Skip to main content
Glama

create_share_link

Destructive

Create, change or revoke a report's share link — the link on the report's Share panel. "create" makes the link (or keeps the one it has) and applies any settings given; "update" changes the existing link; "revoke" deletes it so its URL stops working for good (a later create gives a new URL; on a report with an active e-mail schedule, the next scheduled send creates a new link, and the preview says so). Settings: enabled (false keeps the link but viewers see "not available"), password (sets or replaces one; null removes it; stored hashed, never returned or shown), allowDateChange (true lets viewers pick other periods, so they see data beyond the report's own range). ANYONE WITH THE LINK can open the report — every widget and its live numbers, and the saved AI summaries — after entering the password if one is set. A report in Deleted cannot be shared. Returns the share URL, on the workspace's verified custom domain when there is one. It does not e-mail the link (send_report does) and does not change the report. Requires MCP write actions; without confirm:true it returns a preview of what becomes public and changes nothing.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
actionYescreate (or keep) the link, update its settings, or revoke it.
confirmNoSet true to apply. Omit for a preview. With confirm:true, also pass the preview's previewToken.
enabledNoWhether the link opens the report.
passwordNoSet a password viewers must enter; null removes it. Never echoed back.
reportIdYesReport id (from list_reports).
previewTokenNoWith confirm:true: the previewToken from this tool's preview (valid 15 minutes, once, for exactly the previewed arguments).
allowDateChangeNoLet viewers switch the report's period.

Schema Changelog

Changes observed during successful MCP inspections.

  1. First observed

TDQS

A4.8/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Goes well beyond the annotations (destructiveHint=true, readOnlyHint=false): it discloses that revoke permanently kills the URL and that a later create yields a new one, that an active e-mail schedule auto-regenerates a link, that anyone with the link sees all widgets/live numbers/AI summaries, that passwords are stored hashed and never returned, that Deleted reports cannot be shared, and that write actions require confirm:true or only a preview is returned.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loads the action semantics, then settings, then security/return behavior in a logical order with no filler sentences. It is dense and long, but nearly every clause carries actionable information; a slight trim would still be possible.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema, the description compensates by stating the return value ('Returns the share URL, on the workspace's verified custom domain when there is one') and by covering permissions, side effects, and the preview/confirm protocol. Nothing essential for correct invocation is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so baseline is 3. The description nonetheless adds effect-level meaning: enabled=false keeps the link but shows 'not available', password null removes it and is stored hashed, allowDateChange exposes data beyond the report's own range, and confirm/previewToken govern the preview-then-apply flow.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb set (create/update/revoke) on a specific resource (a report's share link, anchored to the Share panel). It explicitly distinguishes itself from siblings: 'It does not e-mail the link (send_report does) and does not change the report.'

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explains exactly what each of the three actions does and when each applies (create vs update vs revoke), names the alternative tool for e-mailing, and states the confirm/preview precondition. An agent knows both when and when-not to call it.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Try in Browser

Glama MCP Gateway

Add one secure layer between your agents and this server.

Resources