send_group_msg

What send_group_msg does on NapCat MCP Server

AI agents use send_group_msg to create or update resources in NapCat MCP Server, usually the action step of a workflow, after the agent has gathered context. Every call changes real data in your NapCat MCP Server environment.

Why send_group_msg is rated Medium

send_group_msg creates new data (a group message) reversibly through the messaging API. It does not execute arbitrary code, delete data irreversibly, or move money. While it could be misused to spam or harass groups, the blast radius is contained to messaging communication. Severity is medium because misuse could disrupt group communication but does not cause permanent damage or financial harm.

From the tool's definition Tool name 'send_group_msg' and description 'Send group message' indicate the tool creates/posts a new message to a group. This is a write operation that modifies state (adds a message) but is reversible via deletion.

The rule that runs send_group_msg safely

PolicyLayer is an MCP gateway: it sits between your AI agents and NapCat MCP Server, and checks every tool call against a rule you set before the call runs. Nothing changes on the server itself. For send_group_msg, this is the rule to start with:

{
  "version": "1",
  "default": "deny",
  "tools": {
    "send_group_msg": {
      "limits": [
        {
          "counter": "send_group_msg_rate",
          "window": "minute",
          "max": 30,
          "scope": "grant"
        }
      ]
    }
  }
}

Questions about send_group_msg