auth.
| Name | Required | Description | Default |
|---|---|---|---|
| page | No | Page number (50 per page). | |
| url_token | Yes | The url_token of the push. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and destructiveHint=false, so the safety profile is known. The description adds valuable context beyond annotations: it specifies that auth is required and discloses the contents of the audit log (views, IPs, user agents). This enriches the agent's understanding of side effects and prerequisites.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence that front-loads the main purpose and immediately adds the auth requirement. Every word earns its place, with no filler or repetition. It is appropriately sized for a simple read tool.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's simplicity (2 params, 1 required, no output schema), the description covers the core return value and the key context. It could mention pagination or the fact that page defaults to 1, but the schema already provides those details. The description is sufficient to understand what the tool does and returns.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, with both 'page' and 'url_token' already having descriptions. The tool description adds no extra parameter-level meaning beyond 'for a push', so the baseline of 3 applies; the schema carries the parameter semantics.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action ('Return') and the resource ('the audit log (views, IPs, user agents) for a push'), which unambiguously distinguishes it from sibling tools like list_active_pushes or expire_push. The specific content of the audit log adds precision.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage by stating 'for a push', but it does not explicitly contrast with alternatives or state when to choose this tool over siblings. There is no exclusion or alternative naming, so it's clear in context but lacks direct guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_versionARead-only
Return the target instance's version and enabled feature flags (no auth).
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and destructiveHint=false. The description adds the behavioral detail that no authentication is required, which is valuable beyond the annotations. It also clarifies the specific return content (version and feature flags).
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence, front-loaded with the action and resource, and includes the key caveat about no authentication. Every word earns its place with no redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a zero-parameter, read-only tool with no output schema, the description sufficiently explains the return value and access requirements. The low complexity means no additional context is needed to invoke this tool correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters, so the baseline is 4. The description does not need to explain parameters, and the empty input schema is fully covered. No additional parameter semantics are required.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool returns the target instance's version and enabled feature flags. This is a specific verb-resource pairing that distinguishes it from the sibling push-management tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description mentions 'no auth', implying it is safe for quick checks without credentials, but does not explicitly state when to use it versus alternatives. The context is clear enough for a simple read-only version retrieval, but no exclusions or alternative tool references are given.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_active_pushesARead-only
List the authenticated account's active (not yet expired) pushes.
| Name | Required | Description | Default |
|---|---|---|---|
| page | No | Page number (50 per page). |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and destructiveHint=false, covering the safety profile. The description adds scope ('authenticated account's') and the active filter, but does not disclose additional behavioral traits such as pagination behavior or return format. This is similar to the get_calls calibration where a 3 was appropriate.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence, immediately front-loaded with the action and resource, with no superfluous words. It is concise while still delivering purpose and scope.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the low complexity (one optional parameter, no output schema, strong annotations), the description is complete. It clearly states what the tool does, the scope, and the filtering criteria, which is sufficient for an agent to select and invoke it correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, with the only parameter 'page' fully described in the schema. The description adds no additional parameter semantics, so the baseline of 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb 'List' with a clear resource 'pushes' and scope 'authenticated account's active (not yet expired)'. It directly contrasts with the sibling tool 'list_expired_pushes' by emphasizing 'not yet expired', fully distinguishing itself.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies when to use the tool (for active pushes) and hints at the alternative via 'not yet expired', but it does not explicitly state exclusions or name alternative tools. Usage context is implied rather than directly stated.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_expired_pushesARead-only
List the authenticated account's expired pushes.
| Name | Required | Description | Default |
|---|---|---|---|
| page | No | Page number (50 per page). |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and destructiveHint=false, covering the safety profile. The description adds a useful scope ('authenticated account's') but does not disclose other behaviors like pagination details or return format. Given the annotations, the incremental value is moderate, aligning with a baseline acceptable disclosure.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, concise sentence that states exactly what the tool does without any redundancy or filler. It is efficiently front-loaded and earns every word.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple read-only list tool with one optional parameter, the description plus annotations and schema provide sufficient information. The absence of an output schema leaves a minor ambiguity about return format, but the verb 'List' implies an array of pushes, so the overall completeness is strong.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% for the single 'page' parameter, including a description 'Page number (50 per page)'. The tool description adds no additional semantic information about the parameter, so the schema carries the full burden—baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb 'List' with a clear resource 'expired pushes' and scope 'authenticated account's', making its purpose unmistakable and differentiating it from siblings like 'list_active_pushes' and 'get_push_audit'.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives a clear context: use this tool when needing expired pushes of the authenticated account. However, it does not explicitly mention alternatives or exclusions, but the context is sufficiently clear that an agent can infer the appropriate use.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
preview_pushARead-only
Return the shareable secret URL for a push WITHOUT consuming a view.
