// SECURE WEAVIATE

Weaviate: 1 unrestricted tools

The Weaviate MCP server exposes 1 write tool alongside 1 read tool. Write operations carry risk of unintended bulk modifications.

1 modify data

// WHAT CAN GO WRONG

Write operations (insert_one) modify state. Without rate limits, an agent can make hundreds of changes in seconds -- faster than any human can review or revert.

// TOOLS THAT NEED LIMITS

These Weaviate tools can modify, create, or destroy resources. Without a policy, your agent has unrestricted access to all of them.

insert_one Insert an object into Weaviate Write

// RECOMMENDED RULES

These rules are based on the tool categories exposed by the Weaviate MCP server. Adjust the limits to match your use case.

Rate limit write operations

insert_one:
    rules:
      - name: "write-rate-limit"
        rate_limit: 30/hour
        on_deny: "Write rate limit reached"

Prevents bulk unintended modifications from agents caught in loops.

Cap read operations

query:
    rules:
      - action: allow
        rate_limit: 60/minute

Controls API costs and prevents retry loops from exhausting upstream rate limits.

// FULL POLICY

This is the complete policy file for Weaviate. It lists every tool with suggested default rules. Download it, adjust the limits, and run with Intercept.

weaviate.yaml

version: "1"
default: "deny"

tools:
  query:
    rules:
      - action: allow
        rate_limit: 60/minute
  insert_one:
    rules:
      - action: allow
        rate_limit: 30/hour

// ENFORCE IT

Two commands. Under two minutes.

Download the policy

curl -o weaviate.yaml https://raw.githubusercontent.com/policylayer/intercept/main/policies/weaviate.yaml

Run Intercept in front of the server

intercept -c weaviate.yaml -- npx -y @@mcp-server-weaviate

Works with any MCP client:

Claude Code Cursor Claude Desktop Windsurf

Every tool call is now checked against your policy before it reaches Weaviate. Denied calls are blocked and logged. Allowed calls pass through with no latency impact.

Enforce policies on Weaviate

Open source. One binary. Zero dependencies.

npx -y @policylayer/intercept

github.com/policylayer/intercept →