finch_build_container_image

What finch_build_container_image does on AWS

AI agents invoke finch_build_container_image to trigger actions in AWS. What it does depends on the arguments the agent supplies, and its effects often reach beyond the immediate call: builds kicked off, notifications sent, workflows started.

Why finch_build_container_image is rated High

Container image building is an Execute operation that triggers external build processes and can run arbitrary code defined in build configurations. While the description is empty, the sibling tools (AWS policy attachment, audit operations) suggest this is an AWS infrastructure tool, and container image builds are executable operations with effects dependent on build configuration arguments.

From the tool's definition Tool name 'finch_build_container_image' indicates execution of a container image build operation. Building container images involves executing build processes, potentially running arbitrary code embedded in Dockerfiles or build scripts.

The rule that runs finch_build_container_image safely

PolicyLayer is an MCP gateway: it sits between your AI agents and AWS, and checks every tool call against a rule you set before the call runs. Nothing changes on the server itself. For finch_build_container_image, this is the rule to start with:

{
  "version": "1",
  "default": "deny",
  "tools": {
    "finch_build_container_image": {
      "limits": [
        {
          "counter": "finch_build_container_image_rate",
          "window": "minute",
          "max": 10,
          "scope": "grant"
        }
      ]
    }
  }
}

Questions about finch_build_container_image