Skip to main content
Glama

Publish a new app

create_app

Publish new files as an app and get its URL back. Version 1 goes live at once, so show the person the content and the destination before calling this. Access defaults to org_link, which lets anyone signed in to the same organization open the link.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
nameYesWhat the app is called. Shown in listings.
slugNoThe readable part of the subdomain to publish at, 3 to 34 characters of a-z, 0-9 and single hyphens. Derived from the name when omitted. A random 5-character tag is always appended, so a name is never taken and two apps may share one.
typeNoThe badge on the row. Defaults to app.
filesYesFiles to publish as plain text, not base64: HTML, Markdown or JavaScript exporting default { fetch }. A page serves index.html at its URL. Functions declaring db include schema changes as migrations/NNNN_name.sql, run in order when the version goes live.
accessNoWho may open the link. Defaults to org_link.
messageNoWhat version 1 contains.
manifestNoOmit on create_app for a static page; omit on update_app to keep the previous version's manifest. If supplied, replaces the entire manifest: include every field still needed. services, secrets and env apply only to functions. Runtime details and limits: https://reachpad.dev/SKILL.md
validateNoCheck without writing. Validates and returns the resulting file set, total bytes, entry and kind. create_app also validates the slug and returns it with the URL; <tag> stands for five random characters assigned on publish. Does not check the org app limit; publishing can still fail for that.

Schema Changelog

Changes observed during successful MCP inspections.

