Skip to main content
Glama

create_credential

Attach a secret — a password, a key, a test login — to an issue or a wiki page, instead of writing it in a comment or a description, where everyone on the project reads it for ever. Pass issueKey or pageId, and a 'name' saying what it is. It can be read by the person whose token this is, by the people in 'readers', and by the project's lead, who reads every secret in the project — and by nobody else, however much of the issue they can see. The answer lists them in 'readableBy': say that to the person rather than 'only you'. There are two ways to give the value. WITHOUT 'value' nothing is stored and the answer is a 'form' link: it opens the attach dialog with the name and the readers filled in, and the person types the value there themselves. Prefer that whenever the value is not already in the conversation — a value that passes through you stays in your context and in your client's logs. WITH 'value' the secret is stored now and the answer carries its id and name, never the value; it is recorded against the token you are using. Do not repeat the value in any text you write — a comment, a description, a merge request, a log. A name in 'readers' that is unknown or cannot open the project is not stored and comes back in 'dropped' with the reason. Needs the right to edit the issue or the page.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
nameYesWhat it is, e.g. 'stand admin password'. Read by everybody who may read the secret, so not the value and no part of it.
valueNoThe secret itself. Leave it out to get a 'form' link where the person types it themselves.
pageIdNoWiki page id.
readersNoWho else may read it, comma-separated usernames or emails (see list_users): 'ivan,olga'. Leave it out for nobody else.
issueKeyNoIssue key, e.g. 'UK-1'.

Schema Changelog

Changes observed during successful MCP inspections.

  1. Added

TDQS

A4.8/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden and does so: it discloses the readership model (token owner, 'readers', project lead, nobody else), what the response contains per mode ('readableBy', a 'form' link, or id/name but never the value), the 'dropped' failure surface with reasons, and the required edit permission. It also flags log/context leakage risk. This is unusually thorough behavioural disclosure.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The critical scoping (what it does, then the form-vs-stored distinction) is front-loaded, and every sentence is load-bearing. It is nonetheless dense and long for a 5-parameter tool, with the 'do not repeat the value' warning restated, which slightly dilutes the signal.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema and no annotations, the description still tells the agent what comes back in each mode, what failure looks like ('dropped'), and the permission prerequisite. Nothing an agent needs to call this correctly is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline is 3, but the description adds real semantic value: the mutual mode switch between 'value' present vs absent, the issueKey-or-pageId attachment target, the comma-separated readers format referencing list_users, and the constraint that 'name' must not contain any part of the value. It stops short of documenting every edge case, so not a 5.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The opening sentence names a specific verb+resource (attach a secret to an issue or wiki page) and immediately contrasts it with the sibling behaviour it replaces (writing secrets in comments/descriptions). An agent can distinguish it from add_comment, update_credential, and reveal_credential without opening any schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It states when to use this tool versus the alternative (instead of a comment/description), when to pass issueKey vs pageId, and gives an explicit preference rule: omit 'value' whenever the secret is not already in the conversation. It also names the exclusion case (value that would pass through the model).

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Try in Browser

Glama MCP Gateway

Add one secure layer between your agents and this server.

Resources