lifecycle_transition

SERVERServicialo SOURCE@servicialo/mcp-server

High RISK CLASS

Category Execute

Parameters 92 required

Recommended Rate-limitedsee the rule below

Registry record Grade F, identity unverified Pull the record →

This record as markdown: /tools/com-servicialo-mcp-server/lifecycle-transition.md

WHAT IT DOES

What lifecycle_transition does on Servicialo

AI agents invoke lifecycle_transition to trigger actions in Servicialo. What it does depends on the arguments the agent supplies, and its effects often reach beyond the immediate call: builds kicked off, notifications sent, workflows started.

Parameter	Type	Required
`notes`	string	—
`action`	string	—
`apiKey`	string	—
`orgSlug`	string	Yes
`evidence`	object	—
`to_state`	string	—
`session_id`	string	Yes
`no_show_type`	string	—
`delivery_type`	string	—

Parameters from the server's own tool schema.

RISK

Why lifecycle_transition is rated High

This tool executes state transitions on sessions, which are external operations with real-world consequences (e.g., cancelling a session, marking no-show, confirming appointments). These are not simple writes — they trigger workflow state changes that may be irreversible (cancel, no_show) or have downstream effects on service delivery.

From the tool's definition 'Execute a state transition on a session' with actions including confirm, start, complete, verify, document, cancel, no_show — these trigger external state machine operations on live service sessions

Risk signalsHandles credentials or secrets (apiKey)

Attacks that exploit this kind of access

RECOMMENDED RULE

The rule that runs lifecycle_transition safely

PolicyLayer is an MCP gateway: it sits between your AI agents and Servicialo, and checks every tool call against a rule you set before the call runs. Nothing changes on the server itself. For lifecycle_transition, this is the rule to start with:

lifecycle_transition Rate-limited

lifecycle_transition stays usable, but rate-capped: a runaway agent can't fire it dozens of times a minute. Everything else on the server is denied unless you say otherwise.

View as policy code

policy.json

{
  "version": "1",
  "default": "deny",
  "tools": {
    "lifecycle_transition": {
      "limits": [
        {
          "counter": "lifecycle_transition_rate",
          "window": "minute",
          "max": 10,
          "scope": "grant"
        }
      ]
    }
  }
}

RATE-LIMIT THIS TOOL → Instant setup, no code required.

The button opens the PolicyLayer dashboard: create your workspace, connect Servicialo, apply this rule, and every lifecycle_transition call is checked against it from then on.

FAQ

Questions about lifecycle_transition

What does the lifecycle_transition tool do? +

Execute a state transition on a session. Accepts either to_state (target state name per Servicialo spec: confirmed, in_progress, completed, verified, documented, cancelled, no_show) or action (semantic verb: confirm, start, complete, verify, document, cancel, no_show). When to_state=no_show, no_show_type is required. NOTE: to_state="delivered" / action="deliver" is NOT available via MCP (ref PDC-SEC-001) — MCP authentication cannot validate actor-as-Proveedor. Delivery must be performed via the REST endpoint PATCH /api/organizations/[orgSlug]/coordinalo/sessions/[sessionId]/deliver which enforces provider binding. Returns transition record with from, to, at, by, method fields. Requires X-Org-Api-Key. It is categorised as a Execute tool in the Servicialo MCP Server, which means it can trigger actions or run processes. Use rate limits and argument validation.

What parameters does lifecycle_transition accept? +

lifecycle_transition accepts 9 parameters: notes, action, apiKey, orgSlug, evidence, to_state, session_id, no_show_type, delivery_type. Required: orgSlug, session_id. The full parameter table on this page comes from the server's own tool schema.

How do I enforce a policy on lifecycle_transition? +

Register the Servicialo MCP server in PolicyLayer and add a rule for lifecycle_transition: allow, deny, rate-limit, or require approval. Point your MCP client at the PolicyLayer proxy URL and the rule is enforced on every call, before it reaches Servicialo. Nothing to install.

What risk level is lifecycle_transition? +

lifecycle_transition is a Execute tool with high risk. Execute tools should be rate-limited and have argument validation enabled.

Can I rate-limit lifecycