finch_create_ecr_repo

What finch_create_ecr_repo does on AWS

AI agents use finch_create_ecr_repo to create or update resources in AWS, usually the action step of a workflow, after the agent has gathered context. Every call changes real data in your AWS environment.

Why finch_create_ecr_repo is rated Medium

Creating an ECR repository is a reversible write operation—repositories can be deleted if created in error. While it does create cloud infrastructure, it does not execute arbitrary code, delete data, or handle financial transactions. Severity is medium because uncontrolled repository creation could lead to resource sprawl and unexpected AWS costs, but the impact is limited compared to execute or destructive actions.

From the tool's definition Tool name 'finch_create_ecr_repo' indicates it creates an AWS ECR (Elastic Container Registry) repository. The verb 'create' and the absence of destructive language suggest this is a write operation that creates a new resource.

The rule that runs finch_create_ecr_repo safely

PolicyLayer is an MCP gateway: it sits between your AI agents and AWS, and checks every tool call against a rule you set before the call runs. Nothing changes on the server itself. For finch_create_ecr_repo, this is the rule to start with:

{
  "version": "1",
  "default": "deny",
  "tools": {
    "finch_create_ecr_repo": {
      "limits": [
        {
          "counter": "finch_create_ecr_repo_rate",
          "window": "minute",
          "max": 30,
          "scope": "grant"
        }
      ]
    }
  }
}

Questions about finch_create_ecr_repo