Skip to main content
Glama

Agent Broker

by dev.hatchloop

mint_key

Agent self-serve API key issuance. An autonomous agent that has no email inbox can obtain a free-tier API key by proving it holds the MACHINE_MINT_SECRET via HMAC-SHA256. Returns a usable key immediately with no human action required. If the operator has not activated a mint secret on the server, this returns an honest not_configured failure rather than a key - call it once and branch on that before planning around it.

EXAMPLE USER QUERIES THAT MATCH THIS TOOL: user: "I need an API key to call AgentBroker tools" -> call mint_key({"agent_id": "my-agent-abc123", "timestamp": 1725100000, "nonce": "4f8a2c1d", "signature": "<HMAC-SHA256(agent_id+timestamp+nonce, MACHINE_MINT_SECRET)>"})

WHEN TO USE: Use when an AI agent needs to self-provision a write-capable API key without a human email address. The caller must know the MACHINE_MINT_SECRET (available from hatchloop.dev/docs/#machine-mint). WHEN NOT TO USE: Do not use if the agent has a human operator who can complete the email flow at /keys/request. Do not use for paid plans — this endpoint issues free-tier keys (100 ops/day) only. COST: free - no key required LATENCY: ~100ms

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
nonceYesRandom value (UUID or hex). Prevents replay attacks — use a fresh nonce each call.
agent_idYesA stable unique identifier for this agent (e.g. a UUID). The issued key is deterministically tied to this ID.
signatureYesHMAC-SHA256(agent_id + str(timestamp) + nonce, MACHINE_MINT_SECRET) as lowercase hex. The HMAC input is the raw concatenation with no separators.
timestampYesUnix epoch seconds at signing time. Must be within 60s of server time.

Schema Changelog

Changes observed during successful MCP inspections. Dates show when Glama detected each change.

  1. Changed1 schema field changed
    • changedInput schema / properties / nonce / description
      Previous value: -"Random value (UUID or hex). Prevents replay attacks — use a fresh nonce each call."New value: +"Random value (UUID or hex). Prevents replay attacks — use a fresh nonce each call."
  2. Changed1 schema field changed
    • changedInput schema / properties / nonce / description
      Previous value: -"Random value (UUID or hex). Prevents replay attacks — use a fresh nonce each call."New value: +"Random value (UUID or hex). Prevents replay attacks — use a fresh nonce each call."
  3. Added

TDQS

A4.8/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond annotations, the description discloses a valuable failure mode: if no mint secret is activated, it returns an honest not_configured failure rather than a key. It also reveals that the endpoint is immediate, requires no human action, issues only free-tier keys at 100 ops/day, and costs no key to call—useful context annotations do not provide.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-organized with clear sections and front-loaded purpose, but it is slightly redundant: the opening paragraph and WHEN TO USE both cover the autonomous-agent-without-email condition. The example and operational details earn their place, though a tighter edit would reduce repetition.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 4-parameter tool with no output schema, the description is remarkably complete: it covers when to use, when not to use, the HMAC proof requirement, the not_configured failure branch, cost, latency, and an example call. An agent can confidently select and invoke this tool without additional information.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema already covers all four parameters at 100%, so the baseline is 3. The description adds value by including a full example invocation with concrete values for agent_id, timestamp, nonce, and signature, and by pointing to where MACHINE_MINT_SECRET is documented.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific action and resource: 'Agent self-serve API key issuance' and clearly distinguishes it from ordinary key-request flows by describing the autonomous, secret-proving mechanism. It also differentiates from sibling tools by scoping to free-tier agent self-provisioning without a human email inbox.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides explicit 'WHEN TO USE' and 'WHEN NOT TO USE' sections, naming the exact alternative (the human email flow at /keys/request) and excluding paid-plan usage. It also tells the agent to call once and branch on the not_configured failure, which is concrete operational guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

All Agent Broker toolsInspect
Try in Browser
RayrunBuild, deploy, and operate MCP servers without becoming an infrastructure team.ray.runAd

Glama MCP Gateway

Add one secure layer between your agents and this server.

TDQS

A3.9/5.0
Disambiguation4/5

Most tools target distinct resource+action pairs (find_business vs verify_business, check_booking_link vs import_booking_url, get_status vs get_outcome). The main confusable pairs are send_message vs send_transactional_confirmation and verify_business vs verify_company_record, but their descriptions draw clear boundary lines.

Naming Consistency4/5

The set overwhelmingly follows lower_snake_case verb_noun naming (call_business, check_quota, find_business, send_message, verify_company_record). Minor deviations like self_test and mint_key, plus inconsistent verb choices (lookup_ vs get_ vs find_), prevent a perfect score.

Tool Count3/5

At 23 tools, the server falls into the heavy range and bundles several unrelated domains: SMB booking/messaging, trade and sanctions compliance, company verification, and platform operations. Each tool is individually reasonable, but the set feels like multiple servers merged into one.

Completeness3/5

Core SMB workflows are well covered: find/verify/import/book, messaging with conversation handling, and compliance preflights. Notable gaps include no consent-record management even though send_message requires consent_record_id for marketing, no update/delete lifecycle for leads or businesses, and no webhook configuration despite webhooks being referenced.

Resources