  1. Changed8 schema fields changed
    • changedInput schema / properties / files / description
      Previous value: -"The files to publish. Content is plain text written here in the chat, not base64: an HTML page, a Markdown document, or a JavaScript module that exports default { fetch }. A page app serves index.html at the app URL. A function that declares the db service carries its schema changes here too, as migrations/NNNN_name.sql, which run in order when the version goes live."New value: +"Files to publish as plain text, not base64: HTML, Markdown or JavaScript exporting default { fetch }. A page serves index.html at its URL. Functions declaring db include schema changes as migrations/NNNN_name.sql, run in order when the version goes live."
    • changedInput schema / properties / manifest / description
      Previous value: -"How the version runs. Omit it on create_app for a static page, and omit it on update_app to keep the previous version's manifest. A manifest that is sent replaces the whole of it, so send every field the app still needs. services, secrets and env are read by a function only. The data plane in full, with its limits: https://reachpad.dev/SKILL.md"New value: +"Omit on create_app for a static page; omit on update_app to keep the previous version's manifest. If supplied, replaces the entire manifest: include every field still needed. services, secrets and env apply only to functions. Runtime details and limits: https://reachpad.dev/SKILL.md"
    • changedInput schema / properties / manifest / properties / entry / description
      Previous value: -"For a page, the file served at the root of the link, usually index.html. For a function, the module that exports default { fetch }. It has to be one of the files the version ends up with, which on a merge includes the ones carried over from the base."New value: +"Root file for a page, usually index.html; module exporting default { fetch } for a function. Must exist in the resulting files, including files retained by merge."
    • changedInput schema / properties / manifest / properties / env / description
      Previous value: -"Plain string values a function reads as env.NAME. Stored as written and readable by anyone who can read the version, so put a key in secrets instead. A name that is also in secrets fails the publish."New value: +"Plain strings bound as env.NAME, visible to anyone who can read the version. Put keys in secrets instead. Names shared with secrets fail publication."
    • changedInput schema / properties / manifest / properties / kind / description
      Previous value: -"page serves the files as they are. function runs one JavaScript module for every request to the link."New value: +"page serves files unchanged; function runs a JavaScript module for every request."
    • changedInput schema / properties / manifest / properties / secrets / description
      Previous value: -"Names of secrets the organization has already set, each bound as env.NAME. A function only. Set the value first, in Settings at reachpad.dev/apps/settings/secrets or with reachpad secrets set NAME: a name the organization has not set fails the publish with NAME is not set."New value: +"Organization secret names bound as env.NAME for functions. Set values first at reachpad.dev/apps/settings/secrets or with reachpad secrets set NAME. An unset name fails publication with NAME is not set."
    • changedInput schema / properties / manifest / properties / services / description
      Previous value: -"What the function may use, on env.reachpad: db is the app's own SQLite database, through env.reachpad.db.query(sql, params) and env.reachpad.db.batch(statements); files is its file store, through env.reachpad.files.put/get/head/delete. A function only, and any other name is refused when you publish. Declaring db also lets the version carry migrations/NNNN_name.sql, which run when it goes live."New value: +"Function services: db binds the app's SQLite database at env.reachpad.db.query(sql, params) and env.reachpad.db.batch(statements); files binds its file store at env.reachpad.files.put/get/head/delete. Other names are refused. db permits migrations/NNNN_name.sql, run when the version goes live."
    • changedInput schema / properties / validate / description
      Previous value: -"Check the call and write nothing. Answers with the file set the publish would contain, its total bytes, the entry and the kind, and on create_app the slug and the URL the app would take, where <tag> stands for the five random characters drawn when it is published. It checks the file set, its total size, that the entry file is one of the files, and on create_app that the slug is a usable link name. It does not check the org's app limit, so a create that would be refused for that is still refused when it is published."New value: +"Check without writing. Validates and returns the resulting file set, total bytes, entry and kind. create_app also validates the slug and returns it with the URL; <tag> stands for five random characters assigned on publish. Does not check the org app limit; publishing can still fail for that."
  2. Changed1 schema field changed
    • changedInput schema / properties / manifest / properties / secrets / description
      Previous value: -"Names of secrets the organization has already set, each bound as env.NAME. A function only. Set the value first, in Settings at reachpad.dev/apps/settings or with reachpad secrets set NAME: a name the organization has not set fails the publish with NAME is not set."New value: +"Names of secrets the organization has already set, each bound as env.NAME. A function only. Set the value first, in Settings at reachpad.dev/apps/settings/secrets or with reachpad secrets set NAME: a name the organization has not set fails the publish with NAME is not set."
  3. Changed1 schema field changed
    • changedInput schema / properties / validate / description
      Previous value: -"Check the call and write nothing. Answers with the file set the publish would contain, its total bytes, the entry and the kind. It checks the file set, its total size, and that the entry file is one of the files. It does not check the org's app limit or whether the slug is free, so a create that would be refused for one of those is still refused when it is published."New value: +"Check the call and write nothing. Answers with the file set the publish would contain, its total bytes, the entry and the kind, and on create_app the slug and the URL the app would take, where <tag> stands for the five random characters drawn when it is published. It checks the file set, its total size, that the entry file is one of the files, and on create_app that the slug is a usable link name. It does not check the org's app limit, so a create that would be refused for that is still refused when it is published."
  4. Changed8 schema fields changed
    • changedInput schema / properties / files / description
      Previous value: -"The files to publish. Content is plain text written here in the chat, not base64: an HTML page, a Markdown document, or a JavaScript module that exports default { fetch }. A page app serves index.html at the app URL."New value: +"The files to publish. Content is plain text written here in the chat, not base64: an HTML page, a Markdown document, or a JavaScript module that exports default { fetch }. A page app serves index.html at the app URL. A function that declares the db service carries its schema changes here too, as migrations/NNNN_name.sql, which run in order when the version goes live."
    • changedInput schema / properties / manifest / description
      Previous value: -"How the version runs. Omit it for a static page. kind is page or function, entry is the file served at / for a page or the module for a function."New value: +"How the version runs. Omit it on create_app for a static page, and omit it on update_app to keep the previous version's manifest. A manifest that is sent replaces the whole of it, so send every field the app still needs. services, secrets and env are read by a function only. The data plane in full, with its limits: https://reachpad.dev/SKILL.md"
    • addedInput schema / properties / manifest / properties / entry / description
      Added value: +"For a page, the file served at the root of the link, usually index.html. For a function, the module that exports default { fetch }. It has to be one of the files the version ends up with, which on a merge includes the ones carried over from the base."
    • changedInput schema / properties / manifest / properties / env / description
      Previous value: -"Plain string values readable by a function."New value: +"Plain string values a function reads as env.NAME. Stored as written and readable by anyone who can read the version, so put a key in secrets instead. A name that is also in secrets fails the publish."
    • addedInput schema / properties / manifest / properties / kind / description
      Added value: +"page serves the files as they are. function runs one JavaScript module for every request to the link."
    • addedInput schema / properties / manifest / properties / secrets / description
      Added value: +"Names of secrets the organization has already set, each bound as env.NAME. A function only. Set the value first, in Settings at reachpad.dev/apps/settings or with reachpad secrets set NAME: a name the organization has not set fails the publish with NAME is not set."
    • addedInput schema / properties / manifest / properties / services / description
      Added value: +"What the function may use, on env.reachpad: db is the app's own SQLite database, through env.reachpad.db.query(sql, params) and env.reachpad.db.batch(statements); files is its file store, through env.reachpad.files.put/get/head/delete. A function only, and any other name is refused when you publish. Declaring db also lets the version carry migrations/NNNN_name.sql, which run when it goes live."
    • addedInput schema / properties / manifest / properties / services / items / enum
      Added value: +[
      +  "db",
      +  "files"
      +]
  5. Changed1 schema field changed
    • changedInput schema / properties / validate / description
      Previous value: -"Check the call and write nothing. Answers with the file set the publish would contain, its total bytes, the entry and the kind. Nothing is published, so a version that would be refused is refused before it reaches the link."New value: +"Check the call and write nothing. Answers with the file set the publish would contain, its total bytes, the entry and the kind. It checks the file set, its total size, and that the entry file is one of the files. It does not check the org's app limit or whether the slug is free, so a create that would be refused for one of those is still refused when it is published."
  6. Changed1 schema field changed
    • addedInput schema / properties / validate
      Added value: +{
      +  "description": "Check the call and write nothing. Answers with the file set the publish would contain, its total bytes, the entry and the kind. Nothing is published, so a version that would be refused is refused before it reaches the link.",
      +  "type": "boolean"
      +}
  7. Changed1 schema field changed
    • changedInput schema / properties / slug / description
      Previous value: -"The subdomain to publish at, 3 to 40 characters of a-z, 0-9 and single hyphens. Derived from the name when omitted; a taken slug gets a numeric suffix."New value: +"The readable part of the subdomain to publish at, 3 to 34 characters of a-z, 0-9 and single hyphens. Derived from the name when omitted. A random 5-character tag is always appended, so a name is never taken and two apps may share one."
  8. Added

