Skip to main content
Glama
k9fr4n

pwpush-mcp

by k9fr4n

pwpush-mcp

A Model Context Protocol (MCP) server for Password Pusher — create and manage self-destructing secret links from any MCP-compatible client (Claude Desktop, Claude Code, etc.).

Why a "preview but never retrieve" design?

Retrieving a push consumes a view and is irreversible. To keep secrets safe, this server never retrieves a push payload. It can create pushes and hand back the shareable URL, preview that URL (without consuming a view), and manage the lifecycle (expire, audit, list). The secret is only ever read by the human who opens the link.

Related MCP server: passwords-mcp

Tools

Tool

Description

Auth

create_push

Create a secret link (text / url / qr / file). Returns the share URL, never the secret.

optional*

preview_push

Get a push's share URL without consuming a view.

optional*

expire_push

Permanently expire a push. Irreversible.

optional*

get_push_audit

View access log (IPs, user agents, events).

token

list_active_pushes

List active pushes for the account.

token

list_expired_pushes

List expired pushes for the account.

token

get_version

Report the instance version and feature flags.

none

* The bearer token is sent whenever PWPUSH_API_TOKEN is set. Whether it is required depends on the instance: some allow anonymous push creation, preview, and expiry (for pushes created with deletable_by_viewer). Listing and audit are always account-scoped and need a token.

Defaults

New pushes expire after 1 view or 7 days (whichever comes first), with a retrieval step enabled. Override per call via expire_after_views and duration.

File pushes

Attach one or more local files by passing file_paths; kind is forced to file and the upload is sent as multipart. payload is optional in that case.

Prompts

User-controlled templates (slash-command style in clients that support MCP prompts). A prompt renders a message that guides the assistant to call the matching tool — it never touches the API itself.

Prompt

Arguments

Drives

create_push

payload (required); duration, expire_after_views, passphrase, name, note (optional)

create_push

preview_push

url_token (required)

preview_push

expire_push

url_token (required)

expire_push (asks to confirm first)

Prompts follow the same gating as tools: PWPUSH_READ_ONLY=true hides the write prompts (create_push, expire_push), and PWPUSH_ENABLED_TOOLS filters prompts by name too — a prompt is offered only when its tool is.

Configuration

Set via environment variables — the API token is never a tool argument:

Variable

Required

Default

Notes

PWPUSH_API_TOKEN

depends on instance

Generate at <base-url>/api_tokens. Always needed for listing/audit.

PWPUSH_API_EMAIL

v1 auth only

Email tied to the token; legacy (v1) instances auth via X-User-Email + X-User-Token.

PWPUSH_BASE_URL

no

https://pwpush.com

EU: https://eu.pwpush.com. Self-hosted: your domain.

PWPUSH_API_VERSION

no

auto

auto | v1 | v2. Auto-detects the API generation.

PWPUSH_VERIFY_SSL

no

true

Set false only for internal instances with an untrusted cert.

PWPUSH_CA_BUNDLE

no

Path to a CA bundle (preferred over disabling verification).

PWPUSH_READ_ONLY

no

false

Remove write tools (create_push, expire_push).

PWPUSH_ENABLED_TOOLS

no

Comma-separated fnmatch allowlist (e.g. list_*,get_version). Empty = all.

PWPUSH_AUDIT_LOG

no

true

Emit one redacted JSON line per write-tool call on stderr.

PWPUSH_FILE_ROOT

no

Allowlist root for file pushes. Unset = file uploads disabled. When set, create_push(file_paths=…) may only read files under this directory (traversal/symlink escapes rejected).

MCP_HTTP_TOKEN

--listen only

Bearer token required on the /mcp endpoint. --listen refuses to start without it (see below).

MCP_HTTP_ALLOW_UNAUTHENTICATED

no

false

Opt out of the bearer requirement when fronting the server with your own auth proxy.

MCP_HTTP_ALLOWED_HOSTS

no

loopback

Comma-separated Host allowlist (anti-DNS-rebinding). Defaults to localhost,127.0.0.1,[::1] + --host. Use * to allow any.