| Name | Required | Description | Default |
|---|---|---|---|
| url_token | Yes | The url_token of an existing push. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and destructiveHint=false, so the safety profile is covered. The description adds meaningful behavioral context beyond annotations by specifying 'WITHOUT consuming a view', which is a non-obvious behavior not present in the structured fields. However, it doesn't disclose potential rate limits or authorization nuances, which prevents a higher score.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, tightly written sentence that front-loads the action ('Return') and result ('shareable secret URL') while adding a crucial caveat. Every word adds value, with no redundancy or fluff.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool is simple with one parameter and strong annotations. The description effectively communicates the core function and the distinctive 'without consuming a view' behavior. Although there is no output schema, the description hints at the return content (a URL), which is adequate for this tool's complexity.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% for the single parameter (url_token), so the schema fully documents the parameter. The description adds no extra meaning about the parameter beyond saying 'a push', which is already implied by the schema. Baseline 3 is appropriate since the schema carries the burden.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool returns a shareable secret URL for a push, using a specific verb ('Return') and resource ('push'). It also distinguishes itself from sibling tools like list_active_pushes or expire_push by adding the phrase 'WITHOUT consuming a view', which is a unique preview capability.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage context—previewing a push without consuming a view—but does not explicitly mention when to use this tool over alternatives or exclude other scenarios. It lacks explicit 'when/when-not' guidance that would make it clearer, though some context is provided by the preview intent.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.
7 tool updates
v0.5.0- First observed
create_push - First observed
expire_push - First observed
get_push_audit - First observed
get_version - First observed
list_active_pushes - First observed
list_expired_pushes - First observed
preview_push
TDQS
Each tool targets a distinct resource or action: auditing a push, listing pushes by expiration status, checking server version, creating, previewing, or expiring a push. The overlap between list_active_pushes and list_expired_pushes is resolved by the explicit status distinction.
All tool names follow a consistent verb_noun pattern using snake_case: get_push_audit, list_active_pushes, create_push, preview_push, expire_push. The verbs are specific and the pattern is uniform across the set.
With 7 tools, the server is well-scoped for a secret-sharing service. Each tool covers a meaningful operation without redundancy or bloat.
The toolset covers the core lifecycle: create, preview (retrieve URL), expire (delete), audit, and list. A minor gap is the lack of a 'get_push' for retrieving full push metadata, but preview and audit provide sufficient insight for most workflows.
Maintenance
Resources
Unclaimed servers have limited discoverability.
Looking for Admin?
If you are the server author, to access and configure the admin panel.
Related MCP Connectors
The MCP server for Azure DevOps, bringing the power of Azure DevOps directly to your agents.
An MCP server that provides tools to discover and retrieve podcast episodes transcripts.
A MCP server built for developers enabling Git based project management with project and personal…
An MCP server that automatically collects feedback on your MCP server.
Related MCP Servers
- AlicenseAqualityCmaintenanceA tiny MCP server that sends push notifications through Pushover, supporting message, title, priority, sound, URL, and device parameters.11MIT
- AlicenseNot gradedqualityCmaintenanceMCP server for the Nextcloud Passwords app, enabling reading and managing password entries (list, search, create, update, delete) with strong security guarantees.MIT
- AlicenseNot gradedqualityCmaintenanceAn MCP server that scans code for exposed secrets (API keys, tokens, private keys, high-entropy strings) with placeholder-aware allowlisting and fully redacted reports, enabling agents to detect leaks before committing.1MIT
- FlicenseNot gradedqualityBmaintenanceMCP server for end-to-end encrypted secret storage and retrieval, enabling LLM agents to fetch secrets by name via one-time URLs while keeping plaintext out of model context and logs.1-
Latest Blog Posts
- Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)By Om-Shree-0709 on .mcpAgent IdentityOAuth 2.1
- Your AI Chatbot Just Exposed Your CEO's Salary to an InternBy Om-Shree-0709 on .Agent IdentityMCP SecurityOAuth Delegation
- Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)By Om-Shree-0709 on .Agentic AiPrompt InjectionWebAssembly
MCP directory API
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/k9fr4n/pwpush-mcp'
If you have feedback or need assistance with the MCP directory API, please join our Discord server