Skip to main content
Glama

create_session

Create a new phone verification session. Returns deep_link, qr_code (base64 PNG), and qr_text (UTF-8 text QR for terminal display). Sessions provide a hosted verification flow with callbacks.

Agent usage: After creating a session, pass the response's deep_link to render_auth_link so the user can open or scan it. Never hand qr_text to a link renderer — it is that link already rendered as QR art. Print it verbatim inside a fenced code block only when a real terminal needs the QR. Then use wait_for_session to poll until the session reaches a terminal state (verified, failed, or expired).

The user does not see tool results — most clients fold them away, render_auth_link's output included. Before you wait or poll, put what the user must act on into your own reply text: the link itself (not a sentence announcing it), the SMS text and number, or a note to check their inbox.

ACCESS: needs a Proof account. Authenticate this client (Claude Code: /mcp → Authenticate), then call this tool again. start_login does NOT open this tool.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
channelYesVerification channel
metadataNoCustom key-value metadata
template_idNoCustom template ID
callback_urlNoURL to redirect after verification
phone_numberYesPhone number in E.164 format
external_user_idNoYour application user ID

Schema Changelog

Changes observed during successful MCP inspections.

  1. First observed

TDQS

A4.4/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations only cover the mutation safety profile (readOnlyHint=false, destructiveHint=false), and the description goes well beyond that: it enumerates the three return artifacts, defines the terminal states (verified, failed, expired), and warns that clients fold tool results away so the agent must surface the link/text in its own reply. It also discloses the authentication prerequisite and that start_login does not cover this tool.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Purpose and return values are front-loaded, and the workflow guidance is actionable rather than filler. It runs to four paragraphs and the "user does not see tool results" note is a general client-behavior aside that is slightly tangential to this specific tool, but nearly every sentence earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema, the description carries the full burden of explaining returns and does so concretely (deep_link, qr_code as base64 PNG, qr_text as terminal-display QR art). Combined with the auth requirement, the downstream wait/poll path, and terminal states, an agent has everything needed to create and follow through on a session.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100% and each parameter (channel, phone_number, metadata, template_id, callback_url, external_user_id) is documented in the schema itself. The description adds no parameter-level meaning such as format hints, defaults, or interactions, so the baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ("Create a new phone verification session") and adds scope context ("hosted verification flow with callbacks"), which helps separate it from plain create_verification. However, it never explicitly distinguishes itself from close siblings like create_verification, create_multi_channel_verification, or create_verification_request, leaving that inference to the agent.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives an explicit ordered workflow: pass deep_link to render_auth_link, then use wait_for_session to poll to a terminal state. It also states a clear when-not rule ("Never hand qr_text to a link renderer") and names the alternative tools by name, so selection and sequencing require no inference.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Try in Browser

Glama MCP Gateway

Add one secure layer between your agents and this server.