Skip to main content
Glama

Deploy hosted app

deploy_app
DestructiveIdempotent

Put a small web app that you wrote live at a public address, or replace the files of the app this workspace already has under the same slug. A hosted app is static files — HTML, CSS, JavaScript, no build step — that show ONE board and its sub-boards: a gallery, a portfolio, a catalogue. Returns the app's url. Read the hosted_apps topic with read_documentation BEFORE writing the files: it has the contract and a working starter. In short, the page reads the board through its own address: a GET of the RELATIVE URL playbook/api/<path> returns the Playbook REST API's answer to /v1/{organization}/<path> (e.g. playbook/api/assets?nested_assets=true), and playbook/app answers { board }. The page needs and gets no token; every URL in the app must be relative. The app is PUBLIC. Anyone with the address sees everything on the board with no login, unapproved assets and uploader names included, and boards added under it later too, so confirm the board with the user before deploying. Everything in files is public as well: never put a token, a key, or content read from another board into them. The only write is visitors' uploads into the board (playbook/upload, see the topic), and only while the board's share link has Allow uploads or the upload-only page on, with no password, no email form and no past expiry; the app cannot comment or change anything else. Limits: an index.html is required; text files only (.html .css .js .mjs .json .svg .txt .webmanifest); at most 50 files and 1 MB in total — images stay in Playbook and are never part of the app; at most 10 apps per workspace. A deploy replaces the whole file set, so send every file each time, not only the changed ones. If the call times out, check list_apps before deploying again; a repeat is safe. Requires write scope and permission to edit the board. Needs hosted apps enabled for the workspace: without it the call answers 403 hosted_apps_disabled, which no tool can change — tell the user to ask Playbook support.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
nameYesDisplay name of the app, at most 100 characters
slugYesThe app's address: lowercase letters, digits and hyphens, at most 63 characters, starting with a letter or digit. Unique across all of Playbook, so make it specific; one taken by another workspace is refused with a 422. A slug this workspace already uses replaces that app's files.
filesYesThe complete file set: contents as text, keyed by path relative to the app's root, e.g. { "index.html": "<!doctype html>…", "app.js": "…", "styles.css": "…" }. Paths are plain names joined by `/` and `.`, with no leading slash. A top-level `worker.js` is the app's optional backend and is not served as a file; leave it out unless the `hosted_apps` topic says you need one. Nothing may sit under `playbook/`, which Playbook answers itself.
board_tokenYesToken of the board the app shows, from list_boards. Its sub-boards are readable too; nothing else in the workspace is.
organizationNoWorkspace slug, as returned by list_organizations. Omit it when the account has a single workspace — it is then resolved from your token. Pass it only when the account has several, or when you mean a workspace other than the obvious one.

Schema Changelog

Changes observed during successful MCP inspections.

  1. Added

TDQS

A4.8/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations declare destructive/idempotent/openWorld, and the description goes well beyond them: the app is public with no login, files must never contain secrets, the only write is visitor uploads under stated share-link conditions, plus hard limits (index.html required, 50 files/1 MB, 10 apps/workspace), write scope requirement, and the 403 `hosted_apps_disabled` failure mode that no tool can fix.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Purpose is front-loaded and each block (contract, public exposure warning, limits, failure modes) earns its place, but the description is very long and dense for a single tool, with some packaging detail that could be delegated to the referenced `hosted_apps` topic.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a destructive, open-world deploy with a nested `files` object and no output schema, the description supplies everything needed: return value (`url`), prerequisites, constraints, idempotency behavior, and the un-actionable 403 case with user-facing guidance.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline is 3, but the description adds real meaning: a deploy replaces the whole file set so every file must be re-sent, files are public, and board_token scope is limited to the board and its sub-boards. It stops short of restating per-parameter syntax, which the schema already handles.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The first sentence gives a concrete verb and resource ('put a small web app... live at a public address, or replace the files of the app...') and defines what a hosted app is (static files, one board and its sub-boards). It is clearly distinguishable from delete_app and list_apps, which appear in the sibling list.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicit routing: read the `hosted_apps` topic with read_documentation BEFORE writing files, confirm the board with the user because the app is public, and check list_apps first if the call times out instead of re-deploying blindly. When-to-use-vs-alternatives is fully covered.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Try in Browser

Glama MCP Gateway

Add one secure layer between your agents and this server.

Resources