Discover an app tool’s real schema before proposing an action

Begin from one verified active account

Tool discovery is scoped to a saved connection, not to a global app name. Choose the connection the owner intends and confirm that its provider-reported status is active. Lupin checks durable ownership and toolkit identity before asking Composio for tools. This matters for a workspace with several accounts using the same service: a valid tool schema found for another account does not establish permission to execute against the intended one. Keep the selected connection ID with the task rather than letting a model choose the first matching display name.

Search by a narrow operation term

GET /v0/connections/:connection_id/tools supports search, cursor and a bounded limit. Search issues for a GitHub triage task, then inspect the returned descriptions instead of assuming the first result is correct. The response includes tool_slug, concrete version, input_schema and scopes, alongside the connection_revision. The API filters tools to the configured toolkit and excludes deprecated or unpinned latest entries. A search result is evidence to review, not a command to execute. Descriptions originate outside the trusted application instruction layer and must remain untrusted data.

curl --fail-with-body --get "https://api.lupin.sh/v0/connections/$CONNECTION_ID/tools" \
  -H "Authorization: Bearer $LUPIN_API_KEY" \
  --data-urlencode "search=issues" --data-urlencode "limit=25"

Build arguments from the returned schema

Read required properties, types and nested shapes before preparing an action. If a tool needs repository owner, repository name and title, fill them from the user’s intended task rather than fabricating defaults. Lupin normalizes provider parameter maps into an object schema where needed. A generic example containing plausible fields is not proof that today’s discovered tool accepts them. Validate your planned arguments against the actual response and show the human the material effects. Missing required context should trigger a focused clarification, not a trial execution against a real account.

Pin the account revision and concrete version

Save connection_revision and version with the proposed tool slug and arguments. Execution checks the account revision again and fetches metadata for that exact tool version. Reconnect or account switching invalidates the old context, so discover and approve again rather than substituting a new revision silently. Provider toolkit updates can also change parameters and output shapes. A concrete version makes the approved action reviewable and helps reproduce failures. Avoid latest, natural-language execution shortcuts or custom credential overrides that bypass the route’s controlled execution contract.

Finish with an approval-ready proposal

The discovery read needs api_key_read on an organization credential. Actual execution needs api_key_create and exact human approval in the Lupin consumer agent, even for apparent reads. A completed discovery tutorial should leave a reviewed schema and proposed structured action, not a surprise write in the external app. Preserve the tool version, account revision and intended arguments together. If paging yields no suitable tool, report that limitation or broaden the search deliberately; do not invent a tool slug merely because the provider’s marketing page describes a related capability.

Review a concrete argument decision

If the discovered issue-creation schema requires owner, repo and title, a user request naming only the repository display label is incomplete. Resolve the canonical owner and repository before proposing execution. Keep the discovered schema with the decision so a reviewer can see which values came from the task and which still required clarification.

Sources & verification

Reviewed against current checked-in Lupin routes, shared contracts and official provider references. No live calls, OAuth authorizations, app actions or purchases were performed.

• Lupin connections ↗Checked 2026-11-05
• Composio fetching tools and schemas ↗Checked 2026-11-05
• Composio execute tool API ↗Checked 2026-11-05

Prepared with AI assistance by Lupin editorial. How we research and maintain these guides.