Skip to main content
Glama

Upload attachment

upload_attachment

Uploads one file from an allowed local path or HTTPS URL to a Polarion Work Item, Test Run, LiveDoc, or Rich Page and returns the attachment result.

Instructions

Uploads one file as a Polarion attachment to a Work Item, Test Run, LiveDoc, or Rich Page and returns the attachment result. Choose exactly one source: an absolute local path on stdio with MCP_UPLOAD_ROOTS, or an HTTPS URL on an allowlisted host with MCP_UPLOAD_URL_HOSTS. The authenticated Polarion user must have attachment write permission. Use dry_run to validate and preview name, size, and SHA-256; use the resource-specific attachment tools when editing existing attachment metadata or content.

Input Schema

NameRequiredDescriptionDefault
urlNoAbsolute HTTPS URL whose hostname is listed in MCP_UPLOAD_URL_HOSTS; HTTP requires explicit server opt-in.
titleNoOptional attachment title stored by Polarion.
targetYesPolarion target reference; document and page targets also require spaceId.
dry_runNoPreview file metadata and digest without sending an attachment request.
fileNameNoOptional attachment filename override without path separators; defaults to the source filename.
filePathNoAbsolute local file path, available only over stdio and only under a configured MCP_UPLOAD_ROOTS directory.

Schema Changelog

Changes observed during successful MCP inspections.

  1. Changed10 schema fields changedv1.4.4
    • addedInput schema / properties / dry_run / description
      Added value: +"Preview file metadata and digest without sending an attachment request."
    • addedInput schema / properties / fileName / description
      Added value: +"Optional attachment filename override without path separators; defaults to the source filename."
    • changedInput schema / properties / filePath / description
      Previous value: -"Absolute local path. Available only on stdio when MCP_UPLOAD_ROOTS is configured."New value: +"Absolute local file path, available only over stdio and only under a configured MCP_UPLOAD_ROOTS directory."
    • changedInput schema / properties / target / description
      Previous value: -"Polarion reference. Documents and pages also require spaceId."New value: +"Polarion target reference; document and page targets also require spaceId."
    • addedInput schema / properties / target / properties / id / description
      Added value: +"Work Item, Test Run, document, or page ID within the project; do not include the project prefix."
    • addedInput schema / properties / target / properties / projectId / description
      Added value: +"Project ID that owns the target resource."
    • addedInput schema / properties / target / properties / spaceId / description
      Added value: +"Required for `document` and `page`; space ID within the project."
    • addedInput schema / properties / target / properties / type / description
      Added value: +"Target resource family."
    • addedInput schema / properties / title / description
      Added value: +"Optional attachment title stored by Polarion."
    • changedInput schema / properties / url / description
      Previous value: -"HTTPS URL on a hostname listed in MCP_UPLOAD_URL_HOSTS."New value: +"Absolute HTTPS URL whose hostname is listed in MCP_UPLOAD_URL_HOSTS; HTTP requires explicit server opt-in."
  2. Addedv1.4.0

TDQS

A4.3/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already flag it as a non-read-only, non-destructive, open-world write, so the bar is lower; the description still adds real context: the authenticated Polarion user needs attachment write permission, sources are gated by environment allowlists, and dry_run previews name/size/SHA-256 before sending. It does not say whether re-uploading an identical file creates a duplicate, which matters given idempotentHint=false.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three dense sentences, front-loaded with verb and targets, then source constraints, then permission and dry_run guidance. No filler, though the middle sentence packs several environment-variable conditions together and the closing sibling reference is slightly vague ('resource-specific attachment tools').

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a nested-target, six-parameter write tool with no output schema, the description covers target scope, source channel, permission prerequisite, preview mode, and return shape. The single omission is the relationship to the sibling per-resource upload tools, which an agent would need to avoid picking the wrong tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so baseline is 3; the description earns a point by stating the mutual-exclusion rule ('choose exactly one source') between `filePath` and `url`, a constraint not expressed as oneOf in the schema. It also clarifies that dry_run is for validation/preview rather than a separate mode.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb plus the resource ('Uploads one file as a Polarion attachment') and enumerates all four target families (Work Item, Test Run, LiveDoc, Rich Page). It also states the return ('returns the attachment result'), so the tool is fully identifiable without opening the schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives explicit context: 'Choose exactly one source' between local path (stdio + MCP_UPLOAD_ROOTS) and HTTPS URL (allowlisted host), plus when to use `dry_run`. The one gap is that it never disambiguates from the many sibling post*Attachments tools (postWorkItemAttachments, postPageAttachments, postTestRunAttachments, etc.) that appear to overlap heavily; it only routes away from itself for 'editing existing attachment metadata or content'.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Deploy Server

Other Tools