Skip to main content
Glama

upload_skill_draft

Upload a skill without an API key (zero-friction). Returns a claim_token to track status. Perfect for agents contributing skills autonomously. / API 키 없이 Draft 모드로 스킬 업로드.

▶ 정책:
  - AI 검수(approved)만 수락, 그 외(caution/pending/rejected)는 즉시 삭제.
  - 결과는 sandbox tier + claim_status='draft'. 사람 owner 가 claim 해야 community/검증 경로 진입.
  - 동일 agent_author 의 모든 Draft 는 한 번의 이메일 인증으로 일괄 claim 됨.

▶ 에이전트 필수 동작(MANDATORY — 무시 시 반복 업로드/인증이 실패):
  (1) 최초 업로드 응답의 agent_identity.agent_secret 값을 반드시 저장하라.
      이후 같은 agent_author 로 업로드할 때 agent_secret 파라미터에 동일 값 전달.
      저장/재사용 안 하면 AGENT_SECRET_REQUIRED(401) 로 차단됨.
  (2) 응답의 claim_url, human_action.instruction, agent_identity 를
      사용자(사람)에게 그대로, 링크 형태로 표시하라 (요약·의역 금지).
  (3) 에이전트가 대신 claim 을 완료하려 하지 말 것. contact_email/verify 메일은
      반드시 사람 owner 의 실제 이메일이어야 함.
  (4) human_action_required=true 이면 사용자 응답을 기다려라 — 자동 재시도 금지.

Args:
    agent_author: 에이전트 식별자 (X-Agent-Author 헤더로 전송). 예: "claude-sonnet-4-6@anthropic".
                 같은 이름은 agent_secret 으로만 재사용 가능.
    skill_md: SKILL.md 전체 내용 문자열 (필수).
    files: {"main.py": "...", "util.py": "..."} 형태의 부가 파일 dict (선택).
    requirements: requirements.txt 내용 문자열 (선택).
    contact_email: 업로더 사람 owner 의 이메일 (선택, OPTIONAL).
                  ▶ **사용자 이메일을 모르면 반드시 비워두세요** — 추측·생성한 가짜 이메일은
                    DNS resolve 검증(NXDOMAIN 차단)으로 CONTACT_EMAIL_INVALID(400) 거부됩니다.
                  ▶ 비워두면 응답의 claim_url 을 사람 사용자에게 채팅으로 그대로 보여주면 됩니다
                    (forward_claim_url 시나리오, 권장).
                  ▶ 사용자가 명시적으로 알려준 실제 이메일이 있을 때만 지정. 지정 시 서버가
                    verify 링크를 자동 발송 (24시간 만료, 미인증 시 72시간마다 최대 3회 reminder).
                  ▶ 한 번만 지정하면 되며 이후 업로드엔 불필요. verify 링크를 사람이 클릭하면
                    해당 agent_author 의 모든 Draft 가 그 계정으로 일괄 이전.
    agent_secret: 최초 업로드에서 발급된 secret (2회차 이후 필수).
    claim_token: 같은 Draft 에 새 버전을 추가할 때만 (선택).

Returns:
    업로드 결과 + agent_identity + human_action_required + human_action + claim_url 요약.
    사용자에게 claim_url 과 instruction 을 반드시 surface 하라.

Input Schema

NameRequiredDescriptionDefault
filesNoExtra text files as an object mapping file name to file content, e.g. {"main.py": "print(1)", "util.py": "..."}.
skill_mdYesFull SKILL.md file content as a string, including the YAML front matter.
claim_tokenNoclaim_token of an existing draft, only when adding a new version to that same draft. Omit for a brand-new skill.
agent_authorYesStable agent identifier sent as the X-Agent-Author header, e.g. 'claude-sonnet-4-6@anthropic'. The same name can only be reused together with its agent_secret.
agent_secretNoSecret issued in agent_identity.agent_secret of the first upload response. Required on every later upload with the same agent_author.
requirementsNoContents of requirements.txt as a string, e.g. 'requests==2.31.0'.
contact_emailNoReal email address of the human owner, e.g. owner@example.com. Leave empty if unknown; never guess or invent an address (invalid domains are rejected with CONTACT_EMAIL_INVALID).

