Skip to main content
Glama

CorroborateMe

agent_bootstrap

Read-onlyIdempotent

Show how to start zero-human company onboarding. This call does not create a company, send email, or mint a bootstrap token or an aa_ key. MCP requires a company API key (aa_...) or an MCP OAuth access token before any tool runs. Returns message, path (/api/agents/bootstrap), body (company_name and contact_email echoed), product, and keyPrefix. The unauthenticated REST POST to that path returns bootstrapToken, expiresIn 900 (about 15 minutes), and next billing paths, and it does not mint the aa_ key. After that REST call, POST /api/billing/machine-pay with the bootstrap token for an agent prepaid unlock, or POST /api/billing/checkout when a human will pay in the browser.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
company_nameNoOptional display name echoed in body for POST /api/agents/bootstrap. This tool does not store it.
contact_emailNoOptional contact email echoed in body. No message is sent.

Schema Changelog

Changes observed during successful MCP inspections.

  1. First observed

TDQS

A4.1/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnly/idempotent/non-destructive, and the description builds on them by enumerating the side effects it explicitly avoids (no company creation, no email sent, no bootstrap token or aa_ key minted) and by naming the auth requirement. It also discloses the return payload (message, path, body echo, product, keyPrefix) and the REST token's 900-second expiry, which is meaningful context absent an output schema.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The denial-of-side-effects and the auth prerequisite are front-loaded before the return shape and the downstream REST options, which is good ordering. The passage is dense with a lot of REST detail, but nearly every clause (auth, negations, return fields, expiry, next steps) carries distinct information rather than repeating structured data.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a zero-side-effect informational tool with no output schema, the description covers everything an agent needs: what it does and explicitly does not do, the auth precondition, the returned fields, and the follow-on REST calls with their selecting conditions. Nothing needed to invoke it correctly is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100% and both params are optional, so the schema already carries the semantics; the description only restates that company_name and contact_email are echoed in the body and not stored, mirroring the schema text. Baseline 3 applies since the description adds nothing beyond the structured field documentation.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific action (show how to start zero-human company onboarding) and immediately bounds it with three negations (does not create a company, send email, or mint tokens). It is distinguishable from siblings like billing_checkout because it positions itself as the pre-onboarding informational step, though it never explicitly contrasts itself with an MCP sibling tool.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It gives real routing guidance: it states the auth prerequisite (aa_ key or OAuth token) 'before any tool runs,' and it names the downstream alternatives POST /api/billing/machine-pay (agent prepaid unlock) versus POST /api/billing/checkout (human pays in browser) with the condition that selects each. It stops short of explicitly telling the agent when to call this tool instead of the billing_* MCP siblings.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Try in Browser

Glama MCP Gateway

Add one secure layer between your agents and this server.