Grafizum Command Center

Create a connection key

create_connection_key

Mint one long-lived access key for THIS connection, for a machine, script or app that cannot keep an OAuth session alive. note says where the key will be used (the VM, the cron job, the app and account); the server records it with the account, client and IP that minted it. The key is returned ONCE and stored only as a hash, and it inherits every rule and project of this connection, so it cannot widen them. There is no tool that deletes or revokes a key — retiring one stays with the owner in the dashboard.

Tool call template

Replace each placeholder with a value matching the input schema. Only required parameters are included; add optional parameters as needed.

{
  "id": 1,
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "arguments": {
      "note": "<note>"
    },
    "name": "create_connection_key"
  }
}

Input Schema

Name	Required	Description	Default
`note`	Yes	Where this key will be used, in plain words: the machine, app or account it is for.
`reason`	No

Schema Changelog

Changes observed during successful MCP inspections.

AddedNov 9, 2026

TDQS

A4.4/5.0

Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Goes well past the annotations (readOnly=false, destructive=false, idempotent=false): the secret is returned only once and stored as a hash, it inherits the connection's rules and projects so it cannot widen privileges, the server records minting account/client/IP, and non-idempotency is implied by each call minting a new key. The absence of a revoke path is disclosed explicitly, which is exactly the kind of consequence an agent needs.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three sentences, front-loaded with what is created, then behavior of the secret, then the lifecycle gap. Every clause carries information an agent would otherwise have to guess, and nothing is repeated from the title.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema, the description correctly covers the return value (the key, shown once) and the security consequences of the write. It does not mention who is authorized to mint a key or any per-connection limits, but for a two-parameter creation tool the coverage is otherwise sufficient to call it correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 50%: 'note' is documented in both places, and the description adds the purpose of that note (where the key will be used — VM, cron job, app and account) plus the fact that it is recorded alongside account, client and IP. The 'reason' parameter, however, is given no meaning anywhere, leaving half the input undocumented.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('Mint one long-lived access key') and scopes it to THIS connection and to a concrete class of caller (machine, script or app that cannot keep an OAuth session alive). No sibling touches keys, and the definition makes the object created unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives a clear selection condition — use it when the consumer cannot hold an OAuth session — and an explicit exclusion: there is no delete/revoke tool, so retirement happens in the dashboard. It stops short of naming a sibling alternative for interactive callers, but the when-to-use trigger is concrete.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

All Grafizum Command Center tools Inspect

Try in Browser

Claude Code, inside the Godot 4 editorFlockbay puts an AI agent in the real Godot 4 editor: it writes GDScript, runs your game and fixes what breaks. Free, or bring your own Claude Code or Codex.flockbay.comAd

Glama MCP Gateway

Add one secure layer between your agents and this server.