Skip to main content
Glama

upload_create

Create a temporary file upload URL for sandboxed environments. Returns a key, an upload_url, a browser_url, expires_in (seconds), and instructions. Automatic flow: (1) call this tool, (2) POST the file as multipart/form-data in a field named file to the returned upload_url (valid for expires_in seconds), which responds with {"url": "https://..."}, (3) pass that returned url in the media array of post_publish (or post_update). The upload host is tmpfiles.postproxy.dev — that domain must be whitelisted/allowlisted in the sandbox's network egress rules for the upload to succeed. Browser fallback: if you cannot make outbound HTTP requests to that host, cannot access the file bytes, or the automatic upload fails, do not keep retrying — give the user browser_url as a clickable link, ask them to upload the file there in their browser and paste the resulting public media URL back into the conversation, then use that URL in the media array. Only use this when running against the remote (hosted) MCP server: if you are running the local (stdio) MCP server, do NOT use this — instead pass local file paths directly in the media array, which uploads them via multipart.

Input Schema

NameRequiredDescriptionDefault

No arguments

Schema Changelog

Changes observed during successful MCP inspections.

  1. First observed

TDQS

A4.4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=false, openWorldHint=true, idempotentHint=false and destructiveHint=false, so the agent knows this is a non-idempotent, network-touching write. The description adds genuinely useful context beyond that: URL expiry in seconds, the required egress allowlist for tmpfiles.postproxy.dev, and a no-retry policy. However, it doesn't clarify idempotency (does re-calling mint a new key or reuse one?) or what happens to an unexpired key, which would round out the behavioral profile; a 3 reflects solid added context on top of already-decent annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The purpose and numbered flow are front-loaded, and the fallback and environment caveats follow in logical order. It is long, but nearly every clause is actionable (field name, domain, expiry, fallback); minor tightening of the repeated media-array instruction is possible but doesn't impair readability.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema, the description carries the return-value burden and does so precisely, including the response body format of the upload POST. The environment split, allowlist prerequisite, expiry, and fallback cover everything an agent needs to call this correctly end-to-end.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

There are zero input parameters, so the schema needs no elaboration and the baseline is 4. The description goes further by documenting the return payload (key, upload_url, browser_url, expires_in, instructions) and the exact multipart field name 'file', which compensates for the absent output schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource: 'Create a temporary file upload URL for sandboxed environments.' It explicitly positions itself against siblings by naming post_publish and post_update as the consumers of the returned URL, so an agent can place it in the workflow without opening a schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It gives explicit when-to-use (remote hosted server) and when-NOT-to-use (local stdio server — pass local file paths instead), plus a concrete fallback procedure and a 'do not keep retrying' exclusion. The alternative path is named rather than implied.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Try in Browser

Glama MCP Gateway

Add one secure layer between your agents and this server.