PingOne Advanced Identity Cloud MCP Server
OfficialThe PingOne Advanced Identity Cloud MCP Server enables AI assistants to manage and interact with PingOne AIC environments through natural language, without needing the admin console or API scripts. It supports tools like Claude, Cursor, VS Code with GitHub Copilot, Gemini CLI, and Codex.
Managed Objects (Users, Roles, Groups, Organizations, Custom Types)
List available managed object types and retrieve schema definitions
Query objects using CREST filter syntax with pagination and sorting
Full CRUD: get, create, patch, and delete managed objects by ID
Themes (Login & Account Page Customization)
Get theme schema, list, get, create, update, and delete themes
Set the default theme for a realm (alpha or bravo)
Logging & Monitoring
Discover available log sources
Query logs with flexible filtering by time range, source, transaction ID, and payload content
Environment Secrets and Variables (ESVs)
Query, retrieve (with decoded values), create, update, and delete environment variables and secrets
AM Authentication Journeys (local deployment only, not available in Docker)
List, get (with full node schemas/configs), save, delete, and set default journeys
Generate preview URLs to test journeys in a browser
Discover available node types and their schemas, outcomes, and templates
Update individual nodes, batch delete orphaned nodes
Manage Scripted Decision Node scripts: list, get (with base64 decoding), create, update, and delete
Get scripted decision node bindings (available variables and allowed imports)
Security & Compliance
OAuth 2.0 PKCE flow with OS keychain token storage (local) or Device Code Flow with ephemeral storage (Docker)
User-based authentication for full audit trails, input validation, and tenant isolation
Click on "Install Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@PingOne Advanced Identity Cloud MCP Servershow me all failed login attempts from the last hour"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
PingOne Advanced Identity Cloud MCP Server
Features • Use Cases • Prerequisites • Getting Started • Authentication • Available Tools • Agent Skills • Docker Deployment • Security • Monitoring & Audit • Troubleshooting • Development • License
Security Notice
Depending on the requests made to the MCP server, tenant configuration or data may be returned. Do not use the MCP server with untrusted MCP clients, agent code or LLM inference.
Review Generated Configuration
Configuration can be generated dynamically using LLM and user feedback represented dynamically back to agents/conversations. Be sure to review generated configuration before promoting to production environments, or those serving live identity/access requests.
An MCP (Model Context Protocol) server that enables AI assistants to interact with PingOne Advanced Identity Cloud environments. Manage users, roles, groups, organizations, customize authentication themes, analyze logs, and query identity data directly from your AI conversations.
Ask questions like "Find all alpha_users with email starting with john@example.com", "Create a new theme called 'Corporate Brand' with primary color #0066cc", or "Show me all ERROR level logs from the am-authentication source in the last hour".
Features
Administer your AIC environment using natural language - Interact with PingOne AIC from whichever AI tool you use daily. No need to switch to the admin console or write API scripts - just ask your AI assistant.
Secure authentication - Supports OAuth 2.0 PKCE flow for local deployment and Device Code Flow for containerized deployment. All actions are user-based and auditable. Tokens stored securely in OS keychain (local) or ephemerally (Docker).
Broad tool support - Supports full CRUD operations against any managed object type in your environment (users, roles, groups, organizations, and custom types), authentication journey and script management, theme customization, advanced log querying, and environment variable configuration.
Related MCP server: DaVinci MCP Server
Use Cases
Journey Management - "Show me the Login journey", "Create a new MFA journey", "Add a scripted decision node to the registration flow", "Set Login as the default journey"
Authentication Customization - "Create a branded theme with our corporate colors", "Show me all themes in production", "Set the new theme as default"
Audit & Monitoring - "Show me failed login attempts in the last hour", "Find all logs for transaction abc-123", "What log sources are available?"
Identity Operations - "Find all users with admin in their username", "Create a new developer role", "Update the email for user xyz123"
Configuration Management - "List all environment variables", "Create a new API key variable", "Update the database connection string"
Getting Started
Prerequisites
Node.js 18+
PingOne Advanced Identity Cloud Sandbox or Development Tenant
MCP-compatible client (Claude Code, Claude Desktop, Cursor, VS Code with GitHub Copilot, Gemini CLI, Codex, etc.)
Configure Your MCP Client
The MCP server requires the AIC_BASE_URL environment variable to be set to your PingOne AIC hostname.
Add this to your MCP client configuration:
{
"mcpServers": {
"aic-mcp-server": {
"type": "stdio",
"command": "npx",
"args": ["-y", "@ping-identity/aic-mcp-server"],
"env": {
"AIC_BASE_URL": "your-tenant.forgeblocks.com"
}
}
}
}Required: Replace your-tenant.forgeblocks.com with your PingOne AIC tenant URL.
Client-specific instructions:
Add this to your Claude MCP configuration (claude.json for Claude Code or claude_desktop_config.json for Claude Desktop):
{
"mcpServers": {
"aic-mcp-server": {
"command": "npx",
"args": ["-y", "@ping-identity/aic-mcp-server"],
"env": {
"AIC_BASE_URL": "your-tenant.forgeblocks.com"
}
}
}
}Add this to your Cursor MCP configuration (.cursor/mcp.json):
{
"mcpServers": {
"aic-mcp-server": {
"command": "npx",
"args": ["-y", "@ping-identity/aic-mcp-server"],
"env": {
"AIC_BASE_URL": "your-tenant.forgeblocks.com"
}
}
}
}
Add this to your Copilot MCP configuration (mcp.json):
{
"mcpServers": {
"aic-mcp-server": {
"command": "npx",
"args": ["-y", "@ping-identity/aic-mcp-server"],
"env": {
"AIC_BASE_URL": "your-tenant.forgeblocks.com"
}
}
}
}Add this to your Gemini CLI MCP configuration (settings.json):
{
"mcpServers": {
"aic-mcp-server": {
"command": "npx",
"args": ["-y", "@ping-identity/aic-mcp-server"],
"env": {
"AIC_BASE_URL": "your-tenant.forgeblocks.com"
}
}
}
}Add this to your Codex MCP configuration (~/.codex/config.toml):
[mcp_servers.aic-mcp-server]
command = "npx"
args = ["-y", "@ping-identity/aic-mcp-server"]
env = {"AIC_BASE_URL" = "your-tenant.forgeblocks.com"}Restart your MCP client and start asking questions! Your browser will open for authentication when you use the first tool in a session.
Authentication
The server uses OAuth 2.0 PKCE flow for secure user authentication:
First Tool Use - Browser opens automatically for user login at PingOne AIC when you use a tool for the first time in a session
Token Storage - Access tokens stored securely in OS keychain (macOS Keychain, Windows Credential Manager, Linux Secret Service)
Automatic Reuse - Cached tokens used for subsequent tool calls within the same session
Auto Re-authentication - When tokens expire during a session, browser opens again for new login
Docker Deployment: Uses OAuth 2.0 Device Code Flow with ephemeral token storage (tokens deleted on container restart).
Security Features:
User-based actions provide complete audit trail
All actions traceable to authenticated users for compliance
Administrator Access Required: This server requires administrative authentication and provides administrative capabilities to your PingOne AIC development and sandbox environments. All operations are performed as the authenticated administrator and are fully auditable.
Development and Sandbox Environments Only: This server can only be used with development and sandbox environments. Use with trusted AI assistants in secure contexts. AI-driven operations can make mistakes - review and test changes carefully before promoting to higher environments.
Available Tools
The server provides tools for AI agents to interact with your PingOne AIC environment:
Managed Objects
Generic CRUD operations for any managed object type in your environment, plus administrative tools for managing object type definitions and relationship properties.
Tool | Description | Usage Examples |
| Discover all managed object types in your environment | - |
| Get schema definition for an object type | - |
| Query objects with filters, pagination, sorting | - |
| Retrieve an object's complete profile | - |
| Create a new managed object | - |
| Update object fields | - |
| Delete an object | - |
| Create a new managed object type definition | - |
| Modify an existing managed object type definition using ForgeRock PATCH operations | - |
| Delete a managed object type definition from the managed config | - |
| Add, update, or remove a custom relationship property (must use | - |
Themes
Customize login and account page appearance.
Tool | Description | Usage Examples |
| Get complete theme schema documentation | - |
| List all themes in a realm | - |
| Get a theme's complete configuration | - |
| Create a new theme | - |
| Update theme properties | - |
| Delete a theme | - |
| Set a theme as the realm default | - |
Logging
Query and analyze authentication and activity logs.
Tool | Description | Usage Examples |
| List available log sources | - |
| Query logs with time range, source, and content filters | - |
ESVs (Environment Secrets and Variables)
Manage environment secrets and variables.
Tool | Description | Usage Examples |
| Query variables or secrets by ID pattern | - |
| Retrieve a variable with decoded value | - |
| Create or update a variable | - |
| Delete a variable | - |
Feature Management
Inspect and enable optional features in PingOne AIC. A single listFeatures tool returns a unified view of all IDM and AIC platform features with install status. Install operations are one-way and cannot be undone from these tools.
Tool | Description | Usage Examples |
| List all features (IDM + AIC platform) and their install status | - |
| Check whether an IDM feature can be installed without making any changes | - |
| Install an IDM feature (one-way — cannot be undone). Run | - |
| Enable AI Agents (one-way — cannot be undone). Re-running is safe | - |
Applications (Not available when using Docker)
**📍 Not available when using MCP from a Docker container **: Application tools are automatically excluded in Docker deployments because they require browser-based PKCE authentication which is incompatible with the Device Code Flow used in containers.
Manage OIDC applications in a realm.
Tool | Description | Usage Examples |
| Get the OIDC app schema (compact summary by default, full detail with section filtering available) | - |
| List OIDC applications in a realm with summary fields | - |
| Retrieve a complete OIDC application configuration | - |
| Create a new OIDC application | - |
| Update an OIDC application (partial updates — send only changed fields) | - |
| Delete an OIDC application | - |
AM Journeys (Not available when using Docker)
**📍 Not available when using MCP from a Docker container **: AM Journey tools are automatically excluded in Docker deployments because they require browser-based PKCE authentication which is incompatible with the Device Code Flow used in containers.
Manage authentication journeys, node types, and scripts.
Tool | Description | Usage Examples |
| List all authentication journeys in a realm | - |
| Get journey with node schemas and configs automatically included | - |
| Create or replace an authentication journey atomically (upsert) | - |
| Update an existing journey's metadata and/or replace its node graph | - |
| Delete a journey and its associated nodes | - |
| Set the default authentication journey for a realm | - |
| Generate a preview URL to test a journey in a browser | - |
| Discover all available authentication node types | - |
| Get schema, template, and outcomes for node types | - |
| Calculate outcomes for a node based on its configuration | - |
| Update a single node's configuration | - |
| Batch delete orphaned node instances | - |
| List Scripted Decision Node scripts in a realm | - |
| Get AM script with automatic base64 decoding | - |
| Create a new Scripted Decision Node script | - |
| Update an existing script's name, description, or content | - |
| Delete an AM script | - |
| Get available bindings and allowed imports for scripting | - |
Key Feature: The getJourney tool automatically fetches and includes all node schemas and configurations in parallel, so you get complete journey details in a single call - no need to manually fetch node information.
Agent Skills
This repository ships agent skills that extend your AI assistant's ability to work with the AIC MCP server. Once installed, your agent can take on operational tasks — like auditing MCP usage in your environment — without needing explicit instructions.
Skill | What it does | Try it |
Audits MCP server activity in AIC logs — authentication events, user-attributed actions, and API traffic | "Show me what's been done via the MCP server today" |
Install the Skills
Option 1 — Skills CLI (works with any supported agent):
npx skills add pingidentity/aic-mcp-serverOption 2 — Manual installation:
Clone the repository and copy the skills from .claude/skills/ to your agent's skills directory. See your agent's documentation for the correct location:
Once installed, verify by asking your agent "What skills do you have?" — you should see monitor-usage in the list.
Docker Deployment
⚠️ EXPERIMENTAL: Docker deployment uses OAuth 2.0 Device Code Flow with MCP form elicitation. This requires MCP client support for form elicitation, which is currently limited. If your client doesn't support it, use the local deployment method above.
