# cms_upload_asset_from_base64 Upload a small asset inline as base64 (≤100 KB decoded). The right choice when you have generated the asset in this conversation (image-gen output, screenshot, plot) and need it in the CMS without leaving the chat: compress to WebP or JPEG well under 100 KB first, then pass the bytes here. SVG is rejected. For larger assets reachable over HTTPS use Agent View of the PolicyLayer registry record for `cms_upload_asset_from_base64`. HTML page: https://policylayer.com/tools/com-getmunin-munin/cms-upload-asset-from-base64 ## Facts - Tool: `cms_upload_asset_from_base64` - Server: Munin (`https://mcp.getmunin.com/mcp`) — https://policylayer.com/tools/com-getmunin-munin.md - Homepage: https://github.com/getmunin/munin - Risk category: Write (Medium risk) - Registry record: grade D, identity unverified - Server auth posture: gated - Server rate-limited: no - Parameters: 0 - Recommended policy verdict: Rate-limited ## Example call (MCP tools/call, JSON-RPC 2.0) ```json { "jsonrpc": "2.0", "id": 1, "method": "tools/call", "params": { "name": "cms_upload_asset_from_base64", "arguments": {} } } ``` ## Why cms_upload_asset_from_base64 is rated Medium The tool creates and stores new assets in the CMS system, making it a Write action. Severity is medium because: (1) it has built-in constraints (≤100 KB, no SVG) that limit damage scope, (2) uploads are generally reversible (assets can be deleted), and (3) the impact is localized to media storage rather than core data or user accounts. From the tool's own definition: "Tool description states 'Upload a small asset inline as base64', which is a create/write operation that adds new data to the CMS. The description explicitly frames this as uploading/storing content." ## Use case AI agents use cms_upload_asset_from_base64 to create or update resources in Munin, usually the action step of a workflow, after the agent has gathered context. Every call changes real data in your Munin environment. ## Recommended policy (PolicyLayer) Verdict: **Rate-limited**. Enforced by the PolicyLayer MCP gateway (https://policylayer.com/mcp-gateway) before a call reaches Munin: ```json { "version": "1", "default": "deny", "tools": { "cms_upload_asset_from_base64": { "limits": [ { "counter": "cms_upload_asset_from_base64_rate", "window": "minute", "max": 30, "scope": "grant" } ] } } } ``` ## Other tools on Munin (241) - `analytics_revoke_tracker` — Destructive — https://policylayer.com/tools/com-getmunin-munin/analytics-revoke-tracker.md - `analytics_rotate_tracker_key` — Destructive — https://policylayer.com/tools/com-getmunin-munin/analytics-rotate-tracker-key.md - `bookings_cancel_booking` — Destructive — https://policylayer.com/tools/com-getmunin-munin/bookings-cancel-booking.md - `bookings_cancel_my_booking` — Destructive — https://policylayer.com/tools/com-getmunin-munin/bookings-cancel-my-booking.md - `cms_delete_asset` — Destructive — https://policylayer.com/tools/com-getmunin-munin/cms-delete-asset.md - `cms_delete_collection` — Destructive — https://policylayer.com/tools/com-getmunin-munin/cms-delete-collection.md - `cms_delete_entry` — Destructive — https://policylayer.com/tools/com-getmunin-munin/cms-delete-entry.md - `connectors_delete_connection` — Destructive — https://policylayer.com/tools/com-getmunin-munin/connectors-delete-connection.md - `conv_delete_attachment` — Destructive — https://policylayer.com/tools/com-getmunin-munin/conv-delete-attachment.md - `conv_rotate_widget_key` — Destructive — https://policylayer.com/tools/com-getmunin-munin/conv-rotate-widget-key.md - `crm_delete_segment` — Destructive — https://policylayer.com/tools/com-getmunin-munin/crm-delete-segment.md - `kb_delete_document` — Destructive — https://policylayer.com/tools/com-getmunin-munin/kb-delete-document.md - `kb_dismiss_curation_candidate` — Destructive — https://policylayer.com/tools/com-getmunin-munin/kb-dismiss-curation-candidate.md - `outreach_cancel_scheduled_send` — Destructive — https://policylayer.com/tools/com-getmunin-munin/outreach-cancel-scheduled-send.md - `slack_unlink_user` — Destructive — https://policylayer.com/tools/com-getmunin-munin/slack-unlink-user.md - `webhooks_delete` — Destructive — https://policylayer.com/tools/com-getmunin-munin/webhooks-delete.md - `conv_request_callback` — Execute — https://policylayer.com/tools/com-getmunin-munin/conv-request-callback.md - `conv_retry_delivery` — Execute — https://policylayer.com/tools/com-getmunin-munin/conv-retry-delivery.md - `conv_send_email_channel_test` — Execute — https://policylayer.com/tools/com-getmunin-munin/conv-send-email-channel-test.md - `conv_send_sms_channel_test` — Execute — https://policylayer.com/tools/com-getmunin-munin/conv-send-sms-channel-test.md - `conv_test_email_channel` — Execute — https://policylayer.com/tools/com-getmunin-munin/conv-test-email-channel.md - `conv_test_voice_sms_channel` — Execute — https://policylayer.com/tools/com-getmunin-munin/conv-test-voice-sms-channel.md - `outreach_approve_proposal` — Execute — https://policylayer.com/tools/com-getmunin-munin/outreach-approve-proposal.md - `seo_submit_urls` — Execute — https://policylayer.com/tools/com-getmunin-munin/seo-submit-urls.md - `cancel_subscription` — Financial — https://policylayer.com/tools/com-getmunin-munin/cancel-subscription.md - `outreach_withdraw_proposal` — Financial — https://policylayer.com/tools/com-getmunin-munin/outreach-withdraw-proposal.md - `analytics_export_config` — Read — https://policylayer.com/tools/com-getmunin-munin/analytics-export-config.md - `analytics_export_events` — Read — https://policylayer.com/tools/com-getmunin-munin/analytics-export-events.md - `analytics_get_contact_journey` — Read — https://policylayer.com/tools/com-getmunin-munin/analytics-get-contact-journey.md - `analytics_get_funnel` — Read — https://policylayer.com/tools/com-getmunin-munin/analytics-get-funnel.md - …and 211 more: https://policylayer.com/tools/com-getmunin-munin.md ## For agents This record is a snapshot. Live verdicts and the full registry: - Check every server in your MCP config at once: `npx -y policylayer stack` - Vet a server before you add it: install the mcp-precheck skill — `npx skills add https://policylayer.com` (skill text: https://policylayer.com/skill.md) - Query the registry over MCP: endpoint `https://api.policylayer.com/mcp` — tools `check_mcp_server`, `check_mcp_stack`, `check_tool`, `search_registry`, `get_change_events` --- Source: the PolicyLayer MCP registry — one continuously verified record per MCP server. Full record: https://policylayer.com/registry?q=com-getmunin-munin · API: https://policylayer.com/registry/api · Policy library: https://policylayer.com/policies/com-getmunin-munin