Control Plane

Create a Domain

create_domain

Put a domain in front of a workload: pass domain, workload, and gvc, and the 443 listener, its route, and cname mode are derived; the result lists the DNS records the user must add, and the same call with waitSeconds reports when it is ready (an existing domain gets the route added). For a custom setup (other listeners, ns delegation, gvcLink, several routes) pass dnsMode and ports instead; a port item is {number, protocol}, a route needs workloadLink and matches / without prefix.

Input Schema

Name	Required	Description
`gvc`	No	The workload's GVC.
`org`	No	Organization slug.
`tags`	No	Optional tags; they behave like Kubernetes labels. Special behavior-changing tags: cpln/routeLimitOverride (raises the per-port route cap to 200), cpln/skipDNSCheck, cpln/wildcard (wildcard certificate).
`ports`	No	Listener list; derived with workload, required otherwise. Each listener needs number and protocol; cors, routes, and tls are optional.
`domain`	Yes	Fully qualified domain name such as example.com or api.example.com.
`prefix`	No	Path prefix the derived route matches (default "/"). With workload only.
`dnsMode`	No	DNS delegation mode; derived (cname) with workload. cname works for an apex (example.com) and subdomains; ns delegates a subdomain zone to Control Plane and is rejected on an apex.
`gvcLink`	No	Optional GVC link (full or shorthand //gvc/{name}). Each workload in the GVC gets a {workload}.{domain} subdomain. Mutually exclusive with workloadLink.
`workload`	No	Route the domain to this workload (with gvc): the 443 listener, its route, and dnsMode cname are derived.
`description`	No	Domain description so operators understand the purpose (treat it like a concise annotation).
`waitSeconds`	No	Seconds to wait on the server until the domain is ready, 0 to 45. The call returns as soon as it is, or with the latest state when the time runs out. Use this instead of calling again and again.
`workloadLink`	No	Optional workload link (e.g. //gvc/{gvc}/workload/{name}) to bind the ENTIRE domain to one workload — STATEFUL workloads only (the platform rejects serverless/standard here). For those, target the workload with ports[].routes instead. Mutually exclusive with gvcLink.
`acceptAllHosts`	No	Accept any host header (defaults to false).
`certChallengeType`	No	Certificate challenge type (http01 or dns01). Optional — omit for the platform default, and MUST be omitted for .internal domains (the platform rejects it there).
`acceptAllSubdomains`	No	Accept any subdomain (defaults to false).

Output Schema

Name	Required	Description
`ok`	Yes
`data`	No	The full result. Read this, not only the summary.
`details`	No
`summary`	Yes
`nextSteps`	No

Schema Changelog

Changes observed during successful MCP inspections.

Changed3 schema fields changedOct 22, 2026

changedInput schema / properties / ports / items / properties / routes / items / description

Previous value: -"Route definition that maps listener traffic to a workload. Minimal valid route: { \"workloadLink\": \"//gvc/{gvc}/workload/{name}\" }. All matchers are optional; omit prefix/regex to match /."New value: +"Route definition that maps listener traffic to a workload. Minimal valid route: { \"workloadLink\": \"//gvc/{gvc}/workload/{name}\" }. All matchers are optional; omit prefix/regex to match /. Canaries split traffic by weight."

addedInput schema / properties / ports / items / properties / routes / items / properties / canaries

Added value: +{
+  "description": "Optional traffic split by weight to more workloads: weights total at most 100 and the rest goes to workloadLink; a canary not deployed in a location is dropped there.",
+  "items": {
+    "properties": {
+      "port": {
+        "description": "Optional workload port; omit for the workload's first port.",
+        "maximum": 65535,
+        "minimum": 80,
+        "type": "integer"
+      },
+      "weight": {
+        "description": "Percent of the route's traffic; 0 disables the canary.",
+        "maximum": 100,
+        "minimum": 0,
+        "type": "integer"
+      },
+      "workloadLink": {
+        "description": "Required workload target link, e.g. //gvc/{gvc}/workload/{name} or /org/{org}/gvc/{gvc}/workload/{name}.",
+        "type": "string"
+      }
+    },
+    "required": [
+      "workloadLink",
+      "weight"
+    ],
+    "type": "object"
+  },
+  "type": "array"
+}

addedInput schema / properties / ports / items / properties / routes / items / properties / mirror