PWPUSH_PER_REQUEST_CREDENTIALS

--listen only

false

Multi-tenant: let each client send its own pwpush credentials via the X-Pwpush-Token / X-Pwpush-Email headers (see below).

PWPUSH_MAX_CONCURRENT

no

0

Cap concurrent HTTP requests. 0 = unlimited.

PWPUSH_MAX_RETRIES

no

2

Retries for connection errors / 429 / 5xx (backoff honours Retry-After).

PWPUSH_TIMEOUT

no

30

Per-request HTTP timeout, in seconds.

Security & multi-tenant

  • PWPUSH_READ_ONLY=true strips the write tools entirely — only preview_push, get_push_audit, list_* and get_version remain. expire_push is the one destructive tool (destructiveHint), so clients can warn on it.

  • PWPUSH_ENABLED_TOOLS narrows the exposed surface to an allowlist of fnmatch globs, e.g. expose only listing/preview to an auditor.

  • PWPUSH_AUDIT_LOG (on by default) writes one JSON line per write call to the pwpush_mcp.audit logger on stderr — ship it to Loki/CloudWatch/journald via your runtime. Secrets (payload, passphrase, note, name, file contents, token) are redacted; name is hashed in the audit target for grep-ability. The token is also redacted from Config reprs and error text.

  • PWPUSH_FILE_ROOT gates file pushes. File uploads are disabled by default because their bytes become retrievable via the returned share URL — an exfiltration vector for an over-eager or malicious client. Set it to a directory to enable uploads from that subtree only; ~ expansion and symlink resolution are applied before the containment check, so ../ traversal and symlink escapes are rejected.

HTTP transport (--listen) is sensitive. The server may hold PWPUSH_API_TOKEN and exposes account-scoped tools. The transport has no TLS of its own, so:

  • it binds 127.0.0.1 by default — only bind a public interface behind a TLS + auth reverse proxy;

  • it requires MCP_HTTP_TOKEN (clients send Authorization: Bearer <token>) and refuses to start without it, unless you set MCP_HTTP_ALLOW_UNAUTHENTICATED=true;

  • it validates the Host header (MCP_HTTP_ALLOWED_HOSTS) to block DNS-rebinding from a browser.

stdio mode is unaffected by all of the above.

Multi-tenant (per-client credentials)

By default the HTTP server uses one shared identity (PWPUSH_API_TOKEN). Set PWPUSH_PER_REQUEST_CREDENTIALS=true to instead let each client supply its own pwpush credentials, so one hosted server serves many accounts:

  • the client sends X-Pwpush-Token (and X-Pwpush-Email for v1 instances) as HTTP headers; the server builds a per-request, per-tenant client from them;

  • credentials ride the transport, never a tool argument — they are never seen by the language model and are kept out of logs (the header is scrubbed);

  • only the credentials are per-request. base_url, read_only, enabled_tools and file_root stay operator-controlled, so a tenant can neither redirect the instance nor widen its own permissions;

  • if a request sends no X-Pwpush-Token, it falls back to the env token (so you can run a pure multi-tenant server with no PWPUSH_API_TOKEN at all — account-scoped calls then simply require the header).

Credentials in headers travel in clear text: serve only behind TLS. MCP_HTTP_TOKEN (transport gate) and X-Pwpush-Token (tenant identity) are independent — keep both for a shared hosted deployment.

Example client config (MCP client that supports HTTP headers):

{
  "mcpServers": {
    "pwpush": {
      "url": "https://pwpush-mcp.example.com/mcp",
      "headers": {
        "Authorization": "Bearer <MCP_HTTP_TOKEN>",
        "X-Pwpush-Token": "<this-client's-pwpush-token>",
        "X-Pwpush-Email": "<this-client's-email, v1 only>"
      }
    }
  }
}

API v1 / v2

The server speaks both the modern v2 API (pwpush.com, eu.pwpush.com, recent self-hosted) and the legacy v1 API (older self-hosted instances). It auto-detects which one the instance exposes. Note for v1: expiry is day-granular, so sub-day duration values round up to one day, and file/URL pushes are only available if the instance enables them.

