Skip to main content
Glama

create_app

Publish new files as an app and get its URL back. Version 1 goes live at once, so show the person the content and the destination before calling this. Access defaults to org_link, which lets anyone signed in to the same organization open the link.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
nameYesWhat the app is called. Shown in listings.
slugNoThe readable part of the subdomain to publish at, 3 to 34 characters of a-z, 0-9 and single hyphens. Derived from the name when omitted. A random 5-character tag is always appended, so a name is never taken and two apps may share one.
typeNoThe badge on the row. Defaults to app.
filesYesThe files to publish. Content is plain text written here in the chat, not base64: an HTML page, a Markdown document, or a JavaScript module that exports default { fetch }. A page app serves index.html at the app URL. A function that declares the db service carries its schema changes here too, as migrations/NNNN_name.sql, which run in order when the version goes live.
accessNoWho may open the link. Defaults to org_link.
messageNoWhat version 1 contains.
manifestNoHow the version runs. Omit it on create_app for a static page, and omit it on update_app to keep the previous version's manifest. A manifest that is sent replaces the whole of it, so send every field the app still needs. services, secrets and env are read by a function only. The data plane in full, with its limits: https://reachpad.dev/SKILL.md
validateNoCheck the call and write nothing. Answers with the file set the publish would contain, its total bytes, the entry and the kind, and on create_app the slug and the URL the app would take, where <tag> stands for the five random characters drawn when it is published. It checks the file set, its total size, that the entry file is one of the files, and on create_app that the slug is a usable link name. It does not check the org's app limit, so a create that would be refused for that is still refused when it is published.

Schema Changelog

Changes observed during successful MCP inspections. Dates show when Glama detected each change.

  1. Changed1 schema field changed
    • changedInput schema / properties / validate / description
      Previous value: -"Check the call and write nothing. Answers with the file set the publish would contain, its total bytes, the entry and the kind. It checks the file set, its total size, and that the entry file is one of the files. It does not check the org's app limit or whether the slug is free, so a create that would be refused for one of those is still refused when it is published."New value: +"Check the call and write nothing. Answers with the file set the publish would contain, its total bytes, the entry and the kind, and on create_app the slug and the URL the app would take, where <tag> stands for the five random characters drawn when it is published. It checks the file set, its total size, that the entry file is one of the files, and on create_app that the slug is a usable link name. It does not check the org's app limit, so a create that would be refused for that is still refused when it is published."
  2. Changed8 schema fields changed
    • changedInput schema / properties / files / description
      Previous value: -"The files to publish. Content is plain text written here in the chat, not base64: an HTML page, a Markdown document, or a JavaScript module that exports default { fetch }. A page app serves index.html at the app URL."New value: +"The files to publish. Content is plain text written here in the chat, not base64: an HTML page, a Markdown document, or a JavaScript module that exports default { fetch }. A page app serves index.html at the app URL. A function that declares the db service carries its schema changes here too, as migrations/NNNN_name.sql, which run in order when the version goes live."
    • changedInput schema / properties / manifest / description
      Previous value: -"How the version runs. Omit it for a static page. kind is page or function, entry is the file served at / for a page or the module for a function."New value: +"How the version runs. Omit it on create_app for a static page, and omit it on update_app to keep the previous version's manifest. A manifest that is sent replaces the whole of it, so send every field the app still needs. services, secrets and env are read by a function only. The data plane in full, with its limits: https://reachpad.dev/SKILL.md"
    • addedInput schema / properties / manifest / properties / entry / description
      Added value: +"For a page, the file served at the root of the link, usually index.html. For a function, the module that exports default { fetch }. It has to be one of the files the version ends up with, which on a merge includes the ones carried over from the base."
    • changedInput schema / properties / manifest / properties / env / description
      Previous value: -"Plain string values readable by a function."New value: +"Plain string values a function reads as env.NAME. Stored as written and readable by anyone who can read the version, so put a key in secrets instead. A name that is also in secrets fails the publish."
    • addedInput schema / properties / manifest / properties / kind / description
      Added value: +"page serves the files as they are. function runs one JavaScript module for every request to the link."
    • addedInput schema / properties / manifest / properties / secrets / description
      Added value: +"Names of secrets the organization has already set, each bound as env.NAME. A function only. Set the value first, in Settings at reachpad.dev/apps/settings or with reachpad secrets set NAME: a name the organization has not set fails the publish with NAME is not set."
    • addedInput schema / properties / manifest / properties / services / description
      Added value: +"What the function may use, on env.reachpad: db is the app's own SQLite database, through env.reachpad.db.query(sql, params) and env.reachpad.db.batch(statements); files is its file store, through env.reachpad.files.put/get/head/delete. A function only, and any other name is refused when you publish. Declaring db also lets the version carry migrations/NNNN_name.sql, which run when it goes live."
    • addedInput schema / properties / manifest / properties / services / items / enum
      Added value: +[
      +  "db",
      +  "files"
      +]
  3. Changed1 schema field changed
    • changedInput schema / properties / validate / description
      Previous value: -"Check the call and write nothing. Answers with the file set the publish would contain, its total bytes, the entry and the kind. Nothing is published, so a version that would be refused is refused before it reaches the link."New value: +"Check the call and write nothing. Answers with the file set the publish would contain, its total bytes, the entry and the kind. It checks the file set, its total size, and that the entry file is one of the files. It does not check the org's app limit or whether the slug is free, so a create that would be refused for one of those is still refused when it is published."
  4. Changed1 schema field changed
    • addedInput schema / properties / validate
      Added value: +{
      +  "description": "Check the call and write nothing. Answers with the file set the publish would contain, its total bytes, the entry and the kind. Nothing is published, so a version that would be refused is refused before it reaches the link.",
      +  "type": "boolean"
      +}
  5. Changed1 schema field changed
    • changedInput schema / properties / slug / description
      Previous value: -"The subdomain to publish at, 3 to 40 characters of a-z, 0-9 and single hyphens. Derived from the name when omitted; a taken slug gets a numeric suffix."New value: +"The readable part of the subdomain to publish at, 3 to 34 characters of a-z, 0-9 and single hyphens. Derived from the name when omitted. A random 5-character tag is always appended, so a name is never taken and two apps may share one."
  6. Added