Build Image
npm run docker:buildConfigure Your MCP Client
Claude Code or Claude Desktop
Add this to your Claude MCP configuration (claude.json for Claude Code or claude_desktop_config.json for Claude Desktop):
{
"mcpServers": {
"aic-mcp-server": {
"command": "docker",
"args": [
"run",
"--rm",
"-i",
"-e",
"AIC_BASE_URL=your-tenant.forgeblocks.com",
"pingidentity/aic-mcp-server:latest"
]
}
}
}Authentication: When authentication is required, your MCP client should display a URL. Click it to authenticate in your browser, then accept the prompt in your client.
Token Storage: Tokens are stored ephemerally in the container filesystem (/app/tokens/token.json) and deleted on container restart for enhanced security.
Security
The PingOne AIC MCP Server implements multiple security layers:
Secure credential storage - Tokens stored in OS keychain (macOS Keychain, Windows Credential Manager, Linux Secret Service) for local deployment, or ephemerally in container filesystem for Docker
No plain text secrets - No sensitive information stored in configuration files
OAuth 2.0 authentication - PKCE flow for local deployment prevents authorization code interception; Device Code flow for containerized deployment
User-based authentication - All API calls are authenticated as the user who logged in, providing complete audit trails
Input validation - Built-in protections against path traversal and query injection attacks
Tenant isolation - Tokens are validated against the configured
AIC_BASE_URLto prevent accidental cross-tenant operations
Monitoring & Audit
All operations performed through the MCP server are executed as the authenticated user — there are no anonymous or service-account-attributed actions. Every tool invocation produces a full audit trail in the AIC audit logs, attributable to the individual who authenticated the session.
Authentication events
The server authenticates using two registered OAuth 2.0 clients:
AICMCPClient— used for the initial user login (PKCE or Device Code flow)AICMCPExchangeClient— used to obtain scoped tokens for each tool call via RFC 8693 token exchange
Filtering the am-authentication log source for either of these client IDs will surface all MCP authentication activity. Each token exchange references the original user login, providing a complete chain from the tool call back to the authenticated identity.
Attributing actions to a user
All API calls made by the server carry the scoped token issued to the authenticated user. Configuration changes (journeys, scripts, OIDC apps) appear in AM audit logs and identity operations (managed objects, groups, relationships) appear in IDM audit logs — all attributed to the user identity, not a service account.
Identifying MCP traffic
All requests from the server include a User-Agent header of the form aic-mcp-server/<version>. This can be used to filter access logs and isolate MCP-originated traffic from browser sessions, automated reconciliation jobs, and other API clients.
"FATAL: AIC_BASE_URL environment variable is not set"
Set the AIC_BASE_URL environment variable in your MCP client configuration to your PingOne AIC tenant URL (e.g., your-tenant.forgeblocks.com or https://your-tenant.forgeblocks.com).
"Port 3000 is already in use"
Another service is using port 3000 (required for OAuth redirect). Stop that service and try again.
"Browser doesn't open during authentication"
Check that the open package has permissions to launch your browser, or manually navigate to the URL shown in the error message.
Docker: "URL not displayed during authentication"
Your MCP client may not support form elicitation yet. Use the local deployment method instead.
Development
To build the server from source for development:
# Clone the repository
git clone https://github.com/pingidentity/aic-mcp-server.git
cd aic-mcp-server
# Install dependencies
npm install
# Compile TypeScript
npm run buildThen configure your MCP client to use the local build:
{
"mcpServers": {
"aic-mcp-server": {
"command": "node",
"args": ["/absolute/path/to/aic-mcp-server/dist/index.js"],
"env": {
"AIC_BASE_URL": "your-tenant.forgeblocks.com"
}
}
}
}For type checking without building:
npm run typecheckThe project includes a comprehensive test suite covering all tools and authentication flows.
# Run all tests
npm test
# Watch mode for development
npm run test:watch
# Generate coverage report
npm run test:coverage
# Update tool schema snapshots
npm run test:snapshots:updateUse the MCP Inspector to visually test tools in a web interface:
# Development mode (no build required - faster iteration)
AIC_BASE_URL=your-tenant.forgeblocks.com npm run dev:inspect
# Production mode (requires build first)
npm run build
AIC_BASE_URL=your-tenant.forgeblocks.com npm run inspectHosts a web interface for interactive tool testing and OAuth flow debugging.
Contributing
Contributions are welcome! Please feel free to submit a Pull Request.
Feedback & Issues
We welcome your feedback! Please use this repository's issue tracker to submit feedback, bug reports, or enhancement requests. For existing issues, you can add a 👍 reaction to help our team gauge priority.
License
This project is licensed under the Apache License 2.0 - see the LICENSE file for details.
Available Tools
57 toolscreateCorsPolicyCreate CORS PolicyA
Create a new CORS policy on the global AM CorsService. All seven policy fields are required. A user-facing policyId may optionally be supplied; if omitted, AM assigns one. The policy ID is returned in the success response.
| Name | Required | Description | Default |
|---|---|---|---|
| policyId | No | Optional user-facing identifier for the CORS policy. If omitted, AM assigns one. | |
| acceptedOrigins | Yes | Allowed origins (e.g. ["https://example.org"]) | |
| acceptedMethods | Yes | HTTP methods allowed during preflight | |
| acceptedHeaders | Yes | Non-simple request headers allowed during preflight | |
| exposedHeaders | Yes | Response headers exposed to the browser | |
| maxAge | Yes | Preflight cache duration in seconds | |
| allowCredentials | Yes | Whether to send Access-Control-Allow-Credentials: true on responses | |
| enabled | Yes | Whether the policy is enabled; if false, no CORS headers are added |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Disclosure that all seven fields are required and policyId optional adds value beyond annotations. Returns policy ID. Does not contradict annotations; provides useful behavioral context.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three concise sentences, front-loaded with purpose, no redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Covers creation process, required fields, optional policyId, and return value. Could mention global scope more explicitly, but adequate for an agent.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% but description summarizes required fields, optional policyId, and return value, adding context beyond schema descriptions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Clear verb 'Create' and specific resource 'CORS policy on the global AM CorsService' distinguish it from sibling create tools like createJourney or createManagedObject.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Describes creation context but lacks explicit guidance on when to use this tool vs alternatives like updateCorsPolicy or deleteCorsPolicy. No conditions or exclusions mentioned.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
createJourneyCreate JourneyAIdempotent
Create or replace an authentication journey (upsert operation — if a journey with the same name already exists, it is overwritten). Node IDs can be human-readable (e.g., "login-page") and will be automatically transformed to UUIDs. Use "success" or "failure" as connection targets for terminal nodes. Returns the mapping of original IDs to generated UUIDs.
| Name | Required | Description | Default |
|---|---|---|---|
| realm | Yes | The realm to create the journey in | |
| journeyName | Yes | The name of the journey | |
| description | No | Admin-facing description of the journey | |
| identityResource | No | The identity resource that the journey authenticates against. Expected format: "managed/<realm>_<objectType>" (e.g., "managed/alpha_user", "managed/bravo_role"). | |
| journeyData | Yes | The journey structure |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Beyond the annotations (idempotentHint, destructiveHint, openWorldHint), the description reveals key behaviors: node IDs are auto-converted to UUIDs, terminal nodes use 'success'/'failure' as connection targets, and the tool returns a mapping of original IDs to UUIDs. This adds significant context not covered by annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences, both dense with information. It front-loads the upsert nature and then provides two critical behavioral details (ID transformation, terminal nodes). No redundant or unnecessary words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the complexity (nested objects, 5 parameters, no output schema), the description covers core behavior, transformation, and return value. However, it does not mention prerequisites (e.g., realm existence) or potential validation issues. The schema handles structure, but a bit more context on error scenarios would improve completeness.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Even though the input schema has 100% coverage, the description adds critical meaning: node IDs can be human-readable and will be transformed to UUIDs, identityResource format is reinforced, and the journeyData structure with entryNodeId and nodes is clarified. The terminal node convention ('success'/'failure') is also explained, which is not fully captured in the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states 'Create or replace an authentication journey' with the specific resource type (journey) and action (create/replace). It distinguishes from sibling tools like createCorsPolicy or createOidcApp by focusing on journeys and mentioning the upsert nature.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explains the upsert behavior ('if a journey with the same name already exists, it is overwritten'), which implicitly guides when to use this tool (create or full replace). However, it does not explicitly compare with updateJourney or mention when not to use it (e.g., for partial updates).
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
createManagedObjectCreate Managed ObjectB
Create a new managed object in PingOne AIC
| Name | Required | Description | Default |
|---|---|---|---|
| objectType | Yes | Managed object type (e.g., alpha_user, bravo_user, alpha_role, bravo_role, alpha_group, bravo_group, alpha_organization, bravo_organization). Use listManagedObjects to discover all available types. | |
| objectData | Yes | JSON object containing object properties (must include all required fields from the schema) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations provide destructiveHint=false and openWorldHint=true. Description adds no extra behavioral context like permissions, idempotency, or error handling.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Single sentence with no fluff. Efficient and to the point.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
No output schema, so description should mention return value (e.g., created object ID). Also lacks error conditions. Incomplete for a create tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% with good parameter descriptions. Description does not add extra meaning beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Verb 'create' and resource 'managed object' are clear. Distinguishes from siblings like createManagedObjectDefinition and listManagedObjects.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Minimal guidance: only refers to listManagedObjects for discovering types. No explicit when-to-use vs alternatives or exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
createManagedObjectDefinitionCreate Managed Object DefinitionA
Create a new managed object type definition in PingOne AIC by appending to the managed config. IMPORTANT: Call getManagedObjectSchema with includeFullDefinition=true on an existing object first to understand the expected definition structure.
| Name | Required | Description | Default |
|---|---|---|---|
| objectName | Yes | Name for the new managed object type (e.g., "alpha_device", "custom_application"). Must contain only a-z, A-Z, 0-9, and underscore characters. | |
| objectDefinition | Yes | The object definition containing at minimum a schema with properties. Call getManagedObjectSchema with includeFullDefinition=true on an existing object to see the expected structure. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare destructiveHint=false and openWorldHint=true. The description adds 'by appending to the managed config' which explains the mutation mechanism. No contradictions, but additional details like permissions or side effects are missing.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences, front-loading the purpose and following with a key usage hint. Every sentence is meaningful and concise.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (creating a managed object definition with nested schema), the description adequately covers purpose and links to getManagedObjectSchema for structural details. It lacks output schema info but that's acceptable as output schema is absent.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already explains both parameters. The description does not add extra meaning beyond confirming the role of objectDefinition, thus meeting the baseline.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb 'Create' and the resource 'managed object type definition in PingOne AIC', distinguishing it from siblings like deleteManagedObjectDefinition or patchManagedObjectDefinition.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description includes an IMPORTANT note that advises calling getManagedObjectSchema first to understand the expected structure, providing explicit contextual guidance. However, it does not explicitly mention alternatives or when not to use this tool.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
createOidcAppCreate OIDC AppA
Creates an OIDC application. Only supply the oauth2Client fields you want to set; defaults are applied for the rest.
| Name | Required | Description | Default |
|---|---|---|---|
| realm | Yes | The realm | |
| name | Yes | The application display name | |
| clientId | Yes | The OAuth2 client ID used in protocol flows | |
| owners | Yes | Application owners. Example: [{"_ref": "managed/alpha_user/USER_ID"}] | |
| oauth2Client | No | OIDC client configuration. Each property uses the wrapper format {"inherited": false, "value": <val>}, nested under config sections. Example: {"coreOAuth2ClientConfig": {"redirectionUris": {"inherited": false, "value": ["https://example.com/callback"]}}} |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description discloses creation and default application behavior beyond annotations. However, it provides minimal additional behavioral context such as idempotency or side effects beyond what is implied by 'create' and openWorldHint annotation.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two concise sentences, front-loaded with the main action, and no unnecessary words. Every sentence serves a purpose.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description is adequate for a simple creation tool but lacks details on return values, error scenarios, or prerequisites. Given the complex nested parameter (oauth2Client) and many sibling tools, more context would be beneficial.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The description adds value for the oauth2Client parameter by explaining partial supply and defaults. For other parameters, the schema already provides full descriptions (100% coverage), so the description supplements rather than compensates.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states 'Creates an OIDC application' with a specific verb and resource. It does not explicitly differentiate from siblings like createCorsPolicy, but the name and context make the purpose clear.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description hints at usage by suggesting to supply only desired fields for oauth2Client, but lacks explicit when-to-use or when-not-to-use guidance relative to alternatives like updateOidcApp.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
createScriptCreate AM ScriptA
Create a new Scripted Decision Node script for use in authentication journeys. Use getScriptedDecisionNodeBindings to see available variables and allowed imports before writing the script.