Both paths are exercised end-to-end: v1 against a live legacy instance, v2 against pwpush.com (API 2.1). v2 calls target the .json endpoints deliberately — the suffix-less paths issue a cross-host redirect, so they are avoided to keep the payload from leaking to another host.

duration accepts a human label (15m, 30m, 45m, 1h, 6h, 12h, 1d, 2d, 3d, 4d, 5d, 6d, 1w, 2w, 3w, 1mo, 2mo, 3mo) or the raw enum index 017.

Install & run

Published as pwpush-mcp on PyPI and ghcr.io/k9fr4n/pwpush-mcp on GHCR, produced by the release workflow on each version tag (latest: v0.5.0).

With uv (recommended):

uvx pwpush-mcp

Or with pipx:

pipx run pwpush-mcp

From source:

pip install -e ".[dev]"
python -m pwpush_mcp

Transports

stdio is the default (Claude Desktop / Claude Code / Docker MCP Gateway). To expose the server over the network as Streamable HTTP (single /mcp endpoint, MCP spec revision 2025-03-26+ — the legacy HTTP+SSE transport it replaces is deprecated):

# Requires MCP_HTTP_TOKEN; binds 127.0.0.1:8000 by default, endpoint at /mcp.
MCP_HTTP_TOKEN=$(openssl rand -hex 32) pwpush-mcp --listen 8000
# Clients then send:  Authorization: Bearer <MCP_HTTP_TOKEN>  to http://127.0.0.1:8000/mcp

Docker

docker run --rm -i \
  -e PWPUSH_BASE_URL="https://pwpush.com" \
  -e PWPUSH_API_TOKEN="your-token-here" \
  ghcr.io/k9fr4n/pwpush-mcp:latest          # stdio (default)

HTTP mode via compose.yml (override the entrypoint with --listen):

cp .env.example .env && $EDITOR .env
docker compose up        # serves Streamable HTTP on http://localhost:8000/mcp

For v1 (legacy self-hosted) instances also pass -e PWPUSH_API_EMAIL=....

Docker MCP Gateway

The image ships the io.docker.server.metadata label and a catalog entry so the Docker MCP Gateway can spawn it natively. See catalog/readme.md:

docker mcp catalog create pwpush-private
docker mcp catalog add  pwpush-private pwpush-mcp ./catalog/server.yaml
docker mcp server  enable pwpush-mcp
docker mcp gateway run    --catalog pwpush-private

Client configuration

Claude Desktop / Claude Code (mcp config)

{
  "mcpServers": {
    "pwpush": {
      "command": "uvx",
      "args": ["pwpush-mcp"],
      "env": {
        "PWPUSH_API_TOKEN": "your-token-here",
        "PWPUSH_BASE_URL": "https://eu.pwpush.com"
      }
    }
  }
}

Development

pip install -e ".[dev]"
ruff check src tests && ruff format --check src tests
mypy src
pytest -q --cov=pwpush_mcp --cov-fail-under=80

See CONTRIBUTING.md for the tool/env-var checklists and the release process, and CHANGELOG.md / UPGRADING.md for version history.

License

MIT — see LICENSE.

Available Tools

7 tools
create_pushA

Create a Password Pusher secret link and return its sharing URL. The secret payload is NOT echoed back. Share the returned html_url with the recipient. A token is sent if PWPUSH_API_TOKEN is set; some instances also allow anonymous push creation. Pass file_paths to attach one or more local files (a file push). For a text/url/qr push, set payload and kind.

ParametersJSON Schema
NameRequiredDescriptionDefault
kindNoPush type: 'text', 'url', or 'qr'. Ignored when file_paths are given (forced to 'file'). On v1 (legacy) instances 'qr' is created as a text push.text
nameNoOptional name for the push.
noteNoOptional private note, visible only to the creator.
payloadNoThe secret to push (text, a URL, or QR content). Optional when file_paths are given.
durationNoTime before the push expires. Accepts a label (15m, 30m, 45m, 1h, 6h, 12h, 1d, 2d, 3d, 4d, 5d, 6d, 1w, 2w, 3w, 1mo, 2mo, 3mo) or the raw enum index 0..17.7d
file_pathsNoLocal file path(s) to attach as a file push (multipart upload).
passphraseNoOptional passphrase required to view the secret.
retrieval_stepNoRequire an extra click before the secret is revealed.
expire_after_viewsNoNumber of views before expiry (1-100).
deletable_by_viewerNoAllow the recipient to delete the push.

