Skip to main content
Glama

AIfra — temporary static previews

update_preview

Destructive

Prepare replacement of an existing temporary static preview. Supply exactly one of small files or ZIP archive_base64. No backend/build. Requires explicit consent; returns an approval link, not a published URL. User must confirm in their browser. Requires the browser holding the existing management key; expiry is unchanged.

Tool call template

Replace each placeholder with a value matching the input schema. Only required parameters are included; add optional parameters as needed.

{
  "id": 1,
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "arguments": {
      "accept_terms": "<accept_terms>",
      "preview_id": "<preview_id>"
    },
    "name": "update_preview"
  }
}

Input Schema

NameRequiredDescriptionDefault
filesNoOne input choice: 1-500 already-built static files, at most 1 MiB decoded in total. Include index.html at the root and all needed assets. Do not also send archive_base64 or archive. For larger output use a ZIP.
preview_idYesExisting preview_id returned by AIfra. Do not invent it or pass a URL, alias, management key or source IP.
accept_termsYesSet true only after the user explicitly agrees to the current terms and public temporary preview limits. Not inferred from a request to generate a site. Preparation is not publication; the user must also personally confirm the approval URL in their browser within 2 hours.
archive_base64NoOne input choice: actual ZIP bytes encoded as canonical standard base64, without data: prefix. At most 50 MiB (52,428,800 bytes) of decoded ZIP and 50 MiB extracted content; at most 25 MiB per file. index.html at root. No nested archives or server code. Do not also send files or archive.

Output Schema

NameRequiredDescriptionDefault
statusYes
messageYesNext user action; preparation has not published or deleted anything.
preview_idYesAIfra preview identifier; never a management key.
approval_urlYesReturn to the user to open personally. This is not the published preview URL. Never approve it on their behalf.
operation_idYesPrepared operation identifier.
approval_expires_atYesPreparation expires after 2 hours. The 48-hour preview starts only after confirmation.

Schema Changelog

Changes observed during successful MCP inspections.

  1. Changed8 schema fields changed
    • addedInput schema / properties / accept_terms / description
      Added value: +"Set true only after the user explicitly agrees to the current terms and public temporary preview limits. Not inferred from a request to generate a site. Preparation is not publication; the user must also personally confirm the approval URL in their browser within 2 hours."
    • addedInput schema / properties / archive_base64 / description
      Added value: +"One input choice: actual ZIP bytes encoded as canonical standard base64, without data: prefix. At most 50 MiB (52,428,800 bytes) of decoded ZIP and 50 MiB extracted content; at most 25 MiB per file. index.html at root. No nested archives or server code. Do not also send files or archive."
    • addedInput schema / properties / files / description
      Added value: +"One input choice: 1-500 already-built static files, at most 1 MiB decoded in total. Include index.html at the root and all needed assets. Do not also send archive_base64 or archive. For larger output use a ZIP."
    • addedInput schema / properties / files / items / properties / content / description
      Added value: +"Actual file contents, not a filename, local path or download URL. Use UTF-8 text for HTML/CSS/JS and canonical base64 for binary assets. All files together must decode to at most 1 MiB (1,048,576 bytes). No secrets, personal/payment data or forms."
    • addedInput schema / properties / files / items / properties / encoding / description
      Added value: +"Defaults to utf8. Set base64 for binary content; standard padded base64 only, without a data: prefix, whitespace or URL-safe alphabet. The decoded bytes count toward the shared 1 MiB limit."
    • addedInput schema / properties / files / items / properties / path / description
      Added value: +"Relative POSIX path inside the ready static output, e.g. index.html or assets/app.js. index.html must be at the root. No absolute paths, traversal, symlinks, archives or executable/server files."
    • addedInput schema / properties / preview_id / description
      Added value: +"Existing preview_id returned by AIfra. Do not invent it or pass a URL, alias, management key or source IP."
    • changedOutput schema / (root)
      Previous value: -nullNew value: +{
      +  "$schema": "http://json-schema.org/draft-07/schema#",
      +  "additionalProperties": false,
      +  "properties": {
      +    "approval_expires_at": {
      +      "description": "Preparation expires after 2 hours. The 48-hour preview starts only after confirmation.",
      +      "format": "date-time",
      +      "pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z))$",
      +      "type": "string"
      +    },
      +    "approval_url": {
      +      "description": "Return to the user to open personally. This is not the published preview URL. Never approve it on their behalf.",
      +      "format": "uri",
      +      "type": "string"
      +    },
      +    "message": {
      +      "description": "Next user action; preparation has not published or deleted anything.",
      +      "type": "string"
      +    },
      +    "operation_id": {
      +      "description": "Prepared operation identifier.",
      +      "pattern": "^rop_[A-Za-z0-9_-]{43}$",
      +      "type": "string"
      +    },
      +    "preview_id": {
      +      "description": "AIfra preview identifier; never a management key.",
      +      "pattern": "^pv_[A-Za-z0-9_-]{24}$",
      +      "type": "string"
      +    },
      +    "status": {
      +      "const": "pending",
      +      "type": "string"
      +    }
      +  },
      +  "required": [
      +    "operation_id",
      +    "status",
      +    "preview_id",
      +    "approval_url",
      +    "approval_expires_at",
      +    "message"
      +  ],
      +  "type": "object"
      +}
  2. Changed2 schema fields changed
    • addedInput schema / additionalProperties
      Added value: +false
    • removedInput schema / properties / archive
      Removed value: -{
      -  "additionalProperties": false,
      -  "properties": {
      -    "download_url": {
      -      "maxLength": 8192,
      -      "type": "string"
      -    },
      -    "file_id": {
      -      "maxLength": 256,
      -      "minLength": 1,
      -      "type": "string"
      -    },
      -    "file_name": {
      -      "maxLength": 240,
      -      "type": "string"
      -    },
      -    "mime_type": {
      -      "maxLength": 100,
      -      "type": "string"
      -    }
      -  },
      -  "required": [
      -    "download_url",
      -    "file_id"
      -  ],
      -  "type": "object"
      -}
  3. First observed

TDQS

A4.6/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Goes well beyond the annotations (destructiveHint, openWorldHint, non-idempotent) by disclosing the consent requirement, that the return is an approval link rather than a live URL, that the user must confirm in-browser, that the browser must hold the existing management key, and that expiry is unchanged. This is exactly the extra behavioral context annotations cannot convey.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Dense and front-loaded: the core action leads, followed by input constraint, then consent/return semantics. Telegraphic fragments ('No backend/build.') are efficient rather than padding, though the terse style borders on clipped.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given an output schema exists and parameter descriptions are fully covered, the description supplies exactly the missing pieces: the two-hour approval flow, the non-publication outcome, the management-key prerequisite, and unchanged expiry. Nothing an agent needs to call this mutation correctly is absent.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the schema already documents each parameter in detail, giving a baseline of 3. The description adds the cross-parameter XOR constraint ('Supply exactly one of small files or ZIP archive_base64') at the top level, which is a genuine semantic addition beyond individual field docs.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('Prepare replacement of an existing temporary static preview') and implicitly distinguishes itself from create_preview/delete_preview by specifying that the preview already exists. An agent can route here vs. create_preview without opening either schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives clear preconditions for use: an existing preview_id, exactly one of two input modes, and no backend/build step. It stops short of explicitly naming sibling alternatives (e.g. 'use create_preview if no preview exists'), so it is clear context rather than full when/when-not routing.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Try in Browser

Glama MCP Gateway

Add one secure layer between your agents and this server.

Resources