| Name | Required | Description | Default |
|---|---|---|---|
| realm | Yes | The realm to create the script in | |
| name | Yes | The name of the script | |
| description | No | Optional description of the script | |
| script | Yes | The JavaScript source code for the script |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already provide destructiveHint=false and openWorldHint=true. The description adds context about the script's purpose but does not elaborate on side effects, quotas, or overwrite behavior, which would be beneficial given the openWorldHint.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise with two sentences: one stating the purpose and one providing a usage tip. No unnecessary information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a creation tool with no output schema, the description covers the purpose and a key prerequisite. It could mention what the response looks like, but is otherwise sufficient.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema describes all four parameters with 100% coverage. The description adds no new semantics beyond the schema, so a baseline score of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool creates a new Scripted Decision Node script for authentication journeys, distinguishing it from other create tools like createCorsPolicy or createJourney.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly advises using getScriptedDecisionNodeBindings before writing the script, providing clear context. However, it does not specify when not to use this tool or mention alternatives like updateScript.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
createThemeCreate ThemeA
Create a new theme for a realm in PingOne AIC. IMPORTANT: Call getThemeSchema first to understand all available fields, their types, enum values, and requirements before creating a theme.
| Name | Required | Description | Default |
|---|---|---|---|
| realm | Yes | Realm name | |
| themeData | Yes | Theme configuration object (must include a "name" property) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare destructiveHint=false and openWorldHint=true. The description adds behavioral context by requiring a preliminary schema call, which is beyond what annotations provide. No contradictions.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two concise sentences, no wasted words. The first sentence states purpose, the second gives imperative guidance. Well front-loaded and structured.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the simple two-parameter schema and sibling tools like getTheme and getThemes, the description adequately covers the creation workflow. No output schema, but the creation result is implicitly retrievable via getTheme.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Input schema has 100% coverage with clear descriptions, including enum for realm and note that themeData must include a 'name' property. The description reinforces the name requirement but does not add new details beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states 'Create a new theme for a realm in PingOne AIC', using a specific verb and resource. It also names the prerequisite call to getThemeSchema, distinguishing it from sibling tools like updateTheme, getTheme, etc.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly guides the agent to call getThemeSchema first to understand fields, which is a key prerequisite. It does not explicitly state when not to use, but the context is sufficiently clear for selection.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
deleteCorsPolicyDelete CORS PolicyADestructive
Delete a CORS policy by its ID from the global AM CorsService. Warning: this is a permanent deletion and cannot be undone.
| Name | Required | Description | Default |
|---|---|---|---|
| policyId | Yes | The unique identifier of the CORS policy to delete |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already mark destructiveHint=true. Description adds 'Warning: this is a permanent deletion and cannot be undone', providing extra behavioral context beyond the annotation.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two succinct sentences, front-loaded with purpose, then a necessary warning. No superfluous content.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple delete tool with one parameter and no output schema, the description covers purpose and the irreversible nature. Annotations fully cover the safety profile, making this complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% for the single parameter policyId. Description does not add further meaning beyond what schema already provides, so baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Clearly states the verb 'Delete', the resource 'CORS policy', and the identifier 'by its ID' from the global AM CorsService. Distinct from siblings like deleteJourney or deleteManagedObject.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No explicit guidance on when to use this tool vs alternatives (e.g., updateCorsPolicy). Only a warning about permanence, but no context on when to choose deletion.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
deleteJourneyDelete JourneyADestructive
Delete an authentication journey from a realm. AM automatically cleans up all node instances within the journey, including PageNode child nodes.
| Name | Required | Description | Default |
|---|---|---|---|
| realm | Yes | The realm containing the journey | |
| journeyName | Yes | The name of the journey to delete |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already mark it as destructive and open-world. The description adds valuable context that this tool cascades deletion to all node instances, including PageNode child nodes, beyond just the journey itself. This enhances transparency.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences long, directly stating the purpose and key behavior. No superfluous text, and it is well-structured.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's simplicity (2 required params, no output schema), the description adequately explains the core functionality and cascading behavior. It could potentially mention return type or common errors, but overall it is sufficiently complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Input schema coverage is 100% with descriptions for both parameters. The description does not add additional parameter-level details beyond what the schema already provides, maintaining baseline sufficiency.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action (delete) and the resource (authentication journey). It distinguishes itself from the sibling tool deleteJourneyNodes by noting that AM automatically cleans up all node instances, indicating a higher-level operation.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies that this tool handles node cleanup automatically, so users should not need to use deleteJourneyNodes separately. However, it does not explicitly state when to use this tool versus alternatives, nor does it provide exclusions or conditions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
deleteJourneyNodesDelete Journey Nodes (Batch)ADestructive
Batch delete orphaned node instances. Use this to clean up nodes that were removed from a journey during an update (via updateJourney) but still exist in AM. Note: Deleting an entire journey automatically cleans up its nodes, so this tool is only needed after journey updates that remove nodes.
| Name | Required | Description | Default |
|---|---|---|---|
| realm | Yes | The realm containing the nodes | |
| nodes | Yes | Array of nodes to delete |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already indicate destructive and open-world behavior. Description adds that it is a batch operation for orphaned nodes and that full journey deletion automates cleanup, providing extra context beyond annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two concise sentences. First sentence states the core purpose, second provides critical usage context. No wasted words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Completely describes the tool's purpose, when to use it, and important caveats (full journey deletion handles cleanup). No output schema needed, parameters are well-covered.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so baseline is 3. Description adds meaning by specifying 'orphaned' nodes, which is not in the schema, clarifying the intended use case beyond the raw parameter descriptions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description clearly states the verb (delete) and the specific resource (orphaned node instances). It distinguishes this tool from deleteJourney by noting that full journey deletion handles node cleanup automatically.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly states when to use: after journey updates that remove nodes. Also implies when not to use: not needed if deleting the entire journey. No explicit alternatives mentioned, but context is sufficient.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
deleteManagedObjectDelete Managed ObjectADestructive
Delete a managed object by ID from PingOne AIC
| Name | Required | Description | Default |
|---|---|---|---|
| objectType | Yes | Managed object type (e.g., alpha_user, bravo_user, alpha_role, bravo_role, alpha_group, bravo_group, alpha_organization, bravo_organization). Use listManagedObjects to discover all available types. | |
| objectId | Yes | The object's unique identifier (_id) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare destructiveHint=true, so the description's 'Delete' is consistent but adds no new behavioral context. It does not disclose side effects, irreversibility, or permissions. With annotations present, the lack of additional transparency is acceptable but not exemplary.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single, front-loaded sentence that is clear and to the point. No wasted words; every part earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's simplicity (delete with two required IDs, no output schema), the description is minimally adequate. It does not explain the permanent nature of deletion or any caveats, but the annotations and schema cover the essentials. A score of 3 reflects the bare minimum for a basic operation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Input schema has 100% description coverage for both parameters, so the schema already explains them sufficiently. The description does not add extra meaning beyond what the schema provides. Baseline score of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action (delete), the resource (managed object), and the context (by ID from PingOne AIC). It effectively distinguishes from sibling delete tools like deleteJourney or deleteManagedObjectDefinition.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool or when to consider alternatives. It does not mention prerequisites, such as needing the object ID, which is implied but not explicit. No comparative context with similar delete tools.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
deleteManagedObjectDefinitionDelete Managed Object DefinitionADestructive
Delete a managed object type definition from PingOne AIC. Removes the object type from the managed config. IMPORTANT: This will fail if other object types have relationship properties referencing this object type.
| Name | Required | Description | Default |
|---|---|---|---|
| objectName | Yes | Name of the managed object type to delete (e.g., "alpha_device", "custom_application"). Must contain only a-z, A-Z, 0-9, and underscore characters. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already indicate destructiveHint:true and openWorldHint:true. The description adds beyond this by warning about failure due to dependencies, which is valuable behavioral context. No contradictions with annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is extremely concise with two sentences: one for purpose, one for a key warning. No unnecessary words, front-loaded with primary action.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given only one parameter and no output schema, the description covers the core action and a crucial constraint. It could mention irreversibility (though implicit from destructiveHint), but overall it is sufficiently complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% with a clear pattern and description for objectName. The description adds nothing beyond the schema, so baseline score of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action: 'Delete a managed object type definition' from PingOne AIC, specifying it removes the object type from the managed config. It distinguishes from sibling tools like deleteManagedObject (instance deletion) and patchManagedObjectDefinition (modification).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides a critical precondition: 'This will fail if other object types have relationship properties referencing this object type.' This guides when not to use the tool, though no alternative tool is explicitly mentioned.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
deleteOidcAppDelete OIDC AppBDestructive
Deletes an OIDC application.
| Name | Required | Description | Default |
|---|---|---|---|
| realm | Yes | The realm | |
| name | Yes | The application name |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations include destructiveHint=true and openWorldHint=true, but the description adds no additional context. It does not explain what happens when the app is deleted (e.g., irreversibility, cascading effects, permissions required). The openWorldHint suggests side effects that are not addressed.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, concise sentence with no unnecessary words. However, it lacks structure or additional details that could be useful, earning a 'good' but not excellent score.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a delete tool with no output schema, the description should at least hint at the return value or confirm success/failure. It does not mention irreversibility or any side effects, leaving the agent without crucial context.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has 100% coverage with descriptions for both parameters (realm and name). The tool description does not add any parameter-specific information, which is acceptable given the schema coverage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states that the tool deletes an OIDC application, using a specific verb and resource. It distinguishes itself from sibling tools like createOidcApp, getOidcApp, and updateOidcApp.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool versus alternatives (e.g., other delete tools). No prerequisites, dependencies, or cautionary notes are given, which is important for a destructive operation.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
deleteScriptDelete AM ScriptADestructive
Delete an AM script by its ID. Warning: This is a permanent deletion and cannot be undone. Ensure the script is not referenced by any journey nodes before deleting.
| Name | Required | Description | Default |
|---|---|---|---|
| realm | Yes | The realm containing the script | |
| scriptId | Yes | The unique identifier of the script to delete (UUID format) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description adds significant value beyond the annotations by explicitly stating 'permanent deletion and cannot be undone' and warning about journey node references. This complements the destructiveHint and openWorldHint annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences: the first states the action, the second provides a crucial warning. No unnecessary words or repetition.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the annotations (destructiveHint, openWorldHint) and the schema coverage, the description adequately covers the irreversible nature and prerequisite checks. No output schema is needed for a delete operation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema already has 100% description coverage for both parameters (realm and scriptId). The description does not add additional semantic meaning beyond what is in the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states 'Delete an AM script by its ID', specifying the verb (delete) and resource (AM script). It uniquely identifies the tool among siblings like deleteJourney, deleteManagedObject, etc.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides a warning about permanent deletion and the need to ensure the script is not referenced by journey nodes before deleting. It gives context for safe usage but does not explicitly mention when to use this tool over alternatives.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
deleteThemeDelete ThemeBDestructive
Delete a theme from a realm in PingOne AIC
| Name | Required | Description | Default |
|---|---|---|---|
| realm | Yes | Realm name | |
| themeIdentifier | Yes | Theme ID or name |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already indicate destructiveHint and openWorldHint. The description adds no extra behavioral context (e.g., irreversibility, cascading effects, permission requirements).
