derive_capability
Scan the company's connected source code (its GitHub repo, via the Pulse connection in Smart Tools) and DRAFT a capability list — shipped FEATURES (each citing the file that proves it) plus attempted can't-do LIMITS — for the operator to ratify. It writes NOTHING: only items the operator ratifies...
This record as markdown: /tools/com-getfreedomos-freedom-mcp/derive-capability.md
What derive_capability does on Freedom Mcp
AI agents call derive_capability to retrieve information from Freedom Mcp without modifying anything. It is typically the context-gathering step in research, monitoring, and reporting workflows, before the agent takes action elsewhere.
| Parameter | Type | Required | Description |
|---|---|---|---|
companyId | string | Yes | FreedomOS company id to act within (you must be a member). Required for company-scoped tools. |
Parameters from the server's own tool schema.
Why derive_capability is rated Low
This tool performs information retrieval and analysis of existing source code (GitHub repo). It scans and generates a draft report of features and limits, but makes no modifications to any system—all outputs require explicit operator ratification before becoming authoritative. The explicit 'read-only' statement and promise of no autonomous writes confirm it is Read category.
From the tool's definition Tool description explicitly states: 'It writes NOTHING: only items the operator ratifies become authoritative' and 'Read-only; never executes or sends code.' The tool scans source code and drafts a capability list for operator review without persisting any…
Attacks that exploit this kind of access
The rule that runs derive_capability safely
PolicyLayer is an MCP gateway: it sits between your AI agents and Freedom Mcp, and checks every tool call against a rule you set before the call runs. Nothing changes on the server itself. For derive_capability, this is the rule to start with:
derive_capability is read-only, so it stays allowed. Everything else on the server is denied unless you say otherwise.
The button opens the PolicyLayer dashboard: create your workspace, connect Freedom Mcp, apply this rule, and every derive_capability call is checked against it from then on.
Questions about derive_capability
Scan the company's connected source code (its GitHub repo, via the Pulse connection in Smart Tools) and DRAFT a capability list — shipped FEATURES (each citing the file that proves it) plus attempted can't-do LIMITS — for the operator to ratify. It writes NOTHING: only items the operator ratifies become authoritative capability the marketing agents and the Integrity Gate use. Read-only; never executes or sends code. If no repo is connected it tells the operator to connect one in Pulse first. Use to populate or refresh a software product's capabilities without hand-maintaining them. Routing: Operator wants to pull their product's real features from its code (instead of typing them) → use this [sensitive-tier — first use may require a manager's approval; a from-now-on approval makes future calls seamless, a just-once approval re-asks next time.]. It is categorised as a Read tool in the Freedom Mcp MCP Server, which means it retrieves data without modifying state.
derive_capability accepts 1 parameter: companyId. Required: companyId. The full parameter table on this page comes from the server's own tool schema.
Register the Freedom MCP server in PolicyLayer and add a rule for derive_capability: allow, deny, rate-limit, or require approval. Point your MCP client at the PolicyLayer proxy URL and the rule is enforced on every call, before it reaches Freedom Mcp. Nothing to install.
derive_capability is a Read tool with low risk. Read-only tools are generally safe to allow by default.
Yes. Add a rate_limit block to the derive_capability rule in your PolicyLayer policy. For example, setting max: 10 and window: 60 limits the tool to 10 calls per minute. Rate limits are tracked per agent session and reset automatically.
Set action: deny in the PolicyLayer policy for derive_capability. The AI agent will receive a policy violation error and cannot call the tool. You can also include a reason field to explain why the tool is blocked.
derive_capability is provided by the Freedom MCP server (https://twuluxmoognlwtmaoqgo.supabase.co/functions/v1/freedom-mcp). PolicyLayer sits as a proxy in front of this server to enforce policies before tool calls reach the server.
More on Freedom, and thousands of servers like it.
This server
Across the catalogue