Added value: +{
+  "description": "Optional traffic mirroring targets for shadow testing; only workloadLink answers. Shape: [{workloadLink, percent 0 to 100, port (optional)}].",
+  "items": {
+    "type": "object"
+  },
+  "type": "array"
+}

Changed1 schema field changedOct 1, 2026

addedInput schema / properties / ports / items / properties / routes / items / properties / caseInsensitive

Added value: +{
+  "description": "Optional. When true, prefix matches the path regardless of case. Prefix only; for a case-insensitive regex start it with (?i).",
+  "type": "boolean"
+}

Changed45 schema fields changedSep 30, 2026
- removedInput schema / $schema
```
Removed value: -"http://json-schema.org/draft-07/schema#"
```
- removedInput schema / additionalProperties
```
Removed value: -false
```
- removedInput schema / properties / description / maxLength
```
Removed value: -250
```
- changedInput schema / properties / dnsMode / description
```
Previous value: -"DNS delegation mode. cname — REQUIRED for apex domains (example.com) and the common choice for a single subdomain. ns — subdomains ONLY (delegates that subdomain zone to Control Plane); the platform rejects ns on an apex."New value: +"DNS delegation mode; derived (cname) with workload. cname works for an apex (example.com) and subdomains; ns delegates a subdomain zone to Control Plane and is rejected on an apex."
```
- removedInput schema / properties / domain / maxLength
```
Removed value: -253
```
- removedInput schema / properties / domain / minLength
```
Removed value: -1
```
- addedInput schema / properties / gvc
```
Added value: +{
+  "description": "The workload's GVC.",
+  "type": "string"
+}
```
- changedInput schema / properties / org / description
```
Previous value: -"Organization slug (lowercase kebab-case). NEVER guess — if the user has not named one, ask. On org-not-found, stop and ask; do not retry variants."New value: +"Organization slug."
```
- removedInput schema / properties / org / maxLength
```
Removed value: -63
```
- removedInput schema / properties / org / minLength
```
Removed value: -1
```
- removedInput schema / properties / org / pattern
```
Removed value: -"^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$"
```
- changedInput schema / properties / ports / description
```
Previous value: -"Required listener list. Each listener minimally needs number and protocol; cors, routes, and tls are optional nested blocks."New value: +"Listener list; derived with workload, required otherwise. Each listener needs number and protocol; cors, routes, and tls are optional."
```
- removedInput schema / properties / ports / items / additionalProperties
```
Removed value: -false
```
- removedInput schema / properties / ports / items / properties / cors / additionalProperties
```
Removed value: -false
```
- removedInput schema / properties / ports / items / properties / cors / properties / allowOrigins / items / additionalProperties
```
Removed value: -false
```
- removedInput schema / properties / ports / items / properties / cors / properties / maxAge / pattern
```
Removed value: -"^[\\d\\.]+[hms]+$"
```
- removedInput schema / properties / ports / items / properties / routes / items / additionalProperties
```
Removed value: -false
```
- removedInput schema / properties / ports / items / properties / routes / items / properties / headers / additionalProperties
```
Removed value: -false
```
- removedInput schema / properties / ports / items / properties / routes / items / properties / headers / properties / request / additionalProperties
```
Removed value: -false
```
- removedInput schema / properties / ports / items / properties / routes / items / properties / hostPrefix / pattern
```
Removed value: -"^[0-9a-zA-Z-\\._]*$"
```
- removedInput schema / properties / ports / items / properties / routes / items / properties / prefix / pattern
```
Removed value: -"^\\/[0-9a-zA-Z-\\._~\\/]*$"
```
- removedInput schema / properties / ports / items / properties / routes / items / properties / replacePrefix / pattern
```
Removed value: -"^\\/[0-9a-zA-Z-\\._~\\/]*$"
```
- removedInput schema / properties / ports / items / properties / routes / items / properties / workloadLink / minLength
```
Removed value: -1
```
- removedInput schema / properties / ports / items / properties / routes / maxItems
```
Removed value: -200
```
- removedInput schema / properties / ports / items / properties / tls / additionalProperties
```
Removed value: -false
```
- removedInput schema / properties / ports / items / properties / tls / properties / clientCertificate / additionalProperties
```
Removed value: -false
```
- removedInput schema / properties / ports / items / properties / tls / properties / clientCertificate / properties / secretLink / minLength
```
Removed value: -1
```
- removedInput schema / properties / ports / items / properties / tls / properties / serverCertificate / additionalProperties
```
Removed value: -false
```
- removedInput schema / properties / ports / items / properties / tls / properties / serverCertificate / properties / secretLink / minLength
```
Removed value: -1
```
- removedInput schema / properties / ports / maxItems
```
Removed value: -10
```
- removedInput schema / properties / ports / minItems
```
Removed value: -1
```
- addedInput schema / properties / prefix
```
Added value: +{
+  "description": "Path prefix the derived route matches (default \"/\"). With workload only.",
+  "type": "string"
+}
```
- removedInput schema / properties / tags / items / additionalProperties
```
Removed value: -false
```
- removedInput schema / properties / tags / items / properties / key / minLength
```
Removed value: -1
```
- removedInput schema / properties / tags / maxItems
```
Removed value: -50
```
- addedInput schema / properties / waitSeconds
```
Added value: +{
+  "description": "Seconds to wait on the server until the domain is ready, 0 to 45. The call returns as soon as it is, or with the latest state when the time runs out. Use this instead of calling again and again.",
+  "maximum": 45,
+  "minimum": 0,
+  "type": "integer"
+}
```
- addedInput schema / properties / workload
```
Added value: +{
+  "description": "Route the domain to this workload (with gvc): the 443 listener, its route, and dnsMode cname are derived.",
+  "type": "string"
+}
```
- changedInput schema / required
```
Previous value: -[
-  "org",
-  "domain",
-  "dnsMode",
-  "ports"
-]New value: +[
+  "domain"
+]
```
- removedOutput schema / $schema
```
Removed value: -"http://json-schema.org/draft-07/schema#"
```
- removedOutput schema / additionalProperties
```
Removed value: -false
```
- changedOutput schema / properties / data / description
```
Previous value: -"The full machine-readable result — list rows, the resource object, query results. Read THIS, not just the summary."New value: +"The full result. Read this, not only the summary."
```
- addedOutput schema / properties / details
```
Added value: +{
+  "type": "string"
+}
```
- removedOutput schema / properties / nextSteps / description
```
Removed value: -"Recommended follow-up actions for this task, in order."
```
- removedOutput schema / properties / ok / description
```
Removed value: -"Whether the call succeeded."
```
- removedOutput schema / properties / summary / description
```
Removed value: -"One-line summary of the result."
```
First observedJun 28, 2026