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, front-loaded sentence with no unnecessary words. It is appropriately concise, though could include more detail without being verbose.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the destructive nature and existence of sibling tools, the description is too minimal. It lacks context about implications of deletion (e.g., impact on default theme, recovery options) and does not leverage annotations to full effect.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has 100% description coverage for both parameters. The description does not add additional meaning beyond what the schema already provides, so baseline score of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action (Delete), the resource (theme), and the scope (from a realm in PingOne AIC). It effectively distinguishes from sibling tools like createTheme, updateTheme, or getTheme.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool versus alternatives like updateTheme or setDefaultTheme. It does not mention prerequisites (e.g., whether the theme must not be default) or consequences.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
deleteVariableDelete Environment Variable (ESV)ADestructive
Delete an environment variable (ESV) from PingOne AIC
| Name | Required | Description | Default |
|---|---|---|---|
| variableId | Yes | Variable ID (format: esv-*) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description 'Delete an environment variable' is consistent with the destructiveHint annotation, but it adds no additional behavioral details beyond what annotations already convey. No mention of permanence, authorization requirements, or irreversibility.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, clear sentence with no unnecessary information. It is appropriately sized for a simple delete operation.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a straightforward delete tool with one required parameter and no output schema, the description is sufficiently complete. It conveys the essential purpose and resource scope.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema fully describes the single parameter variableId with format hint. The description adds no extra meaning beyond what the schema provides, so baseline score of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The title and description clearly state 'Delete an environment variable (ESV)' from PingOne AIC, using a specific verb and resource. It distinguishes itself from sibling tools like setVariable, getVariable, and queryESVs.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage for deletion but does not explicitly state when to use it vs alternatives, nor does it mention prerequisites or side effects. The destructiveHint annotation provides some guidance but the description itself lacks explicit usage context.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
enableAiAgentEnable AI Agents (End-to-End)ADestructiveIdempotent
Enable the AI Agents feature in PingOne AIC. IMPORTANT: this action is one-way and cannot be undone. Re-running this tool is safe. Use listFeatures to check current status.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already set destructiveHint=true and idempotentHint=true. The description adds crucial behavioral detail: the action is one-way and cannot be undone, and re-running is safe. No contradiction with annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise (two sentences plus a warning), front-loads the purpose, and every sentence adds value. No extraneous text.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's simplicity (zero parameters, no output schema), the description is complete: it explains the action, irreversibility, safety of re-run, and references listFeatures for status. Nothing missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has zero parameters, so baseline is 4. The description appropriately mentions no parameters and does not need to add further information.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action ('Enable') and the resource ('AI Agents feature in PingOne AIC'). It distinguishes from sibling tools as there is no other 'enable' tool, and it provides a specific verb-resource pair.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description advises using `listFeatures` to check current status, providing clear context. However, it does not explicitly state when NOT to use this tool or describe alternatives beyond the status check.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
getAMScriptGet AM ScriptARead-only
Retrieve an AM script by its ID. Returns the complete script including name, description, language, and source code.
| Name | Required | Description | Default |
|---|---|---|---|
| realm | Yes | The realm containing the script | |
| scriptId | Yes | The unique identifier of the script (UUID format, e.g., '01e1a3c0-038b-4c16-956a-6c9d89328cff') |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and openWorldHint=true. The description adds value by specifying the returned fields (name, description, language, source code), but does not mention any additional behavioral traits beyond what annotations provide. No contradiction with annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single clear sentence with no fluff. It is front-loaded with the action and resource, and efficiently communicates the purpose and return content.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple read-only retrieval tool with no output schema, the description covers the action and return value well. It could mention that the scriptId is a UUID (already in schema), but overall it is sufficiently complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, with both parameters already described in the schema (realm with enum, scriptId with format hint). The description only reiterates 'by its ID' without adding new information about parameters. Baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb 'Retrieve' and the resource 'AM script by its ID', and specifies what is returned (name, description, language, source code). It distinguishes well from sibling tools like createScript, updateScript, deleteScript, and listScripts.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies when to use this tool (when you have a script ID and need the full script), but does not explicitly state when not to use it or mention alternatives like listScripts. It is clear enough for a simple retrieval operation.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
getCorsPolicyGet CORS PolicyARead-only
Retrieve a single CORS policy by its ID from the global AM CorsService. Returns the full policy including origins, methods, headers, maxAge, allowCredentials, and enabled status.
| Name | Required | Description | Default |
|---|---|---|---|
| policyId | Yes | The unique identifier of the CORS policy |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint and openWorldHint. Description adds context (global AM CorsService) and specifies return fields, going beyond the annotations without contradicting them.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Single sentence, front-loaded with action and resource, no wasted words. Efficiently conveys essential information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Despite no output schema, description enumerates return fields (origins, methods, etc.) and context (global AM CorsService), making the tool's behavior fully understandable for a simple retrieve operation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema has 100% coverage with a description for policyId. Description reinforces 'by its ID' but adds no new semantic detail beyond the schema. Baseline score of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description clearly states action (retrieve), resource (single CORS policy), and identifier (by its ID). It distinguishes from sibling tools like listCorsPolicies (list) and create/update/delete by being a retrieval operation.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is implied: use when you have a policy ID and need a single policy. However, no explicit guidance on when to use this tool over listCorsPolicies or when not to use it, leaving the agent to infer.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
getDynamicNodeOutcomesGet Dynamic Node OutcomesARead-only
Calculate the dynamic outcomes for a node based on its configuration. Use this for nodes whose outcomes depend on their config, such as: PageNode (outcomes depend on child nodes - pass { nodes: [...] }), ChoiceCollectorNode (outcomes depend on choices array - pass { choices: [...] }), and similar configurable nodes. This helps determine what connections to wire when building journeys.
| Name | Required | Description | Default |
|---|---|---|---|
| realm | Yes | The realm to query | |
| nodeType | Yes | The node type (e.g., "PageNode", "ChoiceCollectorNode") | |
| config | Yes | Node configuration object. For PageNode, use { nodes: [{ nodeType, _properties }...] }. For ChoiceCollectorNode, use { choices: ["option1", "option2", ...] }. Check the node schema via getNodeTypeDetails to understand required config properties. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations include readOnlyHint: true and openWorldHint: true. The description adds beyond annotations by explaining that the tool calculates outcomes based on node configuration, implying a read-only computation. It does not contradict annotations, and it provides useful behavioral context (no destructive effects).
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is three sentences long, each serving a distinct purpose: stating the function, giving usage guidance, and explaining the benefit. No unnecessary words, well-structured, and front-loaded with the core purpose.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool has no output schema and complex nested parameters, the description provides sufficient context about what the tool returns (dynamic outcomes for connections) and how to structure inputs for different node types. It is complete enough for an AI agent to understand the tool's role.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, but the description adds significant value by providing examples of config structures for different node types (PageNode, ChoiceCollectorNode) and referencing getNodeTypeDetails for more details. This clarifies parameter usage beyond the schema's generic descriptions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool calculates dynamic outcomes for nodes based on configuration, using specific verbs like 'calculate' and resource 'dynamic node outcomes'. It distinguishes itself from siblings by listing example use cases (PageNode, ChoiceCollectorNode) and explaining its role in journey building.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides clear guidance on when to use the tool: for nodes whose outcomes depend on their config, with concrete examples. While it does not explicitly mention when not to use it or alternative tools, the context of sibling tools (like getNodeTypeDetails) implies its specific purpose.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
getJourneyGet AM Journey (with Node Details)ARead-only
Retrieve a specific authentication journey (tree) by name from a realm in PingOne AIC. Automatically fetches and includes complete node schemas and configurations for all nodes in the journey. Returns comprehensive journey data with embedded node details.
| Name | Required | Description | Default |
|---|---|---|---|
| realm | Yes | The realm containing the journey | |
| journeyName | Yes | The name of the journey to retrieve (e.g., 'Login', 'Registration') |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations declare readOnlyHint=true and openWorldHint=true. Description adds valuable behavior: automatically fetches and includes complete node schemas and configurations. No contradictions, and the description enriches the agent's understanding of side effects and data retrieval.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, each purposeful. First sentence states the core action, second adds key detail about node retrieval. No wasted words, front-loaded with essential information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given no output schema, description adequately hints at return value ('comprehensive journey data with embedded node details'). With annotations and schema, the description is complete for a retrieval tool, covering purpose, behavior, and output shape.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Input schema covers both parameters with descriptions (realm enum, journeyName example). Schema description coverage is 100%, so baseline is 3. Tool description does not add extra parameter semantics beyond what schema provides.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description clearly states 'Retrieve a specific authentication journey (tree) by name from a realm in PingOne AIC', providing a specific verb and resource. It distinguishes itself from siblings like listJourneys by mentioning automatic fetching of node details.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage for retrieving full journey details with nodes but does not explicitly state when to use this tool versus alternatives (e.g., listJourneys, getJourneyPreviewUrl). No exclusions or when-not-to-use guidance provided.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
getJourneyPreviewUrlGet Journey Preview URLARead-only
Generate the preview URL for testing an authentication journey. Returns a URL that can be opened in a browser to test the journey flow.
| Name | Required | Description | Default |
|---|---|---|---|
| realm | Yes | The realm containing the journey | |
| journeyName | No | The name of the journey to preview. If omitted, returns the URL for the default journey. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already indicate readOnlyHint=true. Description adds that it returns a URL for testing, which is consistent but does not disclose additional behaviors like permissions or rate limits. Minimal added value beyond annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, front-loaded with the primary action. No redundant words. Highly efficient.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple read-only tool with two parameters and no output schema, the description fully explains what the tool does and the special case for journeyName. No missing information needed for correct usage.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% (both params described). Description adds valuable info: 'If omitted, returns the URL for the default journey' for journeyName, giving context beyond the schema. Realm parameter is well-defined by schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Clearly states 'Generate the preview URL for testing an authentication journey' with specific verb and resource. Distinguishes from sibling tools like createJourney or updateJourney by focusing on preview URL generation.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No explicit guidance on when to use this tool versus alternatives. Does not mention when not to use or provide exclusions. Usage context is implied but not clearly stated.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
getLogSourcesGet Log SourcesARead-only
Retrieve the list of available log sources in PingOne AIC
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Description adds context ('in PingOne AIC') but does not disclose any additional behavioral traits beyond the annotations that already mark it as readOnly and openWorld.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Single sentence, no wasted words, front-loaded with the key action.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple tool with no parameters and no output schema, the description is complete enough to understand its purpose and scope.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Input schema has no parameters, so schema coverage is 100%. Description does not add any parameter info, which is acceptable given zero parameters.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description clearly states verb 'Retrieve' and resource 'list of available log sources', which is specific and distinguishes from sibling tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool versus alternatives; no context on usage conditions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
getManagedObjectGet Managed ObjectARead-only
Retrieve a managed object's complete profile by ID in PingOne AIC
| Name | Required | Description | Default |
|---|---|---|---|
| objectType | Yes | Managed object type (e.g., alpha_user, bravo_user, alpha_role, bravo_role, alpha_group, bravo_group, alpha_organization, bravo_organization). Use listManagedObjects to discover all available types. | |
| objectId | Yes | The object's unique identifier (_id) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description adds minimal value beyond the annotations. Annotations already declare readOnlyHint=true and openWorldHint=true. The description only says 'complete profile' but does not elaborate on behavior such as error handling, rate limits, or authentication prerequisites.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, concise sentence that front-loads the key information: action, resource, and context. Every word is meaningful with no redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple get-by-ID operation, the description is adequately complete. It specifies the input (ID and object type) and the output ('complete profile'). However, it could mention what happens if the object is not found or if additional filters apply (e.g., scoping by environment).
