Skip to main content
Glama

Tracklution

register_and_provision

Create/reuse an account and the first tracking container in one agent-safe call. For brand-new emails: the API creates the account, immediately emails the user a welcome / set-password link, and returns a 60-minute JWT in data.auth._sensitive_access_token so this agent can continue applying snippets and verifying events without further authentication. Hold the JWT only for this conversation and pass it back as auth_token on subsequent onboarding tool calls. After the user clicks the welcome email link, they finish setup and log into the dashboard.

The response carries two informational flags for fresh registrations: pending_user_activation: true and welcome_email_sent_to: <email>. Surface the inbox-check instruction to the user verbatim when these are present.

PROACTIVE auth_token: If you ALREADY have an auth_token (the user is signed in, or a previous turn returned one), pass it INSTEAD of email. With auth_token the call returns the existing-or-new container for that (user, website_url) pair — no duplicate_account error occurs. Do NOT pass name or email alongside auth_token; the server reads identity from the JWT.

RECOVERY on duplicate_account (HTTP 409): the user already has a Tracklution account. Ask them to log in at https://app.tracklution.com (or request a fresh setup link at https://app.tracklution.com/account-recovery if they never finished the welcome flow), then re-run this tool with auth_token in memory.

RECOVERY on multi_client_ambiguous (HTTP 409): the JWT-authed user has multiple companies (clients) and the requested website_url does not match any existing container. The server cannot pick a company on the user's behalf. Surface next_action.reason verbatim (it contains a dashboard URL) and EXIT — do NOT call any other MCP tool. The user finishes the container creation from their dashboard, then re-runs this tool with the same website_url, which returns the container created there.

PERMISSIONS: for a signed-in user, creating a NEW container under an existing company requires admin permission on that company (insufficient_permissions, details.required_permission = "admin"); re-running for a website that already has a container under one of the user's companies returns that container when the user has view permission or higher on it (details.required_permission = "view" otherwise). In both denials, surface errors[0].message verbatim and stop.

MULTI-SERVER SESSIONS: in a session connected to several servers the returned next_action.args.server_name names the server this container was created on; pass the returned next_action back verbatim.

RECOVERY on rate_limited (HTTP 429): respect retry_after_seconds strictly. Never retry without backoff. If errors[0].details.key mentions domain:<host>, the cap is per-website-domain — a different email will NOT bypass it.

The MCP server does NOT generate idempotency keys — the agent MUST supply idempotency_key (UUID v7 recommended). Every response includes _request_id in structuredContent.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
goalNo
nameNo
emailNo
phoneNo
companyNo
dry_runNo
frameworkYes
auth_tokenNoSENSITIVE: existing-user path. JWT held by the agent in memory; passes to /mcp-api/v1/* as Authorization: Bearer.
heard_fromNo
website_urlYes
agent_clientYes
idempotency_keyYesUUID v7 recommended. Required.
event_source_systemNo
onboarding_session_idNo
onboarding_session_tokenNoSENSITIVE: required when onboarding_session_id is supplied and the session has no user yet.

Output Schema

TableJSON Schema
NameRequiredDescriptionDefault
dataNo
fieldNo
errorsNo
statusNo
detailsNo
warningsNo
rate_limitNo
_request_idNo
http_statusNo
next_actionNo

Schema Changelog

Changes observed during successful MCP inspections.

  1. First observed

TDQS

A4.8/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description takes the full burden and delivers: it discloses side effects (welcome email, account creation), security-sensitive JWT handling, 409/429 error behavior, idempotency-key requirements, and multi-server session behavior. It also warns that the server does not generate idempotency keys and that every response includes _request_id.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is long, but it is organized into labeled sections (PROACTIVE auth_token, RECOVERY, PERMISSIONS, MULTI-SERVER, rate limits) that make it scannable. Every section conveys load-bearing operational guidance; the length is justified by the tool's complexity, though a few points could be tightened.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 15-parameter, 4-required, no-annotation tool with output schema, the description is remarkably complete. It covers success paths, all major error classes with concrete recovery actions, permission requirements, rate-limit backoff, multi-server routing, and security constraints on token handling. An agent has enough context to call this correctly and recover from failures.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is only 20%, so the description must compensate, and it does for the most decision-critical parameters: auth_token, email, idempotency_key, website_url, and name. Some remaining parameters like dry_run, goal, phone, and company are left to their names/schema, but the description covers the non-obvious inter-parameter constraints well.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a precise verb-resource pair: 'Create/reuse an account and the first tracking container in one agent-safe call.' It clearly distinguishes fresh-email registration from authenticated reuse, and its naming of auth_token behavior separates it from sibling tools like get_container and list_containers.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives explicit when-to-use and when-not-to-use guidance: pass auth_token instead of email for signed-in users, never pass name/email alongside auth_token, and stop without calling other MCP tools on multi_client_ambiguous. It also names alternatives like account recovery URLs and outlines permissions prerequisites for container creation.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Try in Browser

Glama MCP Gateway

Add one secure layer between your agents and this server.

Resources