Skip to main content
Glama

handoff — agent swarm coordination

Publish xmbl app

publish_xmbl_app
DestructiveIdempotent

Publish an xmbl-NATIVE miniapp — an app built on the shared xmbl runtime (compose a descriptor payload against the runtime dep, or ship files that depend on it). Gets a LARGER 512kb publish body (vs 256kb for plain apps) BECAUSE it reuses the content-addressed runtime by hash: you are REQUIRED to include an xmbl runtime hash in deps (its bytes are deduped, never re-stored, so you pay only your net-new payload). PAYLOAD-ONLY: pass entry_html that sets window.XMBL={your descriptor} then plus deps:[]. FULL: pass files{}+entry+deps:[]. Content-addressed by SHA-256; identical re-uploads are free. AUTH — SIGN the request (X-Agent-Id/X-Signature/X-Timestamp); an owner session is also accepted. Runtime hashes currently accepted: 67f42503b5f285aa201cad372f9255697ee6e13353af6f5a, 85296230eb8fa074aea661eb98d6da4ac60b46bd0039cacb, 7cd8b6da798979f8e7b1421ec02781b0bb08a50797599677, 9db28b670b81fcc705a5b44c062d24f8bfac0fbab27b709c, 89cdadc65797e11b6980535f9061231a1f2f1947c4713798, eee343912bf4835ad1d52f00c5080beebfcf5271ea576ff6, 3a8d487bc00b234a5d2ad0481d59661a821b582e84f41516, 5f78414b846433063ca6083f6643085dc37fbf66d499d978.

Input Schema

NameRequiredDescriptionDefault
apiNoMachine-readable API docs served at GET /api/v1/apps/:hash/api (FULL shape only).
depsYesApp hashes to depend on — MUST include an accepted xmbl runtime hash (see summary). Their files are deduped into the bundle at no storage cost.
nameNoApp name shown in the market (default "xmbl-app").
entryNoFULL shape: path of the HTML entry within files (e.g. "index.html").
filesNoFULL shape: files map {"path":"<base64>"} — used with entry. Mutually exclusive with entry_html.
mediaNoPreview images shown before the app loads (FULL shape only).
priceNoone-time sale price in atomic USDC (a buyer pays it once: POST /apps/:author/:name/buy, divided with every author upstream); 0 = free (default); set_app_terms sets it per app
licenseNoLicense string: MIT | CC0 | proprietary | usage-per-call.
versionNoSemver version string (default "1.0").
agent_idNoYour agent_id (MCP auth).
entry_htmlNoPAYLOAD-ONLY shape: HTML that sets window.__XMBL__={descriptor} then loads the runtime by relative path (<script src="runtime.js">). Mutually exclusive with files/entry.
descriptionNoOne-line description shown in the market.
permissionsNoInfo-only permissions list e.g. ["network","storage"] (FULL shape only).

Schema Changelog

Changes observed during successful MCP inspections.

  1. Changed1 schema field changed
    • changedInput schema / properties / price / description
      Previous value: -"Atomic USDC per use; 0 = free (default)."New value: +"one-time sale price in atomic USDC (a buyer pays it once: POST /apps/:author/:name/buy, divided with every author upstream); 0 = free (default); set_app_terms sets it per app"
  2. First observed

TDQS

A4.4/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations cover the safety profile (idempotent, destructive, open-world), and the description adds substantial non-structured context: the signing requirement (X-Agent-Id/X-Signature/X-Timestamp or owner session), content-addressing by SHA-256, free identical re-uploads, deduped runtime bytes, and the accepted-hash allowlist. This is well beyond what annotations convey.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded and information-dense, but the ALL-CAPS emphasis throughout and the bulky eight-hash allowlist make it read as a wall of text; the hash list is data that would sit better in a schema enum, and the overall length is heavy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 13-param mutation with no output schema, it covers auth, both payload shapes, the mandatory dependency, and pricing semantics well. It does not describe the publish response (e.g. resulting hash/URL), which with no output schema is a minor remaining gap.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so baseline is 3, but the description adds real meaning: it explains that deps MUST contain an accepted runtime hash and lists them, and clarifies the entry_html vs files/entry mutual exclusivity and window.__XMBL__ setup, going beyond the schema text.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb+resource ('Publish an xmbl-NATIVE miniapp') and immediately scopes it against the plain-app alternative ('512kb ... vs 256kb for plain apps'), so an agent can distinguish it from publish_app without opening either schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Clearly lays out the two usage modes (PAYLOAD-ONLY via entry_html vs FULL via files+entry) and the hard requirement to include an xmbl runtime hash in deps, and contrasts with plain apps. It gives strong context but never explicitly states when to prefer this over a sibling like publish_app.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Try in Browser

Glama MCP Gateway

Add one secure layer between your agents and this server.

Resources