Skip to main content
Glama

Create a polymorphic read-only embed link

embed_links_create

The capability URL is returned once; only its secret hash is stored.

POST /api/v1/embed-links

For multi-space accounts, call auth_verify, ask the user which space to use, and pass targetSpaceId. Create an embed link only when the user explicitly asks to share or preview that node. The returned URL is a bearer capability: reveal or open it only when the user requests that action.

Input Schema

NameRequiredDescriptionDefault
typeYes
typeIdYes
framePolicyNo
targetSpaceIdNoBusabase space id. Call auth_verify first and ask the user which space to use when more than one is returned.
expiresInMinutesNo

Schema Changelog

Changes observed during successful MCP inspections.

  1. Changed1 schema field changed
    • changedInput schema / properties / expiresInMinutes / maximum
      Previous value: -1440New value: +10080
  2. First observed

TDQS

A3.8/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond the annotations (readOnlyHint=false, destructiveHint=false), it discloses the critical non-obvious behavior: the capability URL is returned only once and only its secret hash is stored, and the URL is a bearer credential that should be revealed only on explicit request. This is exactly the kind of irreversibility and credential-handling context an agent needs.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Roughly 70 words with little waste, and the one-time-URL warning and usage gating are both important. Structure is slightly awkward—it opens with a dependent reference to 'The capability URL' before stating the action, and the raw POST path is implementation detail rather than agent-facing guidance.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 5-parameter mutation tool with no output schema and low schema coverage, it covers the return-value caveat (URL shown once) and the space-selection workflow, but omits required permissions on the target node and the semantics of type, framePolicy, and expiry. Adequate for the basic call path, with clear gaps.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With only 20% schema description coverage, the description must compensate but mostly doesn't: targetSpaceId is mentioned, yet the required type enum (node/change-request/record-detail), typeId, the complex framePolicy anyOf, and expiresInMinutes are left unexplained in both schema and description. The agent cannot infer how the polymorphic link type affects typeId or what the frame policy does.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The title and description make it clear this creates a polymorphic, read-only embed link for a node (or change-request/record-detail via the type enum), with a specific verb+resource. It does not explain how it differs from nearby siblings like change_requests_create_preview_link or node_share, so it stops short of a 5.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It gives an explicit when-to-use rule ('only when the user explicitly asks to share or preview that node') and a concrete multi-space prerequisite (call auth_verify, ask the user which space, then pass targetSpaceId). No explicit when-not or named alternative is given, which keeps it from 5.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Try in Browser

Glama MCP Gateway

Add one secure layer between your agents and this server.