Skip to main content
Glama

BotSpot: AI Trading, Backtests and Bots

Create saved broker credential

create_broker_credential

Stores broker credential material in Vault and returns only metadata for the authenticated user. Values are encrypted at rest and are not returned to MCP. Use this for broker login/trading credentials only. Do not add a brokerCredentialId to a deployment by default; let the user choose on the approval page unless they explicitly named the exact saved broker connection/account. The broker field controls validation for known Lumibot/BotSpot brokers; use the exact environment variable key names below. Alpaca (alpaca): ALPACA_API_KEY + ALPACA_API_SECRET OR ALPACA_OAUTH_TOKEN. Do not pass ALPACA_IS_PAPER; BotSpot derives it from paperOrLive. Example credentialValues: {"ALPACA_API_KEY":"PK...","ALPACA_API_SECRET":"secret..."}. Tradier (tradier): TRADIER_ACCOUNT_NUMBER + TRADIER_ACCESS_TOKEN OR TRADIER_ACCOUNT_NUMBER + TRADIER_API_KEY OR TRADIER_ACCOUNT_NUMBER + TRADIER_TOKEN. Optional: TRADIER_REFRESH_TOKEN, TRADIER_OAUTH_CLIENT_ID, TRADIER_OAUTH_CLIENT_SECRET. Do not pass TRADIER_IS_PAPER; BotSpot derives it from paperOrLive. Example credentialValues: {"TRADIER_ACCOUNT_NUMBER":"6AB12345","TRADIER_ACCESS_TOKEN":"token..."}. Charles Schwab (schwab): SCHWAB_ACCOUNT_NUMBER + SCHWAB_TOKEN. Example credentialValues: {"SCHWAB_ACCOUNT_NUMBER":"123456789","SCHWAB_TOKEN":"base64url-token-payload..."}. Tradovate (tradovate): TRADOVATE_USERNAME + TRADOVATE_DEDICATED_PASSWORD + TRADOVATE_CID + TRADOVATE_SECRET. Optional: TRADOVATE_APP_ID, TRADOVATE_APP_VERSION. Do not pass TRADOVATE_IS_PAPER; BotSpot derives it from paperOrLive. Example credentialValues: {"TRADOVATE_USERNAME":"username...","TRADOVATE_DEDICATED_PASSWORD":"dedicated-password...","TRADOVATE_CID":"client-id...","TRADOVATE_SECRET":"secret..."}. TopstepX (projectx-topstepx): PROJECTX_TOPSTEPX_API_KEY + PROJECTX_TOPSTEPX_USERNAME. Optional: PROJECTX_TOPSTEPX_PREFERRED_ACCOUNT_NAME. Example credentialValues: {"PROJECTX_TOPSTEPX_API_KEY":"key...","PROJECTX_TOPSTEPX_USERNAME":"username..."}. WEEX (weex): WEEX_API_KEY + WEEX_API_SECRET + WEEX_API_PASSPHRASE. Example credentialValues: {"WEEX_API_KEY":"key...","WEEX_API_SECRET":"secret...","WEEX_API_PASSPHRASE":"passphrase..."}. Bitunix (bitunix): BITUNIX_API_KEY + BITUNIX_API_SECRET. Optional: BITUNIX_TRADING_MODE. Example credentialValues: {"BITUNIX_API_KEY":"key...","BITUNIX_API_SECRET":"secret..."}. Kraken (kraken): KRAKEN_API_KEY + KRAKEN_API_SECRET. Example credentialValues: {"KRAKEN_API_KEY":"key...","KRAKEN_API_SECRET":"secret..."}. Coinbase (coinbase): COINBASE_API_KEY_NAME + COINBASE_PRIVATE_KEY. Optional: COINBASE_API_PASSPHRASE, COINBASE_SANDBOX. Example credentialValues: {"COINBASE_API_KEY_NAME":"organizations/.../apiKeys/...","COINBASE_PRIVATE_KEY":"-----BEGIN EC PRIVATE KEY-----..."}. Do not put data-provider API keys, screener rows, CSV data, workbooks, JSON dumps, or BotSpot internal keys here; use saved_env_vars(action="create") for non-broker runtime secrets.

Input Schema

NameRequiredDescriptionDefault
brokerYes
displayNameYes
paperOrLiveYes
credentialValuesYes

Schema Changelog

Changes observed during successful MCP inspections.

  1. First observed

TDQS

A4.7/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations only cover destructiveHint=false, so the description carries the real burden and does: encryption at rest, values never returned to MCP (only metadata), per-broker validation driven by the broker field, and explicit negative rules ('Do not pass ALPACA_IS_PAPER; BotSpot derives it from paperOrLive'). That is exactly the kind of consequence/constraint an agent cannot get from the schema.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The critical rules are front-loaded, which is good, but the per-broker block is repetitive: 'Example credentialValues' appears ten times and the 'Do not pass X_IS_PAPER' rule is restated across four brokers. The detail is largely necessary given no broker enum, but it could be compressed into a table-like form, so length is close to excessive rather than optimal.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 4-required-param mutation with a nested free-form object, no output schema, and only a destructiveHint annotation, the description supplies the missing pieces: what is stored, what is returned (metadata only), what is validated, and what must not be sent. An agent has enough to construct a valid call for every supported broker.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With 0% schema description coverage, the description does heavy lifting: it explains the broker field's role and lists the accepted broker slugs (alpaca, tradier, schwab, tradovate, projectx-topstepx, weex, bitunix, kraken, coinbase), details credentialValues keys per broker, and clarifies paperOrLive indirectly (derived IS_PAPER flags). displayName is never explained, which keeps it off a 5.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Opens with a specific verb and resource: stores broker credential material in Vault and returns only metadata. The scope statement ('broker login/trading credentials only') plus the explicit hand-off to saved_env_vars for non-broker secrets distinguishes it cleanly from the nearest sibling.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives explicit when-to-use ('broker login/trading credentials only'), when-not-to-use ('do not put data-provider API keys, screener rows, CSV data... here; use saved_env_vars(action="create")'), and a behavioral rule for downstream deployments ('do not add a brokerCredentialId by default; let the user choose on the approval page'). Alternatives are named rather than implied.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Try in Browser

Glama MCP Gateway

Add one secure layer between your agents and this server.