Skip to main content
Glama

Publish a lambda's source code

open_source
DestructiveIdempotent

Publish a lambda's source code at /source/{publicKey} for anybody to read, star and download as a .NET project, change the license it is published under, or take it down. What is published is the program and what is written about it - every version's code, resources, documentation and tests, and the history of what each changed - never its data: not the database, not the workspace, not a secret's value. Not part of building: only do this when the user asks for it, and ask which license if they did not say (MIT unless they want another). With only privateKey it returns whether it is published. Once published, everything in every version is public, older ones included: keep keys, passwords and personal data out of the files - in secrets and the database.

Tool call template

Replace each placeholder with a value matching the input schema. Only required parameters are included; add optional parameters as needed.

{
  "id": 1,
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "arguments": {
      "privateKey": "<privateKey>"
    },
    "name": "open_source"
  }
}

Input Schema

NameRequiredDescriptionDefault
authorNoWho holds the copyright, as the license names them - the user's name or organization, only if they gave it. Left out, it stays as it is; empty, the license names 'the authors of' the lambda.
removeNoTake the source down instead. Its stars are kept for when it is published again.
licenseNoThe SPDX identifier of the license: MIT, Apache-2.0, BSD-3-Clause, MPL-2.0, GPL-3.0-or-later, AGPL-3.0-or-later or Unlicense. Left out, it stays as it is - MIT when first published.
privateKeyYesThe editor key.

Schema Changelog

Changes observed during successful MCP inspections.

  1. Changed4 schema fields changed
    • changedInput schema / properties / author / description
      Previous value: -"Who holds the copyright, as the license names them - the user's name or organization, only if they gave it. Left out, it stays as it is; empty, the license names 'the authors of' the lambda. Up to 100 characters."New value: +"Who holds the copyright, as the license names them - the user's name or organization, only if they gave it. Left out, it stays as it is; empty, the license names 'the authors of' the lambda."
    • addedInput schema / properties / author / maxLength
      Added value: +100
    • changedInput schema / properties / license / description
      Previous value: -"The SPDX identifier of the license: MIT, Apache-2.0, BSD-3-Clause, MPL-2.0, GPL-3.0-or-later, AGPL-3.0-or-later, Unlicense. Left out, it stays as it is - MIT when first published."New value: +"The SPDX identifier of the license: MIT, Apache-2.0, BSD-3-Clause, MPL-2.0, GPL-3.0-or-later, AGPL-3.0-or-later or Unlicense. Left out, it stays as it is - MIT when first published."
    • addedInput schema / properties / remove / default
      Added value: +false
  2. Added

TDQS

A4.8/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already flag destructiveHint=true and idempotentHint=true, but the description goes well beyond them: it discloses the precise blast radius ('every version's code, resources, documentation and tests, and the history'), what is explicitly NOT published (database, workspace, secret values), that previously-private historical versions become public, and that removal preserves stars. That's exactly the context an agent needs before triggering an irreversible disclosure.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded with the action and destination, and every sentence carries unique information — the data exclusion, the opt-in rule, the license question, the status mode, and the privacy warning. It is dense and tightly packed into one paragraph, which costs a little scannability, but there is essentially no filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

No output schema exists, and the description compensates by specifying the privateKey-only return ('whether it is published'). Combined with the publicity warning about keys, passwords and personal data, an agent has everything needed to call this safely and correctly, including the consequence of the destructive path.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline is 3, but the description adds meaning the schema does not: the license default (MIT on first publish), the author fallback ('the authors of' the lambda), and the privateKey-only status-query mode. It does not re-explain remove/author syntax, which the schema already handles well.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('Publish a lambda's source code') plus the exact destination path '/source/{publicKey}', and immediately enumerates the accompanying actions (star, download as .NET project, change license, take down). No sibling tool in the list publishes source, so there's no ambiguity with deploy, showcase or read_lambda.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicit when-to-use and when-not-to: 'Not part of building: only do this when the user asks for it, and ask which license if they did not say (MIT unless they want another).' It also defines a distinct invocation mode ('With only privateKey it returns whether it is published'), which tells the agent this tool doubles as a status check.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Try in Browser

Glama MCP Gateway

Add one secure layer between your agents and this server.