# cms_upload_asset_from_url Fetch a publicly reachable HTTPS asset and store it as a CMS asset in one call. Use this when your runtime cannot PUT to a presigned URL or pass large base64 payloads — typical for ChatGPT/Claude workspace agents whose sandbox blocks outbound PUTs and truncates long base64 strings. The server fetches the URL with SSRF protection, validates content-type (image/*, video/*, audio/*, application/pdf — SVG rejected) and size (≤50 MB), and creates the asset row in Agent View of the PolicyLayer registry record for `cms_upload_asset_from_url`. HTML page: https://policylayer.com/tools/com-getmunin-munin/cms-upload-asset-from-url ## Facts - Tool: `cms_upload_asset_from_url` - Server: Munin (`https://mcp.getmunin.com/mcp`) — https://policylayer.com/tools/com-getmunin-munin.md - Homepage: https://github.com/getmunin/munin - Risk category: Write (Medium risk) - Registry record: grade D, identity unverified - Server auth posture: gated - Server rate-limited: no - Parameters: 0 - Recommended policy verdict: Rate-limited ## Example call (MCP tools/call, JSON-RPC 2.0) ```json { "jsonrpc": "2.0", "id": 1, "method": "tools/call", "params": { "name": "cms_upload_asset_from_url", "arguments": {} } } ``` ## Why cms_upload_asset_from_url is rated Medium This tool creates new assets in the CMS by fetching and storing content. It is a Write operation because it persistently adds data to the system. Severity is medium because while asset creation itself is reversible, uncontrolled uploads could introduce malicious content (images, videos, PDFs with embedded exploits) that affects many users or violates content policy. From the tool's own definition: "'store it as a CMS asset' and 'creates the asset row' indicate data creation/modification in a content management system without deletion or reversion barriers" ## Use case AI agents use cms_upload_asset_from_url to create or update resources in Munin, usually the action step of a workflow, after the agent has gathered context. Every call changes real data in your Munin environment. ## Recommended policy (PolicyLayer) Verdict: **Rate-limited**. Enforced by the PolicyLayer MCP gateway (https://policylayer.com/mcp-gateway) before a call reaches Munin: ```json { "version": "1", "default": "deny", "tools": { "cms_upload_asset_from_url": { "limits": [ { "counter": "cms_upload_asset_from_url_rate", "window": "minute", "max": 30, "scope": "grant" } ] } } } ``` ## Other tools on Munin (241) - `analytics_revoke_tracker` — Destructive — https://policylayer.com/tools/com-getmunin-munin/analytics-revoke-tracker.md - `analytics_rotate_tracker_key` — Destructive — https://policylayer.com/tools/com-getmunin-munin/analytics-rotate-tracker-key.md - `bookings_cancel_booking` — Destructive — https://policylayer.com/tools/com-getmunin-munin/bookings-cancel-booking.md - `bookings_cancel_my_booking` — Destructive — https://policylayer.com/tools/com-getmunin-munin/bookings-cancel-my-booking.md - `cms_delete_asset` — Destructive — https://policylayer.com/tools/com-getmunin-munin/cms-delete-asset.md - `cms_delete_collection` — Destructive — https://policylayer.com/tools/com-getmunin-munin/cms-delete-collection.md - `cms_delete_entry` — Destructive — https://policylayer.com/tools/com-getmunin-munin/cms-delete-entry.md - `connectors_delete_connection` — Destructive — https://policylayer.com/tools/com-getmunin-munin/connectors-delete-connection.md - `conv_delete_attachment` — Destructive — https://policylayer.com/tools/com-getmunin-munin/conv-delete-attachment.md - `conv_rotate_widget_key` — Destructive — https://policylayer.com/tools/com-getmunin-munin/conv-rotate-widget-key.md - `crm_delete_segment` — Destructive — https://policylayer.com/tools/com-getmunin-munin/crm-delete-segment.md - `kb_delete_document` — Destructive — https://policylayer.com/tools/com-getmunin-munin/kb-delete-document.md - `kb_dismiss_curation_candidate` — Destructive — https://policylayer.com/tools/com-getmunin-munin/kb-dismiss-curation-candidate.md - `outreach_cancel_scheduled_send` — Destructive — https://policylayer.com/tools/com-getmunin-munin/outreach-cancel-scheduled-send.md - `slack_unlink_user` — Destructive — https://policylayer.com/tools/com-getmunin-munin/slack-unlink-user.md - `webhooks_delete` — Destructive — https://policylayer.com/tools/com-getmunin-munin/webhooks-delete.md - `conv_request_callback` — Execute — https://policylayer.com/tools/com-getmunin-munin/conv-request-callback.md - `conv_retry_delivery` — Execute — https://policylayer.com/tools/com-getmunin-munin/conv-retry-delivery.md - `conv_send_email_channel_test` — Execute — https://policylayer.com/tools/com-getmunin-munin/conv-send-email-channel-test.md - `conv_send_sms_channel_test` — Execute — https://policylayer.com/tools/com-getmunin-munin/conv-send-sms-channel-test.md - `conv_test_email_channel` — Execute — https://policylayer.com/tools/com-getmunin-munin/conv-test-email-channel.md - `conv_test_voice_sms_channel` — Execute — https://policylayer.com/tools/com-getmunin-munin/conv-test-voice-sms-channel.md - `outreach_approve_proposal` — Execute — https://policylayer.com/tools/com-getmunin-munin/outreach-approve-proposal.md - `seo_submit_urls` — Execute — https://policylayer.com/tools/com-getmunin-munin/seo-submit-urls.md - `cancel_subscription` — Financial — https://policylayer.com/tools/com-getmunin-munin/cancel-subscription.md - `outreach_withdraw_proposal` — Financial — https://policylayer.com/tools/com-getmunin-munin/outreach-withdraw-proposal.md - `analytics_export_config` — Read — https://policylayer.com/tools/com-getmunin-munin/analytics-export-config.md - `analytics_export_events` — Read — https://policylayer.com/tools/com-getmunin-munin/analytics-export-events.md - `analytics_get_contact_journey` — Read — https://policylayer.com/tools/com-getmunin-munin/analytics-get-contact-journey.md - `analytics_get_funnel` — Read — https://policylayer.com/tools/com-getmunin-munin/analytics-get-funnel.md - …and 211 more: https://policylayer.com/tools/com-getmunin-munin.md ## For agents This record is a snapshot. Live verdicts and the full registry: - Check every server in your MCP config at once: `npx -y policylayer stack` - Vet a server before you add it: install the mcp-precheck skill — `npx skills add https://policylayer.com` (skill text: https://policylayer.com/skill.md) - Query the registry over MCP: endpoint `https://api.policylayer.com/mcp` — tools `check_mcp_server`, `check_mcp_stack`, `check_tool`, `search_registry`, `get_change_events` --- Source: the PolicyLayer MCP registry — one continuously verified record per MCP server. Full record: https://policylayer.com/registry?q=com-getmunin-munin · API: https://policylayer.com/registry/api · Policy library: https://policylayer.com/policies/com-getmunin-munin