Skip to main content
Glama

mint_key

Mint a free-tier API key without email by signing agent_id + timestamp + nonce with the MACHINE_MINT_SECRET (HMAC-SHA256). Refused without that secret (invalid_request); not_configured if the operator has none set. No secret: use POST /keys/request. [free, no key] [limited]

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
nonceYesRandom value (UUID or hex). Prevents replay attacks — use a fresh nonce each…
agent_idYesA stable unique identifier for this agent (e.g. a UUID). The issued key is…
signatureYesHMAC-SHA256(agent_id + str(timestamp) + nonce, MACHINE_MINT_SECRET) as…
timestampYesUnix epoch seconds at signing time. Must be within 60s of server time.

Schema Changelog

Changes observed during successful MCP inspections.

  1. Changed3 schema fields changed
    • changedInput schema / properties / agent_id / description
      Previous value: -"A stable unique identifier for this agent (e.g. a UUID). The issued key is deterministically tied to this ID."New value: +"A stable unique identifier for this agent (e.g. a UUID). The issued key is…"
    • changedInput schema / properties / nonce / description
      Previous value: -"Random value (UUID or hex). Prevents replay attacks — use a fresh nonce each call."New value: +"Random value (UUID or hex). Prevents replay attacks — use a fresh nonce each…"
    • changedInput schema / properties / signature / description
      Previous value: -"HMAC-SHA256(agent_id + str(timestamp) + nonce, MACHINE_MINT_SECRET) as lowercase hex. The HMAC input is the raw concatenation with no separators."New value: +"HMAC-SHA256(agent_id + str(timestamp) + nonce, MACHINE_MINT_SECRET) as…"
  2. Changed1 schema field changed
    • changedInput schema / properties / nonce / description
      Previous value: -"Random value (UUID or hex). Prevents replay attacks — use a fresh nonce each call."New value: +"Random value (UUID or hex). Prevents replay attacks — use a fresh nonce each call."
  3. Changed1 schema field changed
    • changedInput schema / properties / nonce / description
      Previous value: -"Random value (UUID or hex). Prevents replay attacks — use a fresh nonce each call."New value: +"Random value (UUID or hex). Prevents replay attacks — use a fresh nonce each call."
  4. Added

TDQS

A4.3/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations only say it is a non-read-only, non-destructive, non-idempotent, closed-world write. The description adds substantial context beyond that: the required HMAC secret, the two named failure modes (invalid_request, not_configured), and the 60s freshness window implied by the timestamp parameter.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loads the core action and signing scheme, then tacks on refusal codes and the alternative endpoint. Dense and largely waste-free, though the bracketed tags ('[free, no key] [limited]') are cryptic filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a four-required-parameter mutation with no output schema, it covers auth requirements, failure cases, and the alternate path. It stops short of describing what the minted key response looks like, which is a minor gap given there is no output schema.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so each parameter is already documented in the schema. The description restates the signature construction but adds no format or constraint detail the schema lacks, so the baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('Mint a free-tier API key without email') and the exact mechanism (HMAC-SHA256 over agent_id + timestamp + nonce). No sibling tool does anything comparable, so the agent can place it immediately.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives a clear precondition (requires MACHINE_MINT_SECRET) and routes to an explicit alternative when the secret is absent ('No secret: use POST /keys/request'). It does not spell out the broader when-to-use case versus the other key/booking siblings, but the fallback routing is genuinely useful.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Try in Browser

Glama MCP Gateway

Add one secure layer between your agents and this server.