TDQS

A4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The annotations only say the tool is not read-only, not idempotent, and not destructive, so the description carries most of the side-effect burden. It discloses the important live-at-once behavior, the default org_link access, and the need to pre-confirm content and destination with the user, which goes beyond the annotations. It does not detail reversibility or failure limits, but the schema covers other conditional behaviors.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three sentences, each earning inclusion: immediate action, pre-confirmation caution, and access default. The most critical operatonal fact — that version 1 goes live and is not pending — is front-loaded.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the complex schema, the description does enough to call safely for a first publish: states the outcome, the immediate visibility, and access default. The validate parameter has a different return shape but that is fully documented in its own property description, so the header note is a reasonable omission and not a fatal gap.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Input schema coverage is 100%, so the baseline is 3. The description adds some semantic context about access ('lets anyone signed in to the same organization open the link') but does not meaningfully expand on the remaining parameters beyond the already rich schema descriptions.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb and resource: 'Publish new files as an app and get its URL back.' The phrase 'Version 1 goes live at once' distinguishes this creation flow from version updates, matching the title and separating it from sibling tools like update_app and publish_app_version.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It gives a clear precondition — 'show the person the content and destination before calling this' — which implies the user-facing review needed before an immediate public/org-visible publish. However, it does not explicitly say when to prefer update_app or publish_app_version over create_app, so the alternatives are only implied by context and the title.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Try in Browser

Glama MCP Gateway

Add one secure layer between your agents and this server.