TDQS

A4.7/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond annotations (readOnlyHint=false, destructiveHint=false), the description discloses important behaviors: the secret payload is NOT echoed back, a token is sent if PWPUSH_API_TOKEN is set, some instances allow anonymous push creation, and v1 instances treat 'qr' as text. These details add value beyond the structured annotation fields and help set expectations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is efficiently structured: purpose first, then key behavioral notes, then file vs. text/url/qr usage. Every sentence carries distinct information, and the length is appropriate for the tool's complexity. No redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given 10 parameters and no output schema, the description adequately covers critical context: return URL, non-echo behavior, auth token/anonymous option, file push mechanics, and legacy v1 quirk. It is complete enough for an agent to correctly select and invoke the tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline is 3. The description adds meaning by explaining parameter interactions: file_paths forces a 'file' kind, payload is optional when file_paths are given, and 'qr' behaves differently on v1. This goes beyond individual parameter descriptions and clarifies the overall use.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a clear verb+resource: 'Create a Password Pusher secret link and return its sharing URL.' It explicitly states the tool's primary function and distinguishes it from siblings like expire_push and list_active_pushes by focusing on creation. The purpose is unmistakable.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides clear context on when to use the tool: share the returned html_url with the recipient, use file_paths for file pushes, set payload and kind for text/url/qr pushes. It also notes token/anonymous modes. Lacks an explicit 'use this instead of X' alternative comparison, but the guidance is contextually strong.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

expire_pushA
Destructive

Permanently expire (delete) a push. IRREVERSIBLE. This destroys the payload and any attached files for good. Requires PWPUSH_API_TOKEN (or a push created with deletable_by_viewer).

ParametersJSON Schema
NameRequiredDescriptionDefault
url_tokenYesThe url_token of the push to expire.

TDQS

A4.5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond the destructiveHint annotation, the description adds critical details: 'IRREVERSIBLE' and 'destroys the payload and any attached files for good'. It also mentions the auth requirement, providing meaningful context for a destructive operation.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is brief and impactful, with each sentence providing essential information: the action, irreversibility, and required credentials. It is well-structured with the warning front-loaded.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple destructive tool with one parameter and no output schema, the description covers all necessary aspects: what it does, irreversible consequences, and authentication requirements. No additional information is needed for correct invocation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema already provides 100% coverage for the single parameter url_token with a clear description. The tool description does not add additional meaning about the parameter, so the baseline score of 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the verb 'expire' and resource 'push', and explicitly says 'delete' and 'IRREVERSIBLE'. It distinguishes itself from siblings by being the destructive action, while other tools like create_push and preview_push are non-destructive.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage for permanently deleting a push and notes the required authentication (PWPUSH_API_TOKEN). It does not explicitly name alternatives or state when not to use, but the sibling context makes the purpose clear.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_push_auditA
Read-only

Return the audit log (views, IPs, user agents) for a push. Requires auth.

ParametersJSON Schema
NameRequiredDescriptionDefault
pageNoPage number (50 per page).
url_tokenYesThe url_token of the push.