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the schema alone sufficiently describes the parameters. The description does not add extra meaning or context beyond what is already in the input schema, achieving the baseline of 3.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb 'Retrieve', the resource 'managed object', the scope 'by ID', and the context 'in PingOne AIC'. It distinguishes this tool from siblings like listManagedObjects (list) and queryManagedObjects (query) by focusing on a single object retrieval.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description does not explicitly state when to use this tool over alternatives or provide exclusions. It implies usage for retrieving a single object by ID, but lacks guidance on when not to use or what alternative tools exist for broader queries.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
getManagedObjectSchemaGet Managed Object SchemaBRead-only
Retrieve schema definition for a managed object type in PingOne AIC
| Name | Required | Description | Default |
|---|---|---|---|
| objectType | Yes | Managed object type (e.g., alpha_user, bravo_user, alpha_role, bravo_role, alpha_group, bravo_group, alpha_organization, bravo_organization). Use listManagedObjects to discover all available types. | |
| includeFullDefinition | No | When true, returns the complete managed object definition including script hooks, lifecycle metadata, notifications, and other configuration. Defaults to false for a concise schema-only response. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and openWorldHint=true. The description only restates 'Retrieve' and adds no behavioral details such as response structure, data source, or limitations. Minimal value beyond annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Single, concise sentence that clearly states the tool's purpose. No extraneous information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Despite good annotations and high schema coverage, the description lacks detail about the return format or what the schema definition contains (e.g., fields, types, required attributes). This is a gap for a retrieval tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% and parameter descriptions are self-contained. The description adds no extra meaning beyond what the schema provides, so baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description uses a specific verb ('Retrieve') and resource ('schema definition for a managed object type'), clearly distinguishing it from siblings like getManagedObject (instance) and listManagedObjects (discovery).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description itself lacks usage guidance, but the input schema for objectType advises using listManagedObjects for discovery, providing implicit context. No explicit when/to-use alternatives.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
getNodeTypeDetailsGet Node Type DetailsARead-only
Get complete details (schema, default template, and outcomes) for one or more node types. Use this before building journeys to understand what configuration each node type requires and what outcomes it produces.
| Name | Required | Description | Default |
|---|---|---|---|
| realm | Yes | The realm to query | |
| nodeTypes | Yes | Array of node type names to get details for (e.g., ["UsernameCollectorNode", "PasswordCollectorNode"]) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and openWorldHint=true, which cover the key behavioral aspects. The description adds detail on what is returned, but does not reveal additional behavioral traits beyond the annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence that is front-loaded with the core action and results. Every word adds value with no redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the moderate complexity (2 parameters, no output schema), the description explains the return values (schema, default template, outcomes) sufficiently for an agent to understand the tool's purpose and output.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Input schema has 100% coverage with descriptions for both parameters. The description does not add any additional semantics beyond what is already in the schema, so baseline of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb 'Get' and the resource 'node types', and specifies the returned details (schema, default template, outcomes). It distinguishes itself from siblings like listNodeTypes which likely only lists names.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly states when to use: 'Use this before building journeys to understand what configuration each node type requires and what outcomes it produces.' Provides clear context, though it doesn't explicitly state when not to use.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
getOidcAppGet OIDC AppARead-only
Retrieves a complete OIDC application configuration.
| Name | Required | Description | Default |
|---|---|---|---|
| realm | Yes | The realm | |
| name | Yes | The application name |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already indicate read-only and open-world behavior. The description adds 'complete configuration' but does not disclose further behavioral traits beyond what annotations provide. No contradiction.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, front-loaded sentence of 6 words. It is concise and contains no filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the simplicity of the tool (get operation, two required parameters, no output schema, good annotations), the description is complete enough for an agent to understand its purpose and invoke it correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Input schema coverage is 100% with descriptions for both parameters (realm and name). The description adds no additional meaning beyond the schema, so baseline score of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses the specific verb 'retrieves' and resource 'complete OIDC application configuration,' clearly stating what the tool does. It distinguishes from sibling tools like listOidcApps, createOidcApp, deleteOidcApp, etc.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives (e.g., listOidcApps or getOidcAppSchema). No explicit context or exclusion criteria are mentioned.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
getOidcAppSchemaGet OIDC App SchemaARead-only
Returns the schema for an OIDC application. By default returns a compact summary of property names, types, and allowed values. Set summary=false for full details. Call this before createOidcApp or updateOidcApp to understand available fields.
| Name | Required | Description | Default |
|---|---|---|---|
| realm | Yes | The realm | |
| summary | No | When true (default), returns a compact listing of property names, types, and allowed values. Set to false for the full schema. | |
| sections | No | Limits the full client configuration schema to specific sections (e.g., ["coreOAuth2ClientConfig", "advancedOAuth2ClientConfig"]). The application metadata schema is always returned in full. Omit to get all sections. | |
| includeDefaults | No | Returns default values for all fields. Only applies when summary is false. Large response. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already indicate read-only and open-world. Description adds behavioral detail: default compact summary, sections filtering, includeDefaults only applies with summary=false, and large response warning. No contradiction.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three concise sentences front-loaded with purpose, followed by mode details and usage advice. No unnecessary words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given 4 parameters, no output schema, and high schema coverage, the description fully covers behavior, modes, and usage context. No gaps.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% with good descriptions. The description adds value beyond schema by explaining usage flow and emphasizing large response for includeDefaults. Slightly above baseline 3.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it returns the schema for an OIDC application, with specific detail on two modes (compact summary vs full details). It distinguishes from sibling tools like getOidcApp that return the app instance.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly advises calling this before createOidcApp or updateOidcApp to understand available fields. This provides clear when-to-use guidance and references sibling tools.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
getScriptedDecisionNodeBindingsGet Scripted Decision Node BindingsARead-only
Retrieve the available bindings (variables, functions) and allowed import libraries for Scripted Decision Node scripts. This is essential reference information when writing journey scripts - it shows what APIs and classes are available in the scripting environment.
| Name | Required | Description | Default |
|---|---|---|---|
| realm | Yes | The realm to query |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and openWorldHint=true, so the description does not need to repeat that. It adds useful context by stating it shows 'what APIs and classes are available in the scripting environment', which aligns with the read-only nature. No contradictions.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, front-loaded with the action and resource. No redundant or filler words. Every sentence earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the simple tool with one parameter, full schema coverage, and annotations, the description explains the return content (bindings, functions, libraries) and its relevance. It is sufficient for an agent to understand the tool's purpose and usage.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema covers the single 'realm' parameter completely with an enum and description. The description does not add additional meaning to the parameter beyond what the schema provides, so a baseline of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool retrieves 'available bindings (variables, functions) and allowed import libraries for Scripted Decision Node scripts.' The verb 'Retrieve' and specific resource differentiate it from sibling tools, which mostly operate on journeys, policies, or other entities.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly notes it is 'essential reference information when writing journey scripts', providing clear context for when to use. It does not give explicit exclusions or alternatives, but the context is sufficient for a focused tool.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
getThemeGet ThemeARead-only
Retrieve a specific theme by ID or name from PingOne AIC
| Name | Required | Description | Default |
|---|---|---|---|
| realm | Yes | Realm name | |
| themeIdentifier | Yes | Theme ID or name |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already provide readOnlyHint and openWorldHint, so the description adds limited behavioral context. It does not discuss error handling or return format.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Single sentence, no fluff. Front-loaded with the core action (retrieve) and resource (theme).
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple read-only tool with two parameters and annotations, the coverage is adequate. Lack of output schema is mild gap, but the purpose and inputs are fully specified.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the schema already documents both parameters. The description reinforces that themeIdentifier can be ID or name, but adds no new semantics.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool retrieves a specific theme by ID or name, distinguishing it from siblings like getThemes (list all) and create/update/delete actions.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool vs alternatives such as getThemes. The description does not mention any preconditions or exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
getThemesGet ThemesARead-only
Retrieve all themes for a specific realm in PingOne AIC
| Name | Required | Description | Default |
|---|---|---|---|
| realm | Yes | Realm name |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description is consistent with the readOnlyHint annotation but adds no additional behavioral context beyond what annotations already provide. The openWorldHint is not elaborated.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single sentence of 9 words, front-loaded with the action and resource, no wasted words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Adequate for a simple read operation with 1 parameter and no output schema. Could mention the return type but acceptable given the openWorldHint and schema coverage.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The single parameter 'realm' is fully described in the input schema (enum, description), and the description adds no extra meaning beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action (Retrieve), resource (all themes), and scope (for a specific realm in PingOne AIC), distinguishing it from sibling tools like getTheme (singular).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool versus alternatives like getTheme, createTheme, or listThemes. No exclusions or prerequisites are mentioned.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
getThemeSchemaGet Theme SchemaARead-only
Get comprehensive schema documentation for PingOne AIC themes including the expected payload structure, field types, enum values, and constraints. Use this before creating or updating themes to understand requirements.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true; description adds value by detailing the schema content (payload structure, field types, enums, constraints).
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences: first clearly states purpose and content, second gives usage guidance. No fluff, front-loaded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple, parameterless tool with annotations and no output schema, the description adequately covers purpose and usage context. Could mention response format, but not critical.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
No parameters; baseline 4 applies. Description adds no parameter info because none exist.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Clearly states it gets schema documentation for themes, distinct from getTheme and getThemes which retrieve theme data itself.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly advises using this before creating or updating themes, providing clear context. Lacks explicit exclusion of alternatives but is still helpful.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
getVariableGet Environment Variable (ESV)ARead-only
Retrieve a specific environment variable (ESV) by ID with decoded value
| Name | Required | Description | Default |
|---|---|---|---|
| variableId | Yes | Variable ID (format: esv-*) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint and openWorldHint. The description adds the behavioral detail that the value is decoded, which is useful and not contradicted by annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, well-structured sentence of 11 words, front-loading the key action and outcome with no unnecessary content.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple tool with one parameter and annotations present, the description is adequate: it confirms retrieval with decoded values. However, it omits handling of missing variables or error states, which is minor given the context.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% with one parameter described as 'Variable ID (format: esv-*)'. The description adds no additional meaning beyond the schema, so baseline score of 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action ('Retrieve'), the resource ('environment variable ESV'), the method ('by ID'), and the outcome ('with decoded value'), effectively distinguishing it from siblings like setVariable and queryESVs.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No explicit guidance on when to use this tool versus alternatives (e.g., queryESVs for listing, setVariable for writing). The description only states the function without context or exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
installIdmFeatureInstall IDM FeatureADestructive
Install an IDM feature in PingOne AIC. IMPORTANT: this action is one-way and cannot be undone. Run validateIdmFeature first to check the feature can be installed. For AI Agents, use enableAiAgent instead. Use listFeatures to see what is available.
| Name | Required | Description | Default |
|---|---|---|---|
| featureName | Yes | IDM feature name. May be a single segment (e.g. `groups`, `aiagent`) or slash-separated segments (e.g. `password/timestamps`, `indexed/strings/6thru20`). Alphanumeric/underscore/hyphen segments only; no leading/trailing slash, no `..`. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Beyond annotations (destructiveHint: true), description emphasizes 'one-way and cannot be undone' and provides a validation step. No contradiction with annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three sentences delivering clear purpose, warning, prerequisite, alternative, and discovery tip. No wasted words, front-loaded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Covers all essential aspects: what it does, destructiveness, prerequisite validation, alternative for AI Agents, and discovery. No output schema needed.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so baseline is 3. The description does not add additional meaning beyond what the schema already provides for the single parameter.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states 'Install an IDM feature in PingOne AIC' with specific verb and resource. It distinguishes from siblings by directing to use `enableAiAgent` for AI Agents and `listFeatures` to see available features.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly suggests running `validateIdmFeature` first as a prerequisite, provides alternative for AI Agents (`enableAiAgent`), and recommends `listFeatures` for discovery.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
listCorsPoliciesList CORS PoliciesARead-only
List all CORS policies configured on the global AM CorsService. Returns policy metadata including IDs and configured origins, methods, and headers.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already indicate readOnlyHint and openWorldHint, which the description does not contradict. It adds value by specifying the return content (IDs, origins, methods, headers) beyond the structural annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, no wasted words. First sentence states action and scope, second describes output. Perfectly concise.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given zero parameters and no output schema, the description adequately explains what the tool does and what it returns. It is complete for this simple list operation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
There are no parameters, so the baseline is 4. The description does not need to add parameter info, and it aligns with the fully covered schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool lists all CORS policies on the global AM CorsService and specifies the returned metadata (IDs, origins, methods, headers). It distinguishes from sibling tools like getCorsPolicy (single policy) and create/delete/update.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies use for listing all policies, but does not explicitly contrast with alternatives like getCorsPolicy for a single policy. However, the context of siblings makes it sufficiently clear.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
listFeaturesList FeaturesARead-only
List all available features in PingOne AIC and whether they are installed. Returns a unified list of IDM features and AIC platform features (e.g. AI Agents) with install status. This is the single tool to call when checking what features exist and their state.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already provide readOnlyHint: true and openWorldHint: true, indicating safe read behavior. The description adds value by detailing the return content (unified list, install status), without contradicting annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences cover purpose, scope, and usage context with no redundant words. Every sentence earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a parameterless tool with no output schema, the description adequately explains what it returns (unified list, install status) and gives an example. Could be slightly more detailed about output structure, but is sufficient.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has no parameters, so schema coverage is 100%. The description adds no parameter-specific information, which is appropriate. Baseline score of 3 is maintained.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb 'List', the resource 'features', and adds specifics about returning a unified list of IDM and AIC platform features with install status. It distinguishes itself from sibling tools like installIdmFeature and validateIdmFeature by stating it is the single tool for checking feature existence and state.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly says 'This is the single tool to call when checking what features exist and their state,' providing clear context for when to use it. While it does not explicitly exclude alternatives, the statement implies its unique role among feature-related siblings.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
listJourneysList AM JourneysARead-only
Retrieve all authentication journeys (trees) for a specific realm in PingOne AIC. Returns journey metadata including ID, description, and the default journey for the realm.
| Name | Required | Description | Default |
|---|---|---|---|
| realm | Yes | The realm to query |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and openWorldHint=true. The description adds that it returns metadata (ID, description, default journey) but no additional behavioral traits like rate limits or side effects are disclosed.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is one concise sentence that front-loads the action and outcome. No redundant information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the simple tool (1 param, read-only, no output schema), the description sufficiently covers what the tool does and returns. It lacks details on pagination or return format, but with openWorldHint it is adequate.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The description only says 'for a specific realm' without adding meaning beyond the schema's own description and enum. Schema coverage is 100%, so baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action 'retrieve all authentication journeys' for a specific realm and lists what metadata is returned. It distinguishes from sibling tools like getJourney (single) and createJourney (create).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage when needing all journeys in a realm, but does not explicitly state when not to use it or mention alternatives. It is clear but not exhaustive.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
listManagedObjectsList Managed ObjectsARead-only
Retrieve the list of all managed object types available in PingOne AIC
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and openWorldHint=true. Description adds context that it retrieves object types (not instances), providing additional clarity beyond annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Single sentence, front-loaded with key information. No unnecessary words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Description is adequate for a simple list operation, but does not specify the return format or structure. Could be clearer about what the output contains (e.g., names, ids).
