webhooks_rotate_secret

What webhooks_rotate_secret does on Munin

AI agents use webhooks_rotate_secret to create or update resources in Munin, usually the action step of a workflow, after the agent has gathered context. Every call changes real data in your Munin environment.

Why webhooks_rotate_secret is rated Medium

This tool creates or modifies a webhook secret, which is a reversible write operation. While it affects security credentials, rotating secrets is a standard administrative operation. Severity is medium because misuse could expose webhook authentication or break integrations if rotated without proper synchronization, but it's not destructive (old secret can be retained temporarily) and not financial.

From the tool's definition Tool name 'webhooks_rotate_secret' and description 'Generate a new' (incomplete but implies creation of a new secret value). The verb 'rotate' and 'generate' indicate creation/modification of authentication material.

The rule that runs webhooks_rotate_secret safely

PolicyLayer is an MCP gateway: it sits between your AI agents and Munin, and checks every tool call against a rule you set before the call runs. Nothing changes on the server itself. For webhooks_rotate_secret, this is the rule to start with:

{
  "version": "1",
  "default": "deny",
  "tools": {
    "webhooks_rotate_secret": {
      "limits": [
        {
          "counter": "webhooks_rotate_secret_rate",
          "window": "minute",
          "max": 30,
          "scope": "grant"
        }
      ]
    }
  }
}

Questions about webhooks_rotate_secret