Skip to main content
Glama

GhostKey — Route Paid APIs with x402

ghostkey_session_create

PAID tool ($0.10 USDC via x402 v2, Base). Create a short-lived, origin-scoped browser delegation session. Send the x402 PAYMENT-SIGNATURE header on the /mcp request; without payment the call returns the live x402 challenge (HTTP 402, amount 100000 = $0.10 USDC, network eip155:8453). Actions inside a minted session are unmetered. Optionally target a previously enrolled trusted device using its private 256-bit routing capability so its extension can claim the session automatically. The user still handles login/CAPTCHA and any new browser-origin permission themselves.

Input Schema

NameRequiredDescriptionDefault
ttl_secondsNo
allowed_originsYes
trusted_device_idNo

Schema Changelog

Changes observed during successful MCP inspections.

  1. Added

TDQS

A3.9/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already cover the safety profile (not read-only, open-world, non-idempotent, non-destructive), and the description adds substantial beyond-schema behavior: exact price and network, the x402 PAYMENT-SIGNATURE header requirement, the 402 challenge with amount 100000, the fact that in-session actions are unmetered, and that login/CAPTCHA and new origin permissions remain the user's responsibility. This is unusually rich disclosure for a paid mutation tool.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Sentences are dense with no filler, and the cost/payment condition is front-loaded where an agent needs it before deciding. It is on the long side for a three-parameter tool, but every clause carries distinct operative information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a paid, non-idempotent mutation tool with no output schema, the description covers cost, payment mechanics, session semantics, and user responsibilities. The main gap is the return payload: it never says what a successful session object contains (session ID/token, expiry), which the agent needs to chain into session_action.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must carry parameter meaning. It explains trusted_device_id well ('private 256-bit routing capability' so the extension can auto-claim), and 'origin-scoped' implicitly frames allowed_origins, but ttl_seconds is only gestured at with 'short-lived' and no parameter names or bounds are given. Partial compensation for a low-coverage schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource with scope: 'Create a short-lived, origin-scoped browser delegation session.' That is far more precise than the sibling names alone (session_action, session_status) and implies the lifecycle position. It doesn't explicitly contrast with device_pairing_create or session_action, so it stops short of full sibling differentiation.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage context is implied rather than stated: the agent learns payment is required and that a session can optionally be routed to an enrolled device, but there is no explicit 'use this instead of X when Y' routing against sibling tools like session_action or device_pairing_create. The prerequisites (payment header, user handling login/CAPTCHA) are present, which lifts it above bare minimum.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Try in Browser

Glama MCP Gateway

Add one secure layer between your agents and this server.

Resources