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
No parameters, and schema coverage is 100%. With 0 parameters, baseline is 4. Description does not add parameter details, but none are needed.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Clearly specifies verb 'Retrieve', resource 'list of all managed object types', and context 'PingOne AIC'. Distinguishes from sibling tools like queryManagedObjects.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No explicit when or when-not guidelines or alternatives mentioned. However, the purpose is straightforward and easily inferred from name and description.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
listNodeTypesList AM Node TypesARead-only
Discover all available authentication node types in a realm. Returns node type metadata including ID, name, and tags. Use this to understand what node types can be used when building journeys.
| Name | Required | Description | Default |
|---|---|---|---|
| realm | Yes | The realm to query |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already indicate readOnly and openWorld, so safety is implied. Description adds value by specifying the return fields (ID, name, tags), which is consistent and informative.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three concise sentences with no redundancy. Essential information is front-loaded, and every sentence adds value.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's simplicity (single required enum parameter, no output schema, read-only annotations), the description covers purpose, return content, and usage context adequately.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% with a single parameter described as 'The realm to query.' Description does not add extra meaning beyond the schema, so baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description clearly states the tool discovers all available authentication node types in a realm, indicating a listing operation. It distinguishes from siblings like getNodeTypeDetails, which is for specific node types.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly says 'Use this to understand what node types can be used when building journeys,' providing context. However, it does not explicitly exclude alternatives or mention when not to use it.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
listOidcAppsList OIDC AppsARead-only
Lists OIDC applications in a realm with summary fields only. Use getOidcApp for full details of a specific app.
| Name | Required | Description | Default |
|---|---|---|---|
| realm | Yes | The realm | |
| queryFilter | No | Optional CREST query filter. Default: true (all apps). Example: name sw "my" |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already indicate readOnly and openWorld. The description adds that only summary fields are returned, which is useful behavioral context. No contradictions.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, no extraneous information. Purpose is front-loaded, and the alternative guidance is concise.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple list tool with only two parameters, the description is adequate. It clarifies the output scope but could explicitly mention return type (array of objects). Minor gap, but overall complete given low complexity.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Input schema has 100% coverage with descriptions for both parameters. The description adds no additional meaning beyond what schema provides, so baseline score of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool lists OIDC applications in a realm and specifies that only summary fields are returned. It distinguishes from sibling getOidcApp by mentioning full details are available there.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly guides to use getOidcApp for full details, providing clear when-to-use vs alternative. No mention of when not to use, but the context is sufficient.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
listScriptsList AM ScriptsARead-only
List Scripted Decision Node scripts (evaluatorVersion 2.0) in a realm. Returns script metadata including ID, name, description, language, and context. Use getAMScript to retrieve the full script content.
| Name | Required | Description | Default |
|---|---|---|---|
| realm | Yes | The realm to query |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint and openWorldHint. Description adds that it returns specific metadata (ID, name, etc.), consistent and informative.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two concise sentences, front-loaded with purpose, no redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given simplicity (one required param, no output schema, good annotations), description is complete and sufficient.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% with enum and description for realm. Description only briefly mentions 'in a realm', adding no extra semantics beyond schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description clearly states the tool lists Scripted Decision Node scripts with version 2.0, and specifies the returned metadata fields. It distinguishes from sibling getAMScript.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly mentions when to use this tool (to list metadata) and directs to getAMScript for full content, providing clear alternative.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
patchManagedObjectPatch Managed ObjectA
Update specific fields of a managed object in PingOne AIC using JSON Patch operations
| Name | Required | Description | Default |
|---|---|---|---|
| objectType | Yes | Managed object type (e.g., alpha_user, bravo_user, alpha_role, bravo_role, alpha_group, bravo_group, alpha_organization, bravo_organization). Use listManagedObjects to discover all available types. | |
| objectId | Yes | The object's unique identifier (_id) | |
| revision | Yes | The current revision (_rev) of the object, obtained from getManagedObject | |
| operations | Yes | Array of JSON Patch operations to apply to the object |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations destructiveHint=false and openWorldHint=true are consistent with the description's 'Update' nature. The description does not add behavioral context beyond annotations, such as concurrency handling or authentication needs. It does not contradict annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Description is a single, focused sentence with no extraneous words. It is front-loaded and wastes no space.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a patch tool with no output schema, the description is mostly complete. It could mention return value or revision handling, but the schema provides sufficient detail on required fields. Slightly incomplete for a tool with no output schema.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
All 4 parameters have descriptions in the input schema (100% coverage). The description reinforces the use of JSON Patch operations but does not add new meaning beyond the schema. Baseline score of 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool updates specific fields of a managed object using JSON Patch operations. It uses a specific verb (Update) and resource (managed object), and the method (JSON Patch) distinguishes it from siblings like createManagedObject or deleteManagedObject.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage for modifying fields but does not explicitly state when to use this tool versus alternatives like patchManagedObjectDefinition or patchManagedObjectRelationship. No guidance on when not to use or prerequisites is provided. The input schema references listManagedObjects and getManagedObjectSchema, offering indirect context.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
patchManagedObjectDefinitionPatch Managed Object DefinitionA
Modify an existing managed object type definition in PingOne AIC using ForgeRock PATCH operations. Operations use field paths relative to the object (e.g., /schema/properties/email). IMPORTANT: Cannot modify relationship properties — use patchManagedObjectRelationship for those.
| Name | Required | Description | Default |
|---|---|---|---|
| objectName | Yes | Name of the managed object type to modify (e.g., "alpha_user", "custom_application"). Must contain only a-z, A-Z, 0-9, and underscore characters. | |
| operations | Yes | Array of ForgeRock PATCH operations to apply. Each operation has operation (add/remove/replace), field (path relative to the object, e.g., /schema/properties/email), and optional value. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already indicate non-destructive behavior (destructiveHint: false) and open world (openWorldHint: true). The description adds context about PATCH operations and field paths, but does not cover side effects or permissions. It aligns with annotations without contradiction.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, both informative and no redundancy. The important restriction is highlighted with 'IMPORTANT'. Front-loaded with the primary action.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool has two required parameters and no output schema, the description covers purpose, field path format, and the relationship restriction. Could mention return behavior, but not critical. Adequate for an agent.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has 100% coverage with detailed descriptions. The description adds value by explaining field paths relative to the object and providing an example, clarifying the operations array structure beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool modifies an existing managed object type definition using ForgeRock PATCH operations, specifying the resource and action. It differentiates from the sibling tool patchManagedObjectRelationship by noting that relationship properties cannot be modified here.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly states when not to use this tool (cannot modify relationship properties) and directs to the alternative patchManagedObjectRelationship. This provides clear usage guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
patchManagedObjectRelationshipPatch Managed Object RelationshipADestructive
Add, update, or remove a custom relationship property on a managed object type in PingOne AIC via the schema service. Only works with properties that have a "custom_" prefix. For add/update, provide the full relationship property definition.
| Name | Required | Description | Default |
|---|---|---|---|
| objectType | Yes | The managed object type (e.g., "alpha_user", "bravo_role"). Must be a valid path segment. | |
| propertyName | Yes | The relationship property name. Must start with "custom_" prefix (e.g., "custom_department", "custom_teams"). | |
| action | Yes | The action to perform: "add" to create a new relationship property, "update" to modify an existing one, or "remove" to delete it. | |
| propertyDefinition | No | The full relationship property definition. Required for add/update actions. For the expected structure, refer to an existing relationship property from getManagedObjectSchema with includeFullDefinition=true. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already convey destructive and open-world behavior. Description adds the custom_ prefix constraint and schema service usage, but no additional behavioral traits like permissions or side effects are disclosed.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, zero wasted words. All essential information is presented efficiently and front-loaded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Covers key aspects: operation, prefix requirement, definition needs, and reference schema. Lacks explicit error handling or return value description, but no output schema exists.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema has 100% parameter description coverage. Description adds value by reinforcing the custom_ prefix for propertyName and directing users to getManagedObjectSchema for the propertyDefinition structure.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description clearly states the tool adds, updates, or removes a custom relationship property on a managed object type. It distinguishes from siblings like patchManagedObject by focusing specifically on relationship properties.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly states the custom_ prefix requirement and that a full property definition is needed for add/update. Lacks explicit when-not-to-use or alternative tools, but the context is clear enough.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
queryESVsQuery Environment Secrets and Variables (ESVs)BRead-only
Query environment secrets or variables (ESVs) in PingOne AIC by ID
| Name | Required | Description | Default |
|---|---|---|---|
| type | Yes | Type of ESV to query | |
| queryTerm | No | Search term to filter by ID. If omitted, returns all ESVs up to pageSize | |
| pageSize | No | Number of results to return per page (default: 50) | |
| pagedResultsCookie | No | Pagination cookie from previous response to retrieve next page | |
| sortKeys | No | Comma-separated field names to sort by. Prefix with "-" for descending. Example: "_id,-lastChangeDate" |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already mark readOnlyHint and openWorldHint. The description adds no behavioral details beyond the schema, such as pagination behavior or response format.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Single sentence of 12 words, perfectly concise and front-loaded with the core purpose.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With 5 parameters, no output schema, no guidance, and minimal description, the tool is underdescribed. The description only states the purpose, missing details on pagination, sorting, and response.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema has 100% coverage with descriptions for all parameters. The description does not add any additional meaning beyond what the schema provides.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb 'Query', the resource 'ESVs', and the context 'in PingOne AIC'. It distinguishes from sibling tools like getVariable and deleteVariable by being a query operation for ESVs.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool versus alternatives like getVariable for a single retrieval. The description does not specify use cases or exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
queryLogsQuery LogsARead-only
Query PingOne AIC logs to investigate issues or understand system behavior. Useful for debugging journey execution failures, authentication errors, script exceptions, and API issues. Transaction IDs from error responses can be used to trace specific requests.