Output Schema

NameRequiredDescriptionDefault
resultYes

Schema Changelog

Changes observed during successful MCP inspections.

  1. Changed7 schema fields changed
    • addedInput schema / properties / agent_author / description
      Added value: +"Stable agent identifier sent as the X-Agent-Author header, e.g. 'claude-sonnet-4-6@anthropic'. The same name can only be reused together with its agent_secret."
    • addedInput schema / properties / agent_secret / description
      Added value: +"Secret issued in agent_identity.agent_secret of the first upload response. Required on every later upload with the same agent_author."
    • addedInput schema / properties / claim_token / description
      Added value: +"claim_token of an existing draft, only when adding a new version to that same draft. Omit for a brand-new skill."
    • addedInput schema / properties / contact_email / description
      Added value: +"Real email address of the human owner, e.g. owner@example.com. Leave empty if unknown; never guess or invent an address (invalid domains are rejected with CONTACT_EMAIL_INVALID)."
    • addedInput schema / properties / files / description
      Added value: +"Extra text files as an object mapping file name to file content, e.g. {\"main.py\": \"print(1)\", \"util.py\": \"...\"}."
    • addedInput schema / properties / requirements / description
      Added value: +"Contents of requirements.txt as a string, e.g. 'requests==2.31.0'."
    • addedInput schema / properties / skill_md / description
      Added value: +"Full SKILL.md file content as a string, including the YAML front matter."
  2. Added

TDQS

A4.4/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Goes far beyond the annotations: discloses that only AI-approved submissions are kept and caution/pending/rejected are immediately deleted, that results land in sandbox tier with claim_status='draft', and that a human owner must claim it to enter the community path. It also surfaces concrete failure modes and codes (AGENT_SECRET_REQUIRED 401, CONTACT_EMAIL_INVALID 400 with DNS/NXDOMAIN checks) plus email expiry/reminder cadence (24h expiry, up to 3 reminders every 72h). The immediate-deletion policy is not contradicted by destructiveHint=false, since it applies to the just-submitted payload rather than pre-existing data.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Well structured with ▶ sections and a front-loaded one-line purpose, but the same content is duplicated in English and Korean, and the trailing 'Args:' and 'Returns:' blocks largely restate what the 100%-covered schema and output schema already say. The MANDATORY list is genuinely load-bearing, but the overall length is roughly double what an agent needs.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a zero-auth write tool with a human-in-the-loop handoff, everything an agent needs is present: credential lifecycle, rejection policy, error codes, claim flow, and the instruction to surface claim_url/instruction verbatim rather than paraphrasing. An output schema exists, and the description correctly does not attempt to enumerate return fields beyond naming the key ones.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline is 3; the description earns above that by adding lifecycle meaning the schema cannot convey — agent_secret must be persisted from the first response and reused on every later upload with the same agent_author, and one verify click bulk-claims all drafts for that author. It also explains why contact_email should stay empty (forwarding claim_url to the human is the recommended path). Minor redundancy with the schema's own field descriptions keeps it from a 5.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

Opens with a specific verb+resource plus its differentiator: 'Upload a skill without an API key (zero-friction)' and 'Draft 모드로 스킬 업로드', which separates it from the authenticated `upload_skill` sibling. The draft/sandbox end-state and claim_token return are stated up front. It never names `upload_skill` or `check_draft_status` explicitly, so the sibling contrast is inferred rather than spelled out.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives explicit when/when-not rules: leave contact_email empty if the user's email is unknown (forward_claim_url scenario, '권장'), only set it when the user explicitly provided a real address, use claim_token only when adding a version to an existing draft, and use agent_secret from the second upload onward. It also states what NOT to do ('에이전트가 대신 claim 을 완료하려 하지 말 것', '자동 재시도 금지'), which is the strongest form of usage guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Try in Browser

Glama MCP Gateway

Add one secure layer between your agents and this server.

Resources