Skip to main content
Glama

call_api_raw

Destructive

Make direct Hostkey InvAPI calls by resource and action for operations lacking typed tools, such as ISO, S3, or Remote Hands. Requires confirm=true and may need destructive-action approval.

Instructions

Universal direct InvAPI call by resource and action, for resources without typed tools (e.g.: iso — ISO image library, s3 — S3 Object Storage, rhr — Remote Hands new version; see action list in the docs: https://hostkey.com/documentation/apidocs/). ALWAYS requires confirm=true; destructive/paid actions additionally require HOSTKEY_ALLOW_DESTRUCTIVE=1. Prefer typed tools when they exist for the needed operation.

Input Schema

NameRequiredDescriptionDefault
authNoInject session token (defaults to true)
actionYesResource action, e.g.: list
paramsNoCall parameters as an object; nested objects become params[...]
confirmYesRequired confirmation. Without confirm=true the call is rejected.
resourceYesInvAPI resource without .php, e.g.: iso, s3, rhr, eq, net, whmcs

Schema Changelog

Changes observed during successful MCP inspections.

  1. Changed5 schema fields changedv1.0.3
    • changedInput schema / properties / action / description
      Previous value: -"Действие ресурса, например: list"New value: +"Resource action, e.g.: list"
    • changedInput schema / properties / auth / description
      Previous value: -"Подставлять сессионный токен (по умолчанию true)"New value: +"Inject session token (defaults to true)"
    • changedInput schema / properties / confirm / description
      Previous value: -"Обязательное подтверждение. Без confirm=true вызов отклоняется."New value: +"Required confirmation. Without confirm=true the call is rejected."
    • changedInput schema / properties / params / description
      Previous value: -"Параметры вызова объектом; вложенные объекты превращаются в params[...]"New value: +"Call parameters as an object; nested objects become params[...]"
    • changedInput schema / properties / resource / description
      Previous value: -"Ресурс InvAPI без .php, например: iso, s3, rhr, eq, net, whmcs"New value: +"InvAPI resource without .php, e.g.: iso, s3, rhr, eq, net, whmcs"
  2. First observedv1.0.1

TDQS

A4.3/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already flag destructiveHint=true and openWorldHint=true, but the description adds non-obvious gating context: confirm=true is ALWAYS required and destructive/paid actions additionally need HOSTKEY_ALLOW_DESTRUCTIVE=1. That is real auth/prerequisite disclosure beyond the annotations, though it does not describe response/error behavior for this raw passthrough call.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single dense but well-ordered block: purpose first, examples second, hard requirements third, routing rule last. Every clause earns its place, though the run-on examples-plus-URL sentence is slightly heavy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a universal passthrough tool with no output schema, the description covers scope, mandatory confirmation, the destructive env-var gate, and alternative routing, which is most of what an agent needs. It does not characterize the shape of returned data or failure modes, a minor gap for an openWorld raw call.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100% and each of the 5 parameters is documented there, including the confirm gate and the nested-object params convention. The description adds resource examples (iso, s3, rhr) and a docs pointer for the action vocabulary, but nothing the schema does not already cover, so baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('Universal direct InvAPI call by resource and action') and immediately scopes it to 'resources without typed tools', naming concrete examples (iso, s3, rhr). An agent can distinguish this generic escape-hatch tool from the many typed siblings without opening any schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly says when to use it (resources lacking typed tools) and when not ('Prefer typed tools when they exist for the needed operation'), plus routes to the docs for the action list. This is exactly the when/when-not/alternative guidance the dimension asks for.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Deploy Server

Other Tools