TDQS

A4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and destructiveHint=false, so the safety profile is known. The description adds valuable context beyond annotations: it specifies that auth is required and discloses the contents of the audit log (views, IPs, user agents). This enriches the agent's understanding of side effects and prerequisites.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single sentence that front-loads the main purpose and immediately adds the auth requirement. Every word earns its place, with no filler or repetition. It is appropriately sized for a simple read tool.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's simplicity (2 params, 1 required, no output schema), the description covers the core return value and the key context. It could mention pagination or the fact that page defaults to 1, but the schema already provides those details. The description is sufficient to understand what the tool does and returns.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, with both 'page' and 'url_token' already having descriptions. The tool description adds no extra parameter-level meaning beyond 'for a push', so the baseline of 3 applies; the schema carries the parameter semantics.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action ('Return') and the resource ('the audit log (views, IPs, user agents) for a push'), which unambiguously distinguishes it from sibling tools like list_active_pushes or expire_push. The specific content of the audit log adds precision.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage by stating 'for a push', but it does not explicitly contrast with alternatives or state when to choose this tool over siblings. There is no exclusion or alternative naming, so it's clear in context but lacks direct guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_versionA
Read-only

Return the target instance's version and enabled feature flags (no auth).

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A4.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and destructiveHint=false. The description adds the behavioral detail that no authentication is required, which is valuable beyond the annotations. It also clarifies the specific return content (version and feature flags).

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single sentence, front-loaded with the action and resource, and includes the key caveat about no authentication. Every word earns its place with no redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a zero-parameter, read-only tool with no output schema, the description sufficiently explains the return value and access requirements. The low complexity means no additional context is needed to invoke this tool correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has zero parameters, so the baseline is 4. The description does not need to explain parameters, and the empty input schema is fully covered. No additional parameter semantics are required.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool returns the target instance's version and enabled feature flags. This is a specific verb-resource pairing that distinguishes it from the sibling push-management tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description mentions 'no auth', implying it is safe for quick checks without credentials, but does not explicitly state when to use it versus alternatives. The context is clear enough for a simple read-only version retrieval, but no exclusions or alternative tool references are given.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_active_pushesA
Read-only

List the authenticated account's active (not yet expired) pushes.

ParametersJSON Schema
NameRequiredDescriptionDefault
pageNoPage number (50 per page).

TDQS

A3.9/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and destructiveHint=false, covering the safety profile. The description adds scope ('authenticated account's') and the active filter, but does not disclose additional behavioral traits such as pagination behavior or return format. This is similar to the get_calls calibration where a 3 was appropriate.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single sentence, immediately front-loaded with the action and resource, with no superfluous words. It is concise while still delivering purpose and scope.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the low complexity (one optional parameter, no output schema, strong annotations), the description is complete. It clearly states what the tool does, the scope, and the filtering criteria, which is sufficient for an agent to select and invoke it correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, with the only parameter 'page' fully described in the schema. The description adds no additional parameter semantics, so the baseline of 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb 'List' with a clear resource 'pushes' and scope 'authenticated account's active (not yet expired)'. It directly contrasts with the sibling tool 'list_expired_pushes' by emphasizing 'not yet expired', fully distinguishing itself.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies when to use the tool (for active pushes) and hints at the alternative via 'not yet expired', but it does not explicitly state exclusions or name alternative tools. Usage context is implied rather than directly stated.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_expired_pushesA
Read-only

List the authenticated account's expired pushes.

ParametersJSON Schema
NameRequiredDescriptionDefault
pageNoPage number (50 per page).

TDQS

A4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and destructiveHint=false, covering the safety profile. The description adds a useful scope ('authenticated account's') but does not disclose other behaviors like pagination details or return format. Given the annotations, the incremental value is moderate, aligning with a baseline acceptable disclosure.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, concise sentence that states exactly what the tool does without any redundancy or filler. It is efficiently front-loaded and earns every word.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple read-only list tool with one optional parameter, the description plus annotations and schema provide sufficient information. The absence of an output schema leaves a minor ambiguity about return format, but the verb 'List' implies an array of pushes, so the overall completeness is strong.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% for the single 'page' parameter, including a description 'Page number (50 per page)'. The tool description adds no additional semantic information about the parameter, so the schema carries the full burden—baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb 'List' with a clear resource 'expired pushes' and scope 'authenticated account's', making its purpose unmistakable and differentiating it from siblings like 'list_active_pushes' and 'get_push_audit'.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives a clear context: use this tool when needing expired pushes of the authenticated account. However, it does not explicitly mention alternatives or exclusions, but the context is sufficiently clear that an agent can infer the appropriate use.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

preview_pushA
Read-only

Return the shareable secret URL for a push WITHOUT consuming a view.

