--- name: toolcard description: Check one MCP tool with Toolcard check_tool, or a whole tools/list with check_server, then read the three toolcard://answers resources. Use when writing or reviewing an MCP tool name, description, or inputSchema, when tools are mapped one-to-one onto REST endpoints, when an MCP server loads and the agent never calls the tool, when choosing which parameters to expose, or when a tools list has duplicate names, overlapping descriptions, or too many tools. --- # Toolcard Check the one tool you are about to add or change. To check a whole tools list, call `check_server`. Then read the three resources below. Do not send secrets, tokens, or personal data. The server is `POST https://agentghostedme.com/mcp`. Send one JSON-RPC object. Set `Content-Type: application/json` and `Accept: application/json, text/event-stream`. No batch and no session id. A call with no `id` gets HTTP 202 and an empty body. This server does not require `initialize` first. If your client sends it, use protocol version `2025-06-18` and read `result.instructions`. That string names the three resources and says to pass a finding's `resource` to `resources/read`. ## Call check_tool ```json {"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"check_tool","arguments":{"name":"manage_user","description":"Create or update a user account and its permissions, then return a short summary of what changed.","inputSchema":{"type":"object","properties":{"action":{"type":"string","description":"create, update, or set_permissions"},"email":{"type":"string"}},"required":["action"]}}}} ``` Replace `arguments` with the tool you are checking. `name` is required. `description` and `inputSchema` are optional. Read `result.structuredContent`. For the body above, `shape` is `not-endpoint-shaped`, `findings` is empty, and `stored` is false. Rules version `2026-10-18.1`. An empty `findings` list means these checks did not fire. It does not mean the tool is good. `getUser` with description `Get a user` and one required string property `id` returns `shape` `endpoint-shaped` and finding ids `endpoint-shaped-name`, `thin-description`, and `description-echoes-name`. When a finding includes `resource`, pass that URI to `resources/read`. `endpoint-shaped-name` uses the first URI below. `thin-description` and `description-echoes-name` use the second. `wide-input` uses the third. `missing-input-schema`, `input-schema-not-object`, `duplicate-name`, `overlapping-descriptions`, and `too-many-tools` omit `resource`. Do not pass an http URL to `resources/read`. A check stores nothing. The same check without MCP is `POST https://agentghostedme.com/v1/check` with the arguments object as the body. Prefer `check_tool` when an MCP client is available. Cap: 60 MCP tool calls per IP per hour. A `check_tool` call counts. A resource read does not. Over the cap the HTTP status is 429 and the response includes `Retry-After`. ## Call check_server Use this for a whole `tools/list` result. Pass `arguments.tools`, or pass `arguments.result` when you have the JSON-RPC envelope and no `tools` field. One call counts as one tool call. It stores nothing. Send at most 64 tools. ```json {"jsonrpc":"2.0","id":5,"method":"tools/call","params":{"name":"check_server","arguments":{"tools":[{"name":"getUser","description":"Get a user","inputSchema":{"type":"object","properties":{"id":{"type":"string"}}}},{"name":"listUsers","description":"List users","inputSchema":{"type":"object","properties":{"id":{"type":"string"}}}}]}}} ``` Read `result.structuredContent`. `tools` has one check per tool, with the same finding ids as `check_tool`. `findings` at the top level is only the cross-tool list. `stored` is false. `duplicate-name` fires when the trimmed name appears more than once. Case is kept, so `manage_user` and `Manage_user` are not duplicates. `overlapping-descriptions` fires when both descriptions have at least 4 content tokens and share at least 80 percent of the shorter set. `too-many-tools` fires when the list has more than 20 tools. 20 stays quiet. Those cutoffs are Toolcard's. Those three findings omit `resource`. The same body without MCP is `POST https://agentghostedme.com/v1/check-server`. A JSON-RPC envelope `{"result":{"tools":[...]}}` is accepted there, and as `arguments` here when `tools` is omitted. The body limit is 128KB. One list counts as one check against the 60-check cap, and as one MCP tool call against the 60-call cap. ## Read the three resources `resources/list` returns all three. Read each one. A read stores nothing and does not use the tool-call cap. - `toolcard://answers/mcp-tools-mapped-1-to-1-onto-a-rest-api` - `toolcard://answers/mcp-server-loads-but-the-agent-never-calls-it` - `toolcard://answers/picking-the-right-subset-of-parameters` ```json {"jsonrpc":"2.0","id":2,"method":"resources/read","params":{"uri":"toolcard://answers/mcp-tools-mapped-1-to-1-onto-a-rest-api"}} ``` ```json {"jsonrpc":"2.0","id":3,"method":"resources/read","params":{"uri":"toolcard://answers/mcp-server-loads-but-the-agent-never-calls-it"}} ``` ```json {"jsonrpc":"2.0","id":4,"method":"resources/read","params":{"uri":"toolcard://answers/picking-the-right-subset-of-parameters"}} ``` The markdown is `result.contents[0].text`. Pass those URIs exactly. The public http URL is not a resource URI. Any other URI returns JSON-RPC `-32002`. Read the first when the tool list is one tool per REST method. Read the second when the server loads and the agent does not call the tool. Read the third when the tool exposes many parameters. Read all three before you change the tool. ## Stop Do not call `report_outcome` from this skill. Report only a tool you offered and then saw called or ignored. Rule text is `GET https://agentghostedme.com/v1/rules`. This skill does not restate it.