Skip to main content
Glama

spix_auth_key_create

Generate API keys for the Spix MCP server to enable AI agents to access phone, voice, email, and contact management features.

Instructions

Create a new API key

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
nameYesKey name
expires_atNoExpiration date (ISO8601)

Implementation Reference

  • The `create_tool_handler` function is the generic handler for all MCP tool calls, including "spix_auth_key_create". It resolves the tool name to a schema, validates access, builds the endpoint URL, and dispatches the request to the backend.
    async def create_tool_handler(
        session: McpSessionContext,
        tool_name: str,
        arguments: dict,
    ) -> list:
        """Execute an MCP tool call by dispatching to the backend API.
    
        This function:
        1. Resolves the tool name to a command schema
        2. Validates session scope (playbook access, channel access)
        3. Builds the API request
        4. Dispatches to the backend
        5. Returns the response as MCP TextContent
    
        Args:
            session: The MCP session context for scope validation.
            tool_name: The MCP tool name (e.g., "spix_playbook_create").
            arguments: The tool arguments from the MCP client.
    
        Returns:
            List containing a single TextContent with the JSON response.
        """
        # Import here to avoid circular imports and handle missing mcp package
        try:
            from mcp.types import TextContent
        except ImportError:
            # Fallback for when mcp is not installed
            class TextContent:  # type: ignore[no-redef]
                def __init__(self, type: str, text: str) -> None:
                    self.type = type
                    self.text = text
    
        # Resolve tool name to schema
        schema = get_schema_by_tool_name(tool_name)
        if not schema:
            return [
                TextContent(
                    type="text",
                    text=orjson.dumps(
                        {"ok": False, "error": {"code": "unknown_tool", "message": f"Unknown tool: {tool_name}"}}
                    ).decode(),
                )
            ]
    
        # Validate tool access (not disabled)
        try:
            session.validate_tool_access(schema.path)
        except Exception as e:
            from spix_mcp.session import McpScopeError
    
            if isinstance(e, McpScopeError):
                return [TextContent(type="text", text=orjson.dumps({"ok": False, "error": e.to_dict()}).decode())]
            raise
    
        # Validate channel access if applicable
        channel = infer_channel_from_tool(schema.path)
        if channel:
            try:
                session.validate_channel_access(channel)
            except Exception as e:
                from spix_mcp.session import McpScopeError
    
                if isinstance(e, McpScopeError):
                    return [TextContent(type="text", text=orjson.dumps({"ok": False, "error": e.to_dict()}).decode())]
                raise
    
        # Handle playbook_id: validate and apply default
        playbook_id = arguments.get("playbook_id")
        try:
            effective_playbook = session.validate_playbook_access(playbook_id)
            if effective_playbook and not playbook_id:
                # Apply default playbook
                arguments["playbook_id"] = effective_playbook
        except Exception as e:
            from spix_mcp.session import McpScopeError
    
            if isinstance(e, McpScopeError):
                return [TextContent(type="text", text=orjson.dumps({"ok": False, "error": e.to_dict()}).decode())]
            raise
    
        # Build endpoint URL with path parameters
        endpoint, remaining_args = build_endpoint_url(schema, arguments)
    
        # Dispatch to backend API
        client = session.client
        method = schema.http_method.lower()
    
        if method == "get":
            response = await asyncio.to_thread(client.get, endpoint, params=remaining_args if remaining_args else None)
        elif method == "post":
            response = await asyncio.to_thread(client.post, endpoint, json=remaining_args if remaining_args else None)
        elif method == "patch":
            response = await asyncio.to_thread(client.patch, endpoint, json=remaining_args if remaining_args else None)
        elif method == "delete":
            response = await asyncio.to_thread(client.delete, endpoint, params=remaining_args if remaining_args else None)
        else:
            response = await asyncio.to_thread(client.get, endpoint)
    
        # Build response envelope
        envelope: dict = {"ok": response.ok, "meta": response.meta}
        if response.ok:
            envelope["data"] = response.data
            if response.pagination:
                envelope["pagination"] = response.pagination
            if response.warnings:
                envelope["warnings"] = response.warnings
        else:
            envelope["error"] = response.error
    
        return [TextContent(type="text", text=orjson.dumps(envelope).decode())]
  • The "spix_auth_key_create" tool (mapped from "auth.key.create") is registered in the `COMMAND_REGISTRY` here, defining its API endpoint, HTTP method, and input parameters.
        path="auth.key.create",
        cli_usage="spix auth key create --name <n>",
        http_method="POST",
        api_endpoint="/auth/keys",
        mcp_expose="tool",
        mcp_profile="safe",
        description="Create a new API key",
        params=[
            CommandParam("name", "string", required=True, description="Key name"),
            CommandParam("expires_at", "string", description="Expiration date (ISO8601)"),
        ],
    ),
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden of behavioral disclosure. 'Create a new API key' implies a mutation operation, but it doesn't disclose critical traits like authentication needs, rate limits, whether the key is immediately usable, or what happens upon expiration. For a security-sensitive tool with zero annotation coverage, this is a significant gap.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, efficient sentence with zero waste. It's front-loaded with the core action and resource, making it easy to parse quickly. Every word earns its place without redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the complexity of creating an API key (a security-sensitive mutation), lack of annotations, and no output schema, the description is incomplete. It doesn't cover behavioral aspects like authentication requirements, response format, or error handling. For a tool with no structured safety or output information, the description should do more to compensate.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already documents both parameters ('name' and 'expires_at') with descriptions. The description doesn't add any meaning beyond what the schema provides (e.g., it doesn't explain naming conventions or expiration implications). Baseline 3 is appropriate when the schema does the heavy lifting.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action ('Create') and resource ('API key'), making the purpose immediately understandable. It distinguishes from siblings like 'spix_auth_key_list' by specifying creation rather than listing. However, it doesn't specify what system or context this API key is for (e.g., Spix authentication), which prevents a perfect score.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance is provided on when to use this tool versus alternatives. While siblings include 'spix_auth_key_list' for listing keys, the description doesn't mention this relationship or any prerequisites (e.g., authentication requirements). It lacks explicit when/when-not instructions or named alternatives.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Install Server

Other Tools

Latest Blog Posts

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/Spix-HQ/spix-mcp'

If you have feedback or need assistance with the MCP directory API, please join our Discord server