Skip to main content
Glama

Upload local file to Card Builder media

card_builder_upload_media_from_path
DestructiveIdempotent

Upload a local file from Home Assistant's config www or media folder into the Card Builder media library by providing its path.

Instructions

Read a local file under the HA config directory and upload it as Card Builder media.

local_path must resolve (after following symlinks) under <config>/www or <config>/media, and have an image/SVG extension — see _ALLOWED_MEDIA_EXTENSIONS. Anything else (e.g. secrets.yaml, /data/options.json, a sibling directory) is refused before the file is read. .svg files are sanitized (script/event-handler/unsafe-URL stripping) before upload — see sanitize_svg. The uploaded file becomes public under Home Assistant's /local/ path with no authentication. Upstream's _write_media_file writes with no existence check, so uploading onto a path/filename that already holds a file silently overwrites it, with no backup.

Use when: re-publishing a file that already exists on the config filesystem (e.g. under www/) into the Card Builder media library. Not for: bytes already in memory — use card_builder_upload_media; a remote URL — use card_builder_upload_image_from_url. Returns: {reference, path, url} on success, same shape as card_builder_upload_media. Errors: {"error": "invalid_path" | "path_not_allowed" | "extension_not_allowed" | "file_not_found" | "invalid_svg" | ...} (plus the sanitize_svg errors) when the source path is outside the allowed roots, has a disallowed extension, doesn't exist, or fails sanitization.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
pathNoSub-folder under www/card_builder/ to upload into. Empty string uploads to the root.
filenameNoTarget filename to store as. Omit to reuse local_path's own filename.
local_pathYesAbsolute or relative path to the source file; must resolve under <config>/www or <config>/media.

Output Schema

TableJSON Schema
NameRequiredDescriptionDefault

No arguments

Schema Changelog

Changes observed during successful MCP inspections.

  1. Changed3 schema fields changedv0.25.1
    • addedInput schema / properties / filename / description
      Added value: +"Target filename to store as. Omit to reuse local_path's own filename."
    • addedInput schema / properties / local_path / description
      Added value: +"Absolute or relative path to the source file; must resolve under <config>/www or <config>/media."
    • addedInput schema / properties / path / description
      Added value: +"Sub-folder under www/card_builder/ to upload into. Empty string uploads to the root."
  2. Addedv0.18.1

TDQS

A4.8/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond the annotations (destructiveHint=true, idempotentHint=true), the description discloses critical behaviors the agent could not infer: the uploaded file becomes public under /local/ with no authentication, no existence check means a silent overwrite with no backup, symlinks are followed before validation, and SVGs are sanitized. It also enumerates the exact error codes and the return shape. This is exactly the additional context the annotations alone do not provide.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded with the core action, then organized into bolded Use when / Not for / Returns / Errors segments, so it is scannable and every section carries decision-relevant content. It is somewhat long and leans on internal identifiers (_ALLOWED_MEDIA_EXTENSIONS, _write_media_file, sanitize_svg) that add jargon without much agent benefit, costing a point.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Even though an output schema exists, the description summarizes the return shape ({reference, path, url}), documents the error taxonomy, and covers the constraints, sanitization, visibility, and overwrite behavior an agent needs to invoke this mutation safely. Nothing material is missing for a tool with side effects and no auth on the resulting asset.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline is 3, but the description adds real semantics for local_path beyond the schema: symlink resolution semantics, the extension allow-list, and the fact that disallowed paths are refused before the file is read. It also ties path/filename behavior to the silent-overwrite risk, which the schema's parameter descriptions do not convey.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a precise verb+resource (read a local file and upload it as Card Builder media) along with the exact scope constraints (must resolve under <config>/www or <config>/media with an image/SVG extension). It clearly distinguishes itself from the in-memory and remote-URL siblings by name. An agent can identify this tool's unique role without opening the schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicit 'Use when' (re-publishing a file already on the config filesystem) and 'Not for' clauses that route to the two named alternatives: card_builder_upload_media for in-memory bytes and card_builder_upload_image_from_url for remote URLs. Conditions for choosing each path are unambiguous.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Deploy Server

Other Tools