| Name | Required | Description | Default |
|---|---|---|---|
| sources | Yes | Log sources to query (e.g., ['am-authentication', 'idm-activity']). IMPORTANT: use the getLogSources tool to determine available sources. | |
| beginTime | No | Start time in ISO 8601 format without milliseconds (e.g., '2025-01-11T10:00:00Z'). Filters logs after this time. Defaults to 24 hours before endTime if omitted. Must be within 24 hours of endTime. | |
| endTime | No | End time in ISO 8601 format without milliseconds (e.g., '2025-01-11T12:00:00Z'). Filters logs before this time. Defaults to current time if omitted. Must be within 24 hours of beginTime. | |
| transactionId | No | Transaction ID to trace a specific request. Found in: (1) tool success/error messages, (2) x-forgerock-transactionid response header from AIC API calls, (3) browser network tab when debugging UI issues. | |
| queryFilter | No | CRITICAL: All field paths MUST start with / (e.g., /payload/level, /payload/principal). Missing the leading slash causes 500 Internal Server Error. Operators: eq, co, sw, lt, le, gt, ge, pr (present), ! (NOT). Boolean: and, or. Quote string values. Time filtering: Use beginTime/endTime parameters for time ranges. Use /payload/timestamp only for exact timestamp matches. Examples: /payload/level eq "ERROR" /payload/principal co "admin" /payload/eventName eq "AM-LOGIN-COMPLETED" (/payload/level eq "ERROR") and (/payload/http/request/path co "openidm") /payload/response.statusCode ge 400 Troubleshooting: If you receive a 500 error, verify all field paths begin with / | |
| pagedResultsCookie | No | Opaque pagination cookie from a previous response. Use this to retrieve the next page of results. | |
| pageSize | No | Maximum logs to return (default 100). |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations declare readOnlyHint=true and openWorldHint=true. The description confirms its read-only nature ('Query... to investigate') and adds detail about transaction ID tracing. Parameter descriptions further disclose behaviors like leading slash requirement for queryFilter (causing 500 if missing). No contradictions.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is three sentences front-loaded with purpose, use cases, and a key feature (transaction ID tracing). Every sentence adds value, and parameter descriptions are detailed but not verbose. No wasted words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description and parameter docs cover the tool's functionality well, including time constraints, pagination, and query filter usage. However, without an output schema, the return format (e.g., structure of log entries) is not described, leaving a minor gap for a complex tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, and the description adds rich context, especially for transactionId (how to obtain it) and queryFilter (operators, examples, troubleshooting). This goes well beyond the schema definitions, providing actionable guidance.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool queries PingOne AIC logs for debugging issues. It specifies the resource ('PingOne AIC logs') and verb ('Query'), and distinguishes from siblings like getLogSources by focusing on log investigation.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives concrete use cases (debugging journey failures, authentication errors, etc.), providing clear guidance on when to use. It lacks explicit exclusions or alternative tool mentions, but the use cases are sufficiently specific.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
queryManagedObjectsQuery Managed ObjectsBRead-only
Query managed objects in PingOne AIC using CREST query filter syntax
| Name | Required | Description | Default |
|---|---|---|---|
| objectType | Yes | Managed object type (e.g., alpha_user, bravo_user, alpha_role, bravo_role, alpha_group, bravo_group, alpha_organization, bravo_organization). Use listManagedObjects to discover all available types. | |
| queryFilter | No | CREST query filter expression. IMPORTANT: Call getManagedObjectSchema first to discover available fields. Operators: eq, co, sw, gt, ge, lt, le, pr (present), ! (NOT). Boolean: and, or. Quote strings. If omitted, returns all objects up to pageSize. Examples: FIELD eq "value" | FIELD sw "prefix" | (FIELD1 eq "a") and (FIELD2 co "b") | FIELD pr Docs: https://docs.pingidentity.com/pingoneaic/latest/developer-docs/crest/query.html#crest-query-queryFilter | |
| pageSize | No | Number of objects to return per page (default: 50) | |
| pagedResultsCookie | No | Pagination cookie from previous response to retrieve next page | |
| sortKeys | No | Comma-separated field names to sort by. Prefix with "-" for descending. Example: "FIELD1,-FIELD2" | |
| fields | No | Comma-separated field names to return. If omitted, returns all fields. Example: "FIELD1,FIELD2,_id" |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and openWorldHint=true, indicating a safe, stateless read operation. The description does not add behavioral traits beyond these annotations, nor does it contradict them. It is adequate but adds minimal value.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, front-loaded sentence that conveys the essential purpose efficiently. However, it could be slightly more informative without losing conciseness, e.g., mentioning that it supports filtering and pagination. It earns a 4 for being very concise but not maximally informative.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (6 parameters, no output schema), the description is insufficiently complete. It fails to explain return format, pagination behavior, or high-level usage patterns. The description should at least mention pagination and that the result is a list of objects. The absence of this context makes it harder for an agent to anticipate the tool's behavior.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With 100% schema description coverage across all 6 parameters, the schema already explains each parameter's purpose, constraints, and examples. The description does not add any additional semantic meaning beyond what the schema provides, so a baseline score of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb 'Query', the resource 'managed objects', and the method 'CREST query filter syntax'. It specifically names the syntax and platform, making the purpose unambiguous and distinguishing it from sibling tools like listManagedObjects or getManagedObject.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The top-level description does not provide any usage guidelines, such as when to use this tool versus alternatives like listManagedObjects or getManagedObject. While the parameter descriptions within the schema hint at prerequisites (e.g., using listManagedObjects to discover object types), the description itself lacks this context.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
setDefaultJourneySet Default JourneyAIdempotent
Set the default authentication journey for a realm. This journey will be used when no specific journey is requested during authentication.
| Name | Required | Description | Default |
|---|---|---|---|
| realm | Yes | The realm to configure | |
| journeyName | Yes | The name of the journey to set as default |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare non-destructive (destructiveHint=false) and idempotent (idempotentHint=true). The description adds that the journey is used when no specific journey is requested, providing behavioral context beyond what annotations offer.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two concise sentences, front-loaded with the key purpose, no unnecessary words or redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given there is no output schema, the description sufficiently explains the tool's behavior. It covers the purpose, effect, and usage context without needing to detail return values.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% with both parameters described (realm enum and journeyName with minLength). The description does not add additional meaning or constraints beyond the schema, so it meets the baseline.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb 'set' and the resource 'default authentication journey for a realm', and distinguishes from sibling tools like createJourney and updateJourney by specifying that this sets the default used when no specific journey is requested.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies when to use this tool (to set a default journey) and provides context that it affects authentication when no specific journey is requested. However, it does not explicitly state when not to use it or mention alternatives.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
setDefaultThemeSet Default ThemeAIdempotent
Set a theme as the default for a realm in PingOne AIC
| Name | Required | Description | Default |
|---|---|---|---|
| realm | Yes | Realm name | |
| themeIdentifier | Yes | Theme ID or name |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already indicate idempotent, non-destructive, open-world behavior. The description adds no further context about side effects or state changes beyond the basic action.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Single concise sentence, front-loaded, with no wasted words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Adequate for a simple set operation, but lacks mention that the theme must already exist, that it overwrites the previous default, or any return value details.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% with descriptions for both parameters; the tool description does not add further meaning or clarification beyond what the schema provides.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Clearly states 'set a theme as the default for a realm' with a specific verb and resource, distinguishing it from sibling tools like createTheme or updateTheme.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Implies that this tool is for setting a default theme, but provides no explicit guidance on when to use it vs alternatives like setDefaultJourney, nor prerequisites or exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
setVariableSet Environment Variable (ESV)AIdempotent
Create or update an environment variable (ESV) in PingOne AIC
| Name | Required | Description | Default |
|---|---|---|---|
| variableId | Yes | Variable ID (format: esv-*) | |
| value | No | Variable value as native type (NOT JSON string). Examples: string: 'hello', array: ['a','b'], object: {"key":"val"}, bool: true, int: 42, number: 3.14, list: 'a,b,c'. The tool handles JSON serialization internally for array/object types. | |
| type | Yes | The variable type. Determines how the value is interpreted. Note: Type cannot be changed after creation. Prefer 'array' over 'list'. | |
| description | No | Optional description of the variable's purpose |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already provide idempotentHint=true, destructiveHint=false. Description adds no extra behavioral context beyond 'create or update', which is already implied by the annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, concise sentence that directly states the tool's purpose with no unnecessary words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the simplicity of the tool (4 params, no output schema) and rich annotations/schema, the description is largely adequate. It could mention idempotency or type immutability, but these are covered in schema.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents all parameter details. The tool description adds no additional meaning beyond what is in the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb ('Create or update') and resource ('environment variable (ESV) in PingOne AIC'), distinguishing it from siblings like deleteVariable, getVariable, etc.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No explicit guidance on when to use this tool versus alternatives. The description only implies usage for setting a variable, but does not mention when not to use or provide comparisons.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
updateCorsPolicyUpdate CORS PolicyAIdempotent
Update an existing CORS policy by ID on the global AM CorsService. Performs a full replacement on the wire (fetch-then-PUT): the current policy is fetched first, any provided fields are merged over it, and the complete policy is PUT back to AM. Fields not supplied are preserved from the existing policy.
| Name | Required | Description | Default |
|---|---|---|---|
| policyId | Yes | The unique identifier of the CORS policy to update | |
| acceptedOrigins | No | New allowed origins | |
| acceptedMethods | No | New HTTP methods allowed during preflight | |
| acceptedHeaders | No | New non-simple request headers allowed during preflight | |
| exposedHeaders | No | New response headers exposed to the browser | |
| maxAge | No | New preflight cache duration in seconds | |
| allowCredentials | No | Whether to send Access-Control-Allow-Credentials: true on responses | |
| enabled | No | Whether the policy is enabled |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description discloses the fetch-then-PUT mechanism, merge behavior, and field preservation, adding significant context beyond annotations (destructiveHint=false, idempotentHint=true).
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, front-loaded with the key action, and no unnecessary words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For an update tool with no output schema, the description fully explains the wire behavior and merge logic, leaving no ambiguity.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the baseline is 3. The description adds no additional meaning beyond the schema for individual parameters.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it updates an existing CORS policy by ID on the global AM CorsService, distinguishing it from sibling tools like createCorsPolicy and deleteCorsPolicy.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage for updating an existing policy but does not explicitly state when to use this tool versus alternatives or provide exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
updateJourneyUpdate JourneyAIdempotent
Update an existing authentication journey. Fetches the current journey, merges any caller-provided metadata fields (description, identityResource, mustRun, innerTreeOnly, uiConfig, enabled, maximumSessionTime, maximumIdleTime), and PUTs the result back. If nodes and/or entryNodeId are provided, the graph is replaced atomically using the same UUID transformation pipeline as createJourney; otherwise the existing graph is preserved unchanged. Fields not supplied by the caller are preserved from the fetched journey.
| Name | Required | Description | Default |
|---|---|---|---|
| realm | Yes | The realm containing the journey | |
| journeyName | Yes | The name of the journey to update | |
| description | No | Admin-facing description of the journey | |
| identityResource | No | The identity resource that the journey authenticates against. Expected format: "managed/<realm>_<objectType>" (e.g., "managed/alpha_user", "managed/bravo_role"). | |
| mustRun | No | Whether the journey must run to completion | |
| innerTreeOnly | No | Whether the journey can only be used as an inner tree | |
| uiConfig | No | Unbounded JSON object of UI configuration key/value pairs. The set of meaningful keys is defined by AM and is not enumerated here. To discover the shape for a given journey, read it first with getJourney. | |
| enabled | No | Whether the journey is enabled | |
| maximumSessionTime | No | Maximum session time in minutes | |
| maximumIdleTime | No | Maximum idle time in minutes | |
| entryNodeId | No | ID of the first node (connected from Start). Required when replacing the graph. Can be human-readable; will be transformed to UUID. | |
| nodes | No | Map of node IDs to node definitions. When provided, replaces the existing graph entirely and must be provided together with entryNodeId. Keys can be human-readable (e.g., "login-page"); they will be transformed to UUIDs. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations (destructiveHint=false, idempotentHint=true, openWorldHint=true) are consistent. The description adds substantial behavioral detail: fetches current journey, merges metadata, PUTs result, atomic graph replacement with UUID transformation, preservation of unchanged fields. No contradictions.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single dense paragraph, front-loaded with the main purpose. Every sentence adds value, though it could be slightly more concise. No fluff.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a complex tool with 12 parameters and nested objects, the description covers all behavioral aspects: merge strategy, graph replacement conditions, UUID transformation, field preservation, and uiConfig caveat. No output schema but the description explains what happens sufficiently.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% and each parameter has a thorough description. The tool description adds context about the overall update behavior but does not significantly enhance understanding of individual parameters beyond what the schema provides. Baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states 'Update an existing authentication journey' and explains the merge-and-PUT behavior, distinguishing it from createJourney (UUID transformation pipeline) and implicitly from updateJourneyNode (graph replacement vs node update).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides clear context for when to provide nodes/entryNodeId (to replace graph) and notes that fields not supplied are preserved. However, it does not explicitly state when not to use this tool vs alternatives like updateJourneyNode, though such guidance can be inferred.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
updateJourneyNodeUpdate Journey NodeAIdempotent
Update a single node's configuration without modifying the journey structure. This is a FULL REPLACEMENT of the node configuration - to preserve existing fields, first fetch the current configuration using getJourney, merge your changes, then call this tool with the complete configuration.