TDQS

A4.3/5.0

Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare non-read-only, non-destructive and open-world, so the safety profile is covered. The description adds real context beyond that: the result lists DNS records the user must add, waitSeconds makes the call block until ready, and calling against an existing domain adds the route rather than failing.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded with the common path and only then the escape hatch to custom configuration; every clause carries information. It is dense — the second sentence packs dnsMode, ports, port item shape and route matching into one line — but nothing is wasted.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 15-parameter creation tool with an output schema and exhaustive field documentation, the description covers the two dominant call patterns and the readiness semantics. Specialty paths (tags like cpln/wildcard, TLS and CORS on ports) are left to the schema, which documents them fully.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so baseline is 3, but the description adds derivation logic the schema cannot express — that workload+gvc derives the 443 listener, its route and cname mode, and that a route without prefix matches /. This meaningfully shifts which parameters an agent needs to supply.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('Put a domain in front of a workload') and immediately names the three parameters that drive the simple path. It also clarifies the upsert-like behavior on an existing domain, which an agent could not infer from the name alone.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly splits the simple case (domain + workload + gvc) from the custom case (dnsMode and ports for ns delegation, gvcLink, multiple routes), which is exactly the branching decision an agent faces. It does not reference the update_domain sibling, so the choice between creating and updating an existing domain is only implied.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

All Control Plane tools Inspect

Try in Browser

One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

Glama MCP Gateway

Add one secure layer between your agents and this server.