Skip to main content
Glama

Agent Broker

by io.github.basilalshukaili

mint_key

Agent self-serve API key issuance. An autonomous agent that has no email inbox can obtain a free-tier API key by proving it holds the MACHINE_MINT_SECRET via HMAC-SHA256. Returns a usable key immediately with no human action required. If the operator has not activated a mint secret on the server, this returns an honest not_configured failure rather than a key - call it once and branch on that before planning around it.

EXAMPLE USER QUERIES THAT MATCH THIS TOOL: user: "I need an API key to call AgentBroker tools" -> call mint_key({"agent_id": "my-agent-abc123", "timestamp": 1725100000, "nonce": "4f8a2c1d", "signature": "<HMAC-SHA256(agent_id+timestamp+nonce, MACHINE_MINT_SECRET)>"})

WHEN TO USE: Use when an AI agent needs to self-provision a write-capable API key without a human email address. The caller must know the MACHINE_MINT_SECRET (available from hatchloop.dev/docs/#machine-mint). WHEN NOT TO USE: Do not use if the agent has a human operator who can complete the email flow at /keys/request. Do not use for paid plans — this endpoint issues free-tier keys (100 ops/day) only. COST: free - no key required LATENCY: ~100ms

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
nonceYesRandom value (UUID or hex). Prevents replay attacks — use a fresh nonce each call.
agent_idYesA stable unique identifier for this agent (e.g. a UUID). The issued key is deterministically tied to this ID.
signatureYesHMAC-SHA256(agent_id + str(timestamp) + nonce, MACHINE_MINT_SECRET) as lowercase hex. The HMAC input is the raw concatenation with no separators.
timestampYesUnix epoch seconds at signing time. Must be within 60s of server time.

Schema Changelog

Changes observed during successful MCP inspections. Dates show when Glama detected each change.

  1. Changed1 schema field changed
    • changedInput schema / properties / nonce / description
      Previous value: -"Random value (UUID or hex). Prevents replay attacks — use a fresh nonce each call."New value: +"Random value (UUID or hex). Prevents replay attacks — use a fresh nonce each call."
  2. Changed1 schema field changed
    • changedInput schema / properties / nonce / description
      Previous value: -"Random value (UUID or hex). Prevents replay attacks — use a fresh nonce each call."New value: +"Random value (UUID or hex). Prevents replay attacks — use a fresh nonce each call."
  3. Added

TDQS

A4.7/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond the minimal annotations, the description reveals key behaviors: returns a usable key immediately, returns an honest not_configured failure if no mint secret is activated, and advises calling it once and branching on the result. It also discloses cost, latency, and the free-tier operation limit, giving the agent a full picture of the tool's behavior.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is longer than average but well-organized into labeled sections (WHEN TO USE, WHEN NOT TO USE, COST, LATENCY) with the core purpose front-loaded. The example query is somewhat detailed but earns its place by showing exact parameter usage. Minor redundancy in phrases like 'no email inbox'/'without a human email address' prevents a perfect score.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema, the description adequately covers the primary return behavior: a usable key or a not_configured failure. It also mentions the free-tier limit. However, it does not mention other possible failure modes such as invalid signature or expired timestamp, which would be useful for an agent but are partially inferable from the schema. Otherwise it is fairly complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema already covers all four parameters with 100% coverage, so the baseline is 3. The description adds extra value by giving a concrete example matching the parameter set, clarifying that the caller must know MACHINE_MINT_SECRET, and reinforcing the raw-concatenation HMAC format. This lifts it above baseline.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb+resource: 'Agent self-serve API key issuance' and immediately explains that an agent can 'obtain a free-tier API key' via HMAC proof. It clearly distinguishes itself from sibling tools by focusing on self-provisioning without an email inbox, making its unique role obvious.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The 'WHEN TO USE' and 'WHEN NOT TO USE' sections explicitly state when to use this tool (agent with no email, knows MACHINE_MINT_SECRET) and when to avoid it (human operator can complete email flow at /keys/request, paid plans). It also notes the free-tier limit, leaving no ambiguity about applicability.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

All Agent Broker toolsInspect
Try in Browser
RayrunBuild, deploy, and operate MCP servers without becoming an infrastructure team.ray.runAd

Glama MCP Gateway

Add one secure layer between your agents and this server.

TDQS

A4.2/5.0
Disambiguation4/5

Most tools have clearly differentiated targets (e.g., check_booking_link vs import_booking_url, get_status vs get_outcome), and the descriptions are unusually thorough. However, send_message and send_transactional_confirmation overlap because send_message already includes a 'transactional' message type, and verify_business vs verify_company_record are easy to confuse despite different scopes.

Naming Consistency5/5

All 23 tools use a consistent verb_noun snake_case pattern (check_*, get_*, send_*, verify_*), with no camelCase or stylistic drift. The verb uniformly precedes the object, making the surface predictable and easy to navigate.

Tool Count3/5

23 tools is on the heavy side for a single MCP server, spanning SMB communications, booking, compliance screening, trade lookup, and platform utilities. Each tool has a purpose, but the count pushes the set into the 16-25 borderline range and suggests scope creep.

Completeness3/5

Core workflows for booking, messaging, and compliance pre-flight are well covered, including async polling and cost preview. However, there are lifecycle gaps: capture_lead has no way to list/update/retrieve leads, and business records support import/verify but no update/delete. The trade/company-verification tools also feel disconnected from the main SMB flow.

Resources