| Name | Required | Description | Default |
|---|---|---|---|
| realm | Yes | The realm containing the node | |
| nodeType | Yes | The node type (e.g., "ScriptedDecisionNode") | |
| nodeId | Yes | The node instance UUID (from a previous read or create operation) | |
| config | Yes | The complete node configuration to set. This is a full replacement - fetch current config first if you need to preserve existing fields. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations indicate idempotentHint=true and destructiveHint=false. The description adds value by explicitly noting full replacement and the need to fetch current config, which supplements the annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences: first states the tool's primary function, second explains the critical behavioral caveat. No extraneous information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With 4 required parameters and no output schema, the description covers the main behavioral trait (full replacement) and prerequisite. It could mention expected return value, but not essential.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is complete (100%) and descriptions are adequate. The description reiterates that the config parameter is a full replacement, providing minor additional context beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it updates a single node's configuration without altering journey structure, emphasizing full replacement. This distinguishes it from siblings like updateJourney or deleteJourneyNodes.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It provides explicit guidance on how to preserve existing fields by first fetching with getJourney, merging, then calling this tool. This explains the full replacement behavior, though no alternatives to other tools are mentioned.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
updateOidcAppUpdate OIDC AppAIdempotent
Updates an OIDC application. You can update the client configuration, the application metadata, or both.
| Name | Required | Description | Default |
|---|---|---|---|
| realm | Yes | The realm | |
| name | Yes | The application name | |
| oauth2Client | No | Partial OIDC client configuration. Provide only the properties you want to change, nested under their configuration sections. Omit to skip this update. | |
| managedApplication | No | Application metadata patch. Omit to skip this update. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description discloses that the tool modifies an OIDC application, which is consistent with annotations (idempotentHint, openWorldHint). However, it does not elaborate on specific behaviors like the need for a current revision or potential side effects beyond the update scope.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is extremely concise, using two sentences to convey the core purpose and options. No extraneous information, front-loaded with the verb and resource.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (nested objects, no output schema), the description covers the main update types but lacks context on prerequisites (e.g., fetching _rev via getOidcApp) and return behavior. The openWorldHint suggests possible unlisted effects, but the description could still be more complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With 100% schema coverage, the description adds minimal parameter semantics beyond the schema, only summarizing that client config and metadata can be updated. It does not detail the structure or required fields like _rev for metadata.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool updates an OIDC application, specifying that it can update client configuration, application metadata, or both. This clearly distinguishes it from sibling tools like createOidcApp or deleteOidcApp.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description indicates when to use the tool (to update an existing OIDC app) but does not explicitly mention when not to use it, such as if the app doesn't exist (use create) or prerequisites like obtaining the current revision from getOidcApp for metadata updates.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
updateScriptUpdate AM ScriptAIdempotent
Update an existing Scripted Decision Node script. You can update any combination of name, description, or script content.
| Name | Required | Description | Default |
|---|---|---|---|
| realm | Yes | The realm containing the script | |
| scriptId | Yes | The unique identifier of the script (UUID format) | |
| name | No | New name for the script | |
| description | No | New description for the script | |
| script | No | New JavaScript source code for the script |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already provide destructiveHint=false, idempotentHint=true, and openWorldHint=true. The description adds that it updates existing scripts and allows any combination of name, description, or script content, which gives useful behavioral context beyond the annotations and does not contradict them.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, clear sentence with no unnecessary words. It is front-loaded with the action and resource, making it easy for an agent to quickly understand the purpose.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the presence of annotations, a partial update operation, and no output schema, the description adequately explains what the tool does. It specifies the resource type and what can be updated. A minor gap is the lack of mention about response, but annotations cover idempotency and safety.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% with descriptions for each parameter. The description adds the phrase 'any combination,' reinforcing the optional nature of name, description, and script, but the schema already shows they are not required. The description provides minimal additional meaning beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action ('Update an existing Scripted Decision Node script') and specifies the resource (script). It distinguishes from siblings like createScript, deleteScript, and getAMScript by focusing on modification of an existing entity.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies when to use (to modify an existing script) and indicates partial updates. While it does not explicitly exclude alternatives, the sibling tool names provide context, and the title 'Update AM Script' contrasts with create/delete/get scripts.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
updateThemeUpdate ThemeAIdempotent
Update an existing theme in PingOne AIC
| Name | Required | Description | Default |
|---|---|---|---|
| realm | Yes | Realm name | |
| themeIdentifier | Yes | Theme ID or name | |
| themeUpdates | Yes | Object containing the fields to update (cannot update _id or isDefault) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already indicate non-destructive, idempotent, open world. Description adds no extra behavioral context (e.g., what fields are immutable, if validation occurs). Minimal added value.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Single sentence, no redundancy. Every word contributes to the purpose.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Description is minimal. No mention of return value, error cases, or side effects. Lacks completeness for an update operation, though annotations provide some safety context.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% with descriptions for all parameters. Description does not add any additional meaning beyond the schema, so baseline score of 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Clearly states verb 'Update', resource 'existing theme', and system 'PingOne AIC'. Distinct from siblings like createTheme or deleteTheme.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool versus alternatives (e.g., createTheme, patchManagedObject). No conditions or prerequisites mentioned.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
validateIdmFeatureValidate IDM FeatureARead-only
Check whether an IDM feature can be installed without making any changes. Returns a result with success (true/false) and a message explaining any blockers. Run this before installIdmFeature.
| Name | Required | Description | Default |
|---|---|---|---|
| featureName | Yes | IDM feature name. May be a single segment (e.g. `groups`, `aiagent`) or slash-separated segments (e.g. `password/timestamps`, `indexed/strings/6thru20`). Alphanumeric/underscore/hyphen segments only; no leading/trailing slash, no `..`. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description adds significant behavioral context beyond annotations: it confirms no changes are made ('without making any changes'), describes the return structure ('success' and 'message' with explanation of blockers), and complements the readOnlyHint annotation. No contradiction.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is extremely concise, consisting of two sentences that convey purpose, behavior, and usage guidance without any redundant information. It is well-structured and front-loaded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple validation tool with one parameter and no output schema, the description is complete. It explains the return value, side-effect-free nature, and relationship to sibling. No additional context is needed.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema provides full coverage of the single parameter 'featureName' with a detailed description. The tool description does not add additional parameter semantics beyond what the schema already offers, which meets the baseline expectation.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose with a specific verb ('check') and resource ('IDM feature'). It distinguishes the tool from its sibling 'installIdmFeature' by emphasizing it makes no changes and should be run before installation.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly instructs to run this tool before 'installIdmFeature', providing clear usage context. While it doesn't explicitly state when not to use it, the guidance is sufficiently strong for correct selection.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.
5 tool updates
- Added
createCorsPolicy - Added
deleteCorsPolicy - Added
getCorsPolicy - Added
listCorsPolicies - Added
updateCorsPolicy
41 tool updates
v0.3.0- Added
createJourney - Added
createManagedObjectDefinition - Added
createOidcApp - Added
createScript - Added
deleteJourney - Added
deleteJourneyNodes - Added
deleteManagedObjectDefinition - Added
deleteOidcApp - Added
deleteScript - Changed
deleteTheme1 field changed- added
Input schema / properties / themeIdentifier / minLengthAdded value: +1
- Added
enableAiAgent - Added
getAMScript - Added
getDynamicNodeOutcomes - Added
getJourney - Added
getJourneyPreviewUrl - Changed
getManagedObjectSchema1 field changed- added
Input schema / properties / includeFullDefinitionAdded value: +{ + "default": false, + "description": "When true, returns the complete managed object definition including script hooks, lifecycle metadata, notifications, and other configuration. Defaults to false for a concise schema-only response.", + "type": "boolean" +}
- Added
getNodeTypeDetails - Added
getOidcApp - Added
getOidcAppSchema - Added
getScriptedDecisionNodeBindings - Changed
getTheme1 field changed- added
Input schema / properties / themeIdentifier / minLengthAdded value: +1
- Changed
getVariable1 field changed- added
Input schema / properties / variableId / minLengthAdded value: +1
- Added
installIdmFeature - Added
listFeatures - Added
listJourneys - Added
listNodeTypes - Added
listOidcApps - Added
listScripts - Changed
patchManagedObject1 field changed- added
Input schema / properties / revision / minLengthAdded value: +1
- Added
patchManagedObjectDefinition - Added
patchManagedObjectRelationship - Changed
queryLogs1 field changed- changed
Input schema / properties / transactionId / descriptionPrevious value: -"Filter by specific transaction ID to trace a request across the system."New value: +"Transaction ID to trace a specific request. Found in: (1) tool success/error messages, (2) x-forgerock-transactionid response header from AIC API calls, (3) browser network tab when debugging UI issues."
- Added
setDefaultJourney - Changed
setDefaultTheme1 field changed- added
Input schema / properties / themeIdentifier / minLengthAdded value: +1
- Changed
setVariable2 fields changed- changed
Input schema / properties / type / descriptionPrevious value: -"The variable type. Determines how the value is interpreted. Note: Type cannot be changed after creation. Ping recommends using 'array' instead of 'list'."New value: +"The variable type. Determines how the value is interpreted. Note: Type cannot be changed after creation. Prefer 'array' over 'list'." - added
Input schema / properties / variableId / minLengthAdded value: +1
- Added
updateJourney - Added
updateJourneyNode - Added
updateOidcApp - Added
updateScript - Changed
updateTheme1 field changed- added
Input schema / properties / themeIdentifier / minLengthAdded value: +1
- Added
validateIdmFeature
20 tool updates
v1.0.0- First observed
createManagedObject - First observed
createTheme - First observed
deleteManagedObject - First observed
deleteTheme - First observed
deleteVariable - First observed
getLogSources - First observed
getManagedObject - First observed
getManagedObjectSchema - First observed
getTheme - First observed
getThemes - First observed
getThemeSchema - First observed
getVariable - First observed
listManagedObjects - First observed
patchManagedObject - First observed
queryESVs - First observed
queryLogs - First observed
queryManagedObjects - First observed
setDefaultTheme - First observed
setVariable - First observed
updateTheme
TDQS
Each tool targets a distinct resource and action (e.g., createJourney vs. deleteJourney, getOidcApp vs. listOidcApps). No two tools have overlapping purposes; all operations are clearly separated.
All tool names follow a consistent verb_noun pattern in camelCase (e.g., createJourney, deleteManagedObject, getTheme). Minor variations like queryESVs vs. listOidcApps still adhere to the pattern.
With 52 tools, the count exceeds the 'too many' threshold of 25+. While the server covers a broad domain, the large number may overwhelm agents and suggests potential for consolidation.
The tool set provides full CRUD coverage for journeys, managed objects, OIDC apps, themes, scripts, and variables, plus querying and feature management. Minor gaps exist (e.g., no export/import), but core workflows are well-covered.
Maintenance
Resources
Unclaimed servers have limited discoverability.
Looking for Admin?
If you are the server author, to access and configure the admin panel.
Related MCP Connectors
- mcpOAuthcom.vibgrate
Query your team's drift, vulnerability, and upgrade data from any AI assistant. OAuth 2.1, 51 tools.
OAuth 2.1 short-link tools for AI agents with scoped tokens, approvals, audit logs, and revocation.
Connects AI assistants to CloudQuell multi-cloud and AI cost, savings, anomaly, and budget data.
Deploy, monitor, and manage your OpenClaw AI assistants via natural language.
Related MCP Servers
AlicenseNot gradedqualityBmaintenanceEnables AI assistants to interact with Scalekit's identity and access management platform through natural language queries. Supports managing environments, organizations, users, OIDC connections, workspace operations, and MCP server configurations with OAuth-protected access.2255Apache 2.0
DaVinci MCP Serverofficial
AlicenseNot gradedqualityCmaintenanceEnables AI assistants to manage and troubleshoot PingOne DaVinci identity orchestration flows, applications, connectors, variables, and forms through standardized MCP tools.2551Apache 2.0
OneLogin MCP Serverofficial
AlicenseNot gradedqualityBmaintenanceEnables managing users, apps, roles, authentication, and security settings through natural language, providing comprehensive access to the OneLogin API.3035MIT- FlicenseNot gradedqualityDmaintenanceEnables AI assistants to securely access Okta Identity Governance APIs for managing users, groups, apps, access requests, and certifications with configurable deployment modes and safety controls.-
Latest Blog Posts
- Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)By Om-Shree-0709 on .mcpAgent IdentityOAuth 2.1
- Your AI Chatbot Just Exposed Your CEO's Salary to an InternBy Om-Shree-0709 on .Agent IdentityMCP SecurityOAuth Delegation
- Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)By Om-Shree-0709 on .Agentic AiPrompt InjectionWebAssembly
MCP directory API
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/pingidentity/aic-mcp-server'
If you have feedback or need assistance with the MCP directory API, please join our Discord server