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond the annotations, the description discloses the key non-obvious behavior: Version 1 goes live at once, so there is immediate public exposure. It also states the default access behavior (org_link), which affects who can open the result. This adds meaningful safety-relevant context beyond the structured hints.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is only three sentences and every sentence earns its place: the first states purpose and output, the second warns about immediate publication, and the third gives the access default. No filler or repetition of the schema.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The schema and annotations cover most operational details, while the description supplies the purpose, a live-on-publish warning, the default access, and the return value. It is nearly complete, though it does not explicitly route the agent away from update_app or publish_app_version for existing apps.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already documents every parameter in detail. The top-level description adds general context about publishing and access defaults but does not add per-parameter meaning beyond what the schema provides. That matches the baseline for high schema coverage.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The first sentence states a specific verb, resource, and output: 'Publish new files as an app and get its URL back.' It also signals that this is a new-app creation with 'Version 1 goes live at once,' which distinguishes it from version-update siblings like publish_app_version.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives clear context and a practical precondition: 'show the person the content and the destination before calling this' because the version goes live immediately. It does not name alternatives explicitly, but its 'new files as an app' framing makes the create-versus-update use case reasonably clear.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Try in Browser

Glama MCP Gateway

Add one secure layer between your agents and this server.

TDQS

A3.8/5.0
Disambiguation4/5

Most tools target clearly distinct actions and resources, such as app CRUD, versioning, sharing, secrets, and folder operations. A few adjacent tools like read_app, read_app_file, and read_app_version, or update_app and publish_app_version, require careful reading, but their descriptions are explicit enough to prevent serious confusion.

Naming Consistency3/5

The set mostly uses a verb_noun pattern, with names like create_app, list_secrets, set_app_access, and trash_app. However, Unix-style commands like ls, mkdir, mv, tree, and whoami, plus mixed verbs such as get, read, list, remove, and revoke, break any single consistent convention.

Tool Count3/5

24 tools is on the heavy end of the 16-25 range, and while the platform covers apps, versions, folders, sharing, secrets, logs, and databases, the count feels somewhat large. Each tool has a defined role, but several could potentially be consolidated without losing clarity.

Completeness4/5

The surface covers the main lifecycle well: creating, reading, updating, versioning, sharing, securing, and organizing apps, plus secrets and database queries. Notable gaps are the lack of a permanent delete or restore tool for trashed apps, and the stated absence of captured function logs, but these are workable limitations rather than dead ends.