ParametersJSON Schema
NameRequiredDescriptionDefault
url_tokenYesThe url_token of an existing push.

TDQS

A4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and destructiveHint=false, so the safety profile is covered. The description adds meaningful behavioral context beyond annotations by specifying 'WITHOUT consuming a view', which is a non-obvious behavior not present in the structured fields. However, it doesn't disclose potential rate limits or authorization nuances, which prevents a higher score.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, tightly written sentence that front-loads the action ('Return') and result ('shareable secret URL') while adding a crucial caveat. Every word adds value, with no redundancy or fluff.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool is simple with one parameter and strong annotations. The description effectively communicates the core function and the distinctive 'without consuming a view' behavior. Although there is no output schema, the description hints at the return content (a URL), which is adequate for this tool's complexity.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100% for the single parameter (url_token), so the schema fully documents the parameter. The description adds no extra meaning about the parameter beyond saying 'a push', which is already implied by the schema. Baseline 3 is appropriate since the schema carries the burden.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool returns a shareable secret URL for a push, using a specific verb ('Return') and resource ('push'). It also distinguishes itself from sibling tools like list_active_pushes or expire_push by adding the phrase 'WITHOUT consuming a view', which is a unique preview capability.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage context—previewing a push without consuming a view—but does not explicitly mention when to use this tool over alternatives or exclude other scenarios. It lacks explicit 'when/when-not' guidance that would make it clearer, though some context is provided by the preview intent.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.

  1. 7 tool updatesv0.5.0
    • First observedcreate_push
    • First observedexpire_push
    • First observedget_push_audit
    • First observedget_version
    • First observedlist_active_pushes
    • First observedlist_expired_pushes
    • First observedpreview_push

TDQS

A4.3/5.0
Disambiguation5/5

Each tool targets a distinct resource or action: auditing a push, listing pushes by expiration status, checking server version, creating, previewing, or expiring a push. The overlap between list_active_pushes and list_expired_pushes is resolved by the explicit status distinction.

Naming Consistency5/5

All tool names follow a consistent verb_noun pattern using snake_case: get_push_audit, list_active_pushes, create_push, preview_push, expire_push. The verbs are specific and the pattern is uniform across the set.

Tool Count5/5

With 7 tools, the server is well-scoped for a secret-sharing service. Each tool covers a meaningful operation without redundancy or bloat.

Completeness4/5

The toolset covers the core lifecycle: create, preview (retrieve URL), expire (delete), audit, and list. A minor gap is the lack of a 'get_push' for retrieving full push metadata, but preview and audit provide sufficient insight for most workflows.

Maintenance

ActivityStale
ResponsivenessSyncing

Resources

Unclaimed servers have limited discoverability.

Looking for Admin?

If you are the server author, to access and configure the admin panel.

Related MCP Connectors

Related MCP Servers

  • A
    license
    A
    quality
    C
    maintenance
    A tiny MCP server that sends push notifications through Pushover, supporting message, title, priority, sound, URL, and device parameters.
    1
    1
    MIT
  • A
    license
    Not graded
    quality
    C
    maintenance
    MCP server for the Nextcloud Passwords app, enabling reading and managing password entries (list, search, create, update, delete) with strong security guarantees.
    MIT
  • A
    license
    Not graded
    quality
    C
    maintenance
    An MCP server that scans code for exposed secrets (API keys, tokens, private keys, high-entropy strings) with placeholder-aware allowlisting and fully redacted reports, enabling agents to detect leaks before committing.
    1
    MIT
  • F
    license
    Not graded
    quality
    B
    maintenance
    MCP server for end-to-end encrypted secret storage and retrieval, enabling LLM agents to fetch secrets by name via one-time URLs while keeping plaintext out of model context and logs.
    1
    -

Latest Blog Posts

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/k9fr4n/pwpush-mcp'

If you have feedback or need assistance with the MCP directory API, please join our Discord server