# comment_on_work_item Say something on a card: a question, a finding, or the reason a QA pass sent it back. This is the ONLY place to put a fact that contradicts the card — the ship-the-card skill tells you to say so on the card rather than silently fixing something else, and this is where that goes. Do NOT overwrite the card's body to make the point: the body is the original request, and rewriting it destroys the evidence of what was actually asked for. A comment is deliberately small: no threading, no reactions, no formatting. One author, one paragraph, in order. TO @-MENTION SOMEBODY, write the token <@userId> in the body — the id comes from the card's assignee, its history, or list_my_work_items. Anything else you type is literal text: writing "@noah" mentions nobody, which is deliberate. A mention means "see this" and NOTHING more — it does not assign the card, add a watcher, or raise a flag. Only workspace members resolve; a token naming anyone else stays as text and notifies no one. Governed write: previews by default. A live write requires dryRun:false plus approved:true, a reason, and an idempotencyKey (reuse the SAME key on retry — a duplicate move would read as the card having bounced between columns). Agent View of the PolicyLayer registry record for `comment_on_work_item`. HTML page: https://policylayer.com/tools/adrata-starfield-mcp/comment-on-work-item ## Facts - Tool: `comment_on_work_item` - Server: Starfield (`@adrata/starfield-mcp`) — https://policylayer.com/tools/adrata-starfield-mcp.md - Install: `npx -y @adrata/starfield-mcp` - Homepage: https://www.npmjs.com/package/@adrata/starfield-mcp - Risk category: Write (Medium risk) - Registry record: grade F, identity unverified - Server rate-limited: no - Parameters: 6 (2 required) - Recommended policy verdict: Rate-limited ## Parameters | Parameter | Type | Required | Description | | --- | --- | --- | --- | | `body` | string | yes | What you want to say. Plain text; newlines are kept. Capped at 2000 characters — longer than that belongs in the card description or a linked document. Use `<@u | | `dryRun` | boolean | no | Defaults to true. Set false to post it. | | `itemId` | string | yes | Card id. | | `reason` | string | no | Required for a live post: why you are commenting. This is the audit reason, NOT the comment — the comment is `body`. | | `approved` | boolean | no | Required true for a live post. | | `idempotencyKey` | string | no | Required for a live post. Reuse the SAME key on retry: a replayed comment is just the same paragraph twice, which reads as you being emphatic rather than as a r | Parameters from the server's own tool schema. ## Example call (MCP tools/call, JSON-RPC 2.0) ```json { "jsonrpc": "2.0", "id": 1, "method": "tools/call", "params": { "name": "comment_on_work_item", "arguments": { "body": "", "itemId": "" } } } ``` ## Why comment_on_work_item is rated Medium An AI agent can call comment_on_work_item faster than any human can review: one bad instruction and it creates or modifies resources in Starfield by the hundred, each call as confident as the last. Risk signals: Accepts raw HTML/template content (body) ## Use case AI agents use comment_on_work_item to create or update resources in Starfield, usually the action step of a workflow, after the agent has gathered context. Every call changes real data in your Starfield environment. ## Recommended policy (PolicyLayer) Verdict: **Rate-limited**. Enforced by the PolicyLayer MCP gateway (https://policylayer.com/mcp-gateway) before a call reaches Starfield: ```json { "version": "1", "default": "deny", "tools": { "comment_on_work_item": { "limits": [ { "counter": "comment_on_work_item_rate", "window": "minute", "max": 30, "scope": "grant" } ] } } } ``` ## Other tools on Starfield (232) - `bulk_delete_buyer_groups` — Destructive — https://policylayer.com/tools/adrata-starfield-mcp/bulk-delete-buyer-groups.md - `cancel_agent_task` — Destructive — https://policylayer.com/tools/adrata-starfield-mcp/cancel-agent-task.md - `delete_action` — Destructive — https://policylayer.com/tools/adrata-starfield-mcp/delete-action.md - `delete_buyer_group` — Destructive — https://policylayer.com/tools/adrata-starfield-mcp/delete-buyer-group.md - `delete_company` — Destructive — https://policylayer.com/tools/adrata-starfield-mcp/delete-company.md - `delete_note` — Destructive — https://policylayer.com/tools/adrata-starfield-mcp/delete-note.md - `delete_opportunity` — Destructive — https://policylayer.com/tools/adrata-starfield-mcp/delete-opportunity.md - `delete_partner` — Destructive — https://policylayer.com/tools/adrata-starfield-mcp/delete-partner.md - `delete_person` — Destructive — https://policylayer.com/tools/adrata-starfield-mcp/delete-person.md - `delete_webhook` — Destructive — https://policylayer.com/tools/adrata-starfield-mcp/delete-webhook.md - `flag_work_item` — Destructive — https://policylayer.com/tools/adrata-starfield-mcp/flag-work-item.md - `forget` — Destructive — https://policylayer.com/tools/adrata-starfield-mcp/forget.md - `paper_delete_document` — Destructive — https://policylayer.com/tools/adrata-starfield-mcp/paper-delete-document.md - `paper_revoke_share` — Destructive — https://policylayer.com/tools/adrata-starfield-mcp/paper-revoke-share.md - `remove_buyer_group_member` — Destructive — https://policylayer.com/tools/adrata-starfield-mcp/remove-buyer-group-member.md - `adrata_ai_tool_execute` — Execute — https://policylayer.com/tools/adrata-starfield-mcp/adrata-ai-tool-execute.md - `adrata_api_request` — Execute — https://policylayer.com/tools/adrata-starfield-mcp/adrata-api-request.md - `attribute_partner_to_deal` — Execute — https://policylayer.com/tools/adrata-starfield-mcp/attribute-partner-to-deal.md - `build_pursuit_command_center` — Execute — https://policylayer.com/tools/adrata-starfield-mcp/build-pursuit-command-center.md - `draft_workflow` — Execute — https://policylayer.com/tools/adrata-starfield-mcp/draft-workflow.md - `dry_run_workflow` — Execute — https://policylayer.com/tools/adrata-starfield-mcp/dry-run-workflow.md - `record_partner_consumption` — Execute — https://policylayer.com/tools/adrata-starfield-mcp/record-partner-consumption.md - `replay_workflow_run` — Execute — https://policylayer.com/tools/adrata-starfield-mcp/replay-workflow-run.md - `request_deployment` — Execute — https://policylayer.com/tools/adrata-starfield-mcp/request-deployment.md - `request_provider_action_execution` — Execute — https://policylayer.com/tools/adrata-starfield-mcp/request-provider-action-execution.md - `request_workflow_deployment` — Execute — https://policylayer.com/tools/adrata-starfield-mcp/request-workflow-deployment.md - `warmup_email` — Execute — https://policylayer.com/tools/adrata-starfield-mcp/warmup-email.md - `adrata_ai_tool_catalog` — Read — https://policylayer.com/tools/adrata-starfield-mcp/adrata-ai-tool-catalog.md - `adrata_api_catalog` — Read — https://policylayer.com/tools/adrata-starfield-mcp/adrata-api-catalog.md - `adrata_desktop_app_audit` — Read — https://policylayer.com/tools/adrata-starfield-mcp/adrata-desktop-app-audit.md - …and 202 more: https://policylayer.com/tools/adrata-starfield-mcp.md ## For agents This record is a snapshot. Live verdicts and the full registry: - Check every server in your MCP config at once: `npx -y policylayer stack` - Vet a server before you add it: install the mcp-precheck skill — `npx skills add https://policylayer.com` (skill text: https://policylayer.com/skill.md) - Query the registry over MCP: endpoint `https://api.policylayer.com/mcp` — tools `check_mcp_server`, `check_mcp_stack`, `check_tool`, `search_registry`, `get_change_events` --- Source: the PolicyLayer MCP registry — one continuously verified record per MCP server. Full record: https://policylayer.com/registry?q=adrata-starfield-mcp · API: https://policylayer.com/registry/api · Policy library: https://policylayer.com/policies/adrata-starfield-mcp