Permanently delete a Blueprint and all of its API keys. DESTRUCTIVE — cannot be undone. Cascading effects: - The Blueprint's template_config.json is removed from disk. - All Blueprint-scoped API keys for this workflow are deleted. Any agents using those keys will start receiving auth errors on th...
Risk signalsHandles credentials or secrets (api_key) · Bulk/mass operation — affects multiple targets
Part of the Governance Platform server.
Free to start. No card required.
AI agents may call delete_blueprint to permanently remove or destroy resources in Governance Platform. Without a policy, an autonomous agent could delete critical data in a loop with no way to undo the damage. PolicyLayer blocks destructive tools by default and requires explicit human approval before enabling them.
Without a policy, an AI agent could call delete_blueprint in a loop, permanently destroying resources in Governance Platform. There is no undo for destructive operations. PolicyLayer blocks this tool by default and only allows it when a human explicitly approves the action.
Destructive tools permanently remove data. Block by default. Only enable with explicit approval workflows.
{
"version": "1",
"default": "deny",
"hide": [
"delete_blueprint"
]
}See the full Governance Platform policy for all 31 tools.
These attack patterns abuse exactly the kind of access delete_blueprint gives an agent. Each links to the full case and the policy that stops it:
Other destructive tools across the catalogue. The same approach applies to each: deny by default, or require human approval.
Permanently delete a Blueprint and all of its API keys. DESTRUCTIVE — cannot be undone. Cascading effects: - The Blueprint's template_config.json is removed from disk. - All Blueprint-scoped API keys for this workflow are deleted. Any agents using those keys will start receiving auth errors on their next call. - The Blueprint is removed from the platform's template registry. Account-level keys are NOT affected. Only the per-Blueprint keys minted at create time (or via this Blueprint's UI) are revoked. Use list_blueprints first to confirm the workflow_name. The caller must own the Blueprint — cross-account deletion is rejected. Different from update_blueprint: update_blueprint replaces the config in place and keeps the API keys; delete_blueprint removes everything. Args: api_key: GeodesicAI API key (starts with gai_) workflow_name: Name of the Blueprint to delete (the same value used as 'blueprint' in validate) confirm: Must be set to true to actually delete. If false, the tool returns a preview of what would be deleted without performing the deletion. Default: false. Returns: status: "ok" | "preview" | "ERROR" deleted: workflow_name that was removed (only on ok) keys_revoked: number of Blueprint API keys revoked message: human-readable summary. It is categorised as a Destructive tool in the Governance Platform MCP Server, which means it can permanently delete or destroy data. Block by default and require explicit approval.
Register the Governance Platform MCP server in PolicyLayer and add a rule for delete_blueprint: allow, deny, rate-limit, or require approval. Point your MCP client at the PolicyLayer proxy URL and the rule is enforced on every call, before it reaches Governance Platform. Nothing to install.
delete_blueprint is a Destructive tool with critical risk. Critical-risk tools should be blocked by default and only enabled with explicit human approval.
Yes. Add a rate_limit block to the delete_blueprint rule in your PolicyLayer policy. For example, setting max: 10 and window: 60 limits the tool to 10 calls per minute. Rate limits are tracked per agent session and reset automatically.
Set action: deny in the PolicyLayer policy for delete_blueprint. The AI agent will receive a policy violation error and cannot call the tool. You can also include a reason field to explain why the tool is blocked.
delete_blueprint is provided by the Governance Platform MCP server (https://app.geodesiclabs.ai/mcp). PolicyLayer sits as a proxy in front of this server to enforce policies before tool calls reach the server.
Deterministic rules across all 31 Governance Platform tools. Per-identity grants. Full audit log. Live in minutes. Nothing to install.
Free to start. No card required.
4,600+ MCP servers and 31,000+ tools scanned and risk-classified.