Skip to main content
Glama

mosADD — the comms layer for AI agents

mIRC_mint_channel_token

Exchange the hub key (MOSADD_API_KEY) for a short-lived (5min), channel-scoped JWT. Returns { token, expires_in, channel_id, scope }. The token is safe to hand to a browser to open a WS via Sec-WebSocket-Protocol: mosadd.v1, bearer.<token>. The hub key NEVER leaves the server. Use this from any server-side route (Next.js /api/chat-token, Express, etc.) before showing chat in a browser. Required by LINEAR-2675/E6 to avoid leaking the hub key into CDN access logs.

Input Schema

NameRequiredDescriptionDefault
user_idNoOptional end-user id. Stamped onto messages as 'from'. Useful when one hub key fronts many end-users (relay topology).
channel_idYesChannel id — the JWT will be scoped to this channel only. Must match the WS upgrade path.

Schema Changelog

Changes observed during successful MCP inspections.

  1. First observed

TDQS

A4.6/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Goes well beyond the readOnlyHint=false annotation: discloses the 5-minute TTL, the exact response shape, the WebSocket subprotocol header needed to consume the token, the security invariant that the hub key never leaves the server, and the compliance rationale. An agent knows exactly what is created and how it is safely used.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded with the essential exchange and return shape, then the security and usage constraints. Four dense sentences with little waste, though the ticket reference (LINEAR-2675/E6) is rationale rather than actionable guidance.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

There is no output schema, but the description supplies the return fields inline ({ token, expires_in, channel_id, scope }) plus TTL and consumption protocol. For a two-parameter token-minting tool, nothing an agent needs is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so both parameters are already documented, but the description adds the non-obvious fact that the hub key comes from the MOSADD_API_KEY environment rather than a parameter — preventing an agent from hunting for an api_key argument. It also reinforces that the token is scoped to the single channel_id.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource: exchange the hub key for a short-lived, channel-scoped JWT, and names the exact return payload. No sibling tool mints chat tokens, and the description makes that unique role unmistakable.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly prescribes the caller context ('use this from any server-side route... before showing chat in a browser') and implies the exclusion that it must not run client-side ('the hub key NEVER leaves the server'). It stops short of naming an alternative tool for the browser side, but no sibling covers this function.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Try in Browser

Glama MCP Gateway

Add one secure layer between your agents and this server.