Skip to main content
Glama

BotSpot: AI Trading, Backtests and Bots

Update saved broker credential

update_broker_credential
Idempotent

Updates broker credential metadata and optionally replaces Vault material for the authenticated owner. This replaces the saved credential values when credentialValues is provided; it never returns raw values. Use this for broker login/trading credentials only. Do not add a brokerCredentialId to a deployment by default; let the user choose on the approval page unless they explicitly named the exact saved broker connection/account. The broker field controls validation for known Lumibot/BotSpot brokers; use the exact environment variable key names below. Alpaca (alpaca): ALPACA_API_KEY + ALPACA_API_SECRET OR ALPACA_OAUTH_TOKEN. Do not pass ALPACA_IS_PAPER; BotSpot derives it from paperOrLive. Example credentialValues: {"ALPACA_API_KEY":"PK...","ALPACA_API_SECRET":"secret..."}. Tradier (tradier): TRADIER_ACCOUNT_NUMBER + TRADIER_ACCESS_TOKEN OR TRADIER_ACCOUNT_NUMBER + TRADIER_API_KEY OR TRADIER_ACCOUNT_NUMBER + TRADIER_TOKEN. Optional: TRADIER_REFRESH_TOKEN, TRADIER_OAUTH_CLIENT_ID, TRADIER_OAUTH_CLIENT_SECRET. Do not pass TRADIER_IS_PAPER; BotSpot derives it from paperOrLive. Example credentialValues: {"TRADIER_ACCOUNT_NUMBER":"6AB12345","TRADIER_ACCESS_TOKEN":"token..."}. Charles Schwab (schwab): SCHWAB_ACCOUNT_NUMBER + SCHWAB_TOKEN. Example credentialValues: {"SCHWAB_ACCOUNT_NUMBER":"123456789","SCHWAB_TOKEN":"base64url-token-payload..."}. Tradovate (tradovate): TRADOVATE_USERNAME + TRADOVATE_DEDICATED_PASSWORD + TRADOVATE_CID + TRADOVATE_SECRET. Optional: TRADOVATE_APP_ID, TRADOVATE_APP_VERSION. Do not pass TRADOVATE_IS_PAPER; BotSpot derives it from paperOrLive. Example credentialValues: {"TRADOVATE_USERNAME":"username...","TRADOVATE_DEDICATED_PASSWORD":"dedicated-password...","TRADOVATE_CID":"client-id...","TRADOVATE_SECRET":"secret..."}. TopstepX (projectx-topstepx): PROJECTX_TOPSTEPX_API_KEY + PROJECTX_TOPSTEPX_USERNAME. Optional: PROJECTX_TOPSTEPX_PREFERRED_ACCOUNT_NAME. Example credentialValues: {"PROJECTX_TOPSTEPX_API_KEY":"key...","PROJECTX_TOPSTEPX_USERNAME":"username..."}. WEEX (weex): WEEX_API_KEY + WEEX_API_SECRET + WEEX_API_PASSPHRASE. Example credentialValues: {"WEEX_API_KEY":"key...","WEEX_API_SECRET":"secret...","WEEX_API_PASSPHRASE":"passphrase..."}. Bitunix (bitunix): BITUNIX_API_KEY + BITUNIX_API_SECRET. Optional: BITUNIX_TRADING_MODE. Example credentialValues: {"BITUNIX_API_KEY":"key...","BITUNIX_API_SECRET":"secret..."}. Kraken (kraken): KRAKEN_API_KEY + KRAKEN_API_SECRET. Example credentialValues: {"KRAKEN_API_KEY":"key...","KRAKEN_API_SECRET":"secret..."}. Coinbase (coinbase): COINBASE_API_KEY_NAME + COINBASE_PRIVATE_KEY. Optional: COINBASE_API_PASSPHRASE, COINBASE_SANDBOX. Example credentialValues: {"COINBASE_API_KEY_NAME":"organizations/.../apiKeys/...","COINBASE_PRIVATE_KEY":"-----BEGIN EC PRIVATE KEY-----..."}. Do not put data-provider API keys, screener rows, CSV data, workbooks, JSON dumps, or BotSpot internal keys here; use saved_env_vars(action="create") for non-broker runtime secrets.

Input Schema

NameRequiredDescriptionDefault
idYes
brokerNo
displayNameNo
paperOrLiveNo
credentialValuesNo

Schema Changelog

Changes observed during successful MCP inspections.

  1. First observed

TDQS

A4.7/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond the annotations, it discloses that credentialValues replaces saved credential values when provided and that raw values are never returned. It also explains broker-specific validation and warns against passing derived paper/live flags, which prevents incorrect writes.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The critical purpose, replacement semantics, and usage warnings are front-loaded before the long broker-specific key reference. The broker sections are lengthy but each earns its place because the schema has no parameter descriptions and correct credentialValues keys are essential for successful invocation.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a mutation tool with nested credentialValues and no output schema, the description covers ownership, replacement behavior, return-value secrecy, and broker-specific formats thoroughly. It could be more complete by stating whether omitted metadata fields remain unchanged and by describing id/displayName update semantics.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate; it does so extensively for broker and credentialValues with exact key names and examples per broker. It also implies paperOrLive behavior through the paper/live derivation notes, but it leaves id and displayName largely undocumented.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states that it updates broker credential metadata and optionally replaces Vault-stored values for the authenticated owner. It distinguishes this from creating or deleting credentials by its update scope and explicitly limits it to broker login/trading credentials.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It gives explicit when-to-use guidance, including broker login/trading credentials only, and warns not to attach a brokerCredentialId to a deployment by default. It also names the alternative for non-broker secrets: saved_env_vars(action="create").

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Try in Browser

Glama MCP Gateway

Add one secure layer between your agents and this server.