Skip to main content
Glama

BotSpot: AI Trading, Backtests and Bots

Create or revoke a private publication link

private_share_link
DestructiveIdempotent

action="create" issues or rotates a private bearer link for one account or strategy publication; a new link gets a generated password returned once unless password or noPassword: true is passed. action="revoke" invalidates it immediately.

Set "action" to choose the operation. Only send the fields listed for that action.

Required fields: publicationId. Issues a high-entropy bearer link for one explicit publication. The full secret is returned only once. Anyone with the link can forward it; use private_share_link(action="revoke") to invalidate it. A brand-new link is password protected by default: when no password is passed, BotSpot generates a strong one, builds it into the returned link as #pwd=, and returns it once (it is stored only as a hash and cannot be shown again). Pass password to choose it, or noPassword: true to share with no password. password: null also removes a password, which issues a new link. Rotating a live link that has a password issues a fresh one, built into the new link.

Required fields: publicationId. Immediately invalidates the bearer link for exactly one owner publication.

Input Schema

NameRequiredDescriptionDefault
actionYesWhich operation to run: "create", "revoke". See the tool description for each one.
rotateNoInvalidate the prior token and issue a new one. Used with action="create".
passwordNoOptional password, 8 to 128 characters. Omit it to get a generated one on a new link. null removes the password. Used with action="create".
expiresAtNoOptional ISO-8601 expiration. Must be in the future. Used with action="create".
noPasswordNotrue shares the link with no password instead of generating one. Used with action="create".
publicationIdNoUsed with action="create", action="revoke". Required for action="create", action="revoke".
recipientEmailNoRestrict access to one authenticated existing BotSpot user. Used with action="create".

Schema Changelog

Changes observed during successful MCP inspections.

  1. First observed

TDQS

A4.5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond the annotations (destructiveHint=true, readOnlyHint=false, idempotentHint=true), the description carries real operational context: the secret is shown only once, stored only as a hash, is forwardable by anyone holding it, revoke invalidates immediately, and a generated password is embedded in the link as #pwd=. That is exactly the kind of consequence an agent needs before calling a destructive, non-read-only tool.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

It is front-loaded with a one-line summary followed by clean per-action sections, so the agent can stop reading after the action it needs. There is minor redundancy (e.g. the revoke section repeats 'invalidates it immediately' from the intro, and rot/password rules loop back on themselves).

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema, the description does the right thing by explaining what the call returns (a one-time secret built into the link). Two small gaps remain for a destructive link-issuing tool: whether omitting expiresAt means no expiry, and how recipientEmail restrictions interact with the returned link.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline is 3, but the description adds meaning the schema cannot: omitting password generates a strong one, password: null removes it and issues a new link, and noPassword: true shares with no password. It does not extend the meaning of expiresAt or recipientEmail beyond their schema text.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The opening sentence names the specific verb and resource: it issues or rotates a private bearer link for one account or strategy publication, and it revokes it. The 'private bearer link' framing plus the per-action headings lets an agent distinguish this from public share flows such as strategy_share_link without opening the schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It gives explicit routing between the two actions ('Set "action" to choose the operation. Only send the fields listed for that action') and explains when to rotate versus create. It stops short of naming a sibling alternative (e.g. strategy_share_link for public sharing) or stating eligibility prerequisites for a publication.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Try in Browser

Glama MCP Gateway

Add one secure layer between your agents and this server.