Skip to main content
Glama

Agent Broker

by io.github.basilalshukaili

mint_key

Agent self-serve API key issuance. An autonomous agent that has no email inbox can obtain a free-tier API key by proving it holds the MACHINE_MINT_SECRET via HMAC-SHA256. Returns a usable key immediately with no human action required.

EXAMPLE USER QUERIES THAT MATCH THIS TOOL: user: "I need an API key to call AgentBroker tools" -> call mint_key({"agent_id": "my-agent-abc123", "timestamp": 1725100000, "nonce": "4f8a2c1d", "signature": "<HMAC-SHA256(agent_id+timestamp+nonce, MACHINE_MINT_SECRET)>"})

WHEN TO USE: Use when an AI agent needs to self-provision a write-capable API key without a human email address. The caller must know the MACHINE_MINT_SECRET (available from hatchloop.dev/docs/#machine-mint). WHEN NOT TO USE: Do not use if the agent has a human operator who can complete the email flow at /keys/request. Do not use for paid plans — this endpoint issues free-tier keys (100 ops/day) only. COST: free - no key required LATENCY: ~100ms

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
nonceYesRandom value (UUID or hex). Prevents replay attacks — use a fresh nonce each call.
agent_idYesA stable unique identifier for this agent (e.g. a UUID). The issued key is deterministically tied to this ID.
signatureYesHMAC-SHA256(agent_id + str(timestamp) + nonce, MACHINE_MINT_SECRET) as lowercase hex. The HMAC input is the raw concatenation with no separators.
timestampYesUnix epoch seconds at signing time. Must be within 60s of server time.

TDQS

A4.7/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations are minimal and non-contradictory, but the description adds substantial behavioral context: the requirement to prove possession of MACHINE_MINT_SECRET, immediate issuance without human action, deterministic binding to agent_id, free-tier limit of 100 ops/day, cost, and latency. This goes well beyond what the structured annotation fields convey.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-organized with clear headings, an example query, and no redundant filler. Every sentence serves a purpose: explaining the use case, the proof requirement, when to use/avoid, and operational details like cost and latency. Despite containing a lot of information, it remains scannable and efficient.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a self-serve provisioning tool with no output schema, the description covers the essential completion criteria: what the caller needs, what they get back, constraints, and alternatives. It also includes practical operational details (free tier, rate limit, latency) that an agent would need to set expectations and decide correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, with each parameter already explained in detail including the HMAC-SHA256 construction and timestamp freshness. The description reinforces the HMAC mechanism and provides a sample call, but it does not add significant new semantic information beyond the schema. Baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb and resource: 'Agent self-serve API key issuance.' It clearly explains what the tool returns and the authentication mechanism. The example user query further illustrates the exact intent, and it is distinct from all sibling tools which concern calls, leads, compliance, and messaging.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description includes explicit WHEN TO USE and WHEN NOT TO USE sections. It names the exact alternative flow (human operator email flow at /keys/request), and excludes paid plans and cases where a human can complete the flow. This leaves little ambiguity for an agent deciding whether to invoke this tool.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

All Agent Broker toolsInspect
Try in Browser
RayrunBuild, deploy, and operate MCP servers without becoming an infrastructure team.ray.runAd

Glama MCP Gateway

Add one secure layer between your agents and this server.

TDQS

A4.5/5.0
Disambiguation5/5

Each tool has a clear, distinct purpose with detailed descriptions and explicit WHEN TO USE / WHEN NOT TO USE guidance. Potential overlaps like send_message vs. send_transactional_confirmation are well-differentiated by idempotency and use case, and compliance tools (check_compliance, screen_sanctions, map_trade_restriction) operate on different scopes without ambiguity.

Naming Consistency5/5

All tool names use lowercase snake_case and follow a consistent verb_noun pattern (call_business, check_quota, find_business, send_message, verify_company_record). Even less standard verbs like lookup, map, and mint follow the same structural convention, and there are no mixed casing styles or inconsistent naming patterns.

Tool Count4/5

With 23 tools, this is slightly above the typical 3-15 range, but the breadth of the server's purpose—covering communication, scheduling, compliance, trade screening, and operational utilities—justifies the count. Each tool addresses a distinct capability area, and the set is not bloated with redundant or trivial functions.

Completeness5/5

The tool surface covers the full lifecycle of the broker's domain: business discovery, booking (check, import, schedule), communication (send, receive, read), compliance (pre-flight checks, sanctions, trade restrictions, company verification), and operational support (quota, health, cost preview, key minting, async status/outcome). There are no obvious dead ends or missing critical operations for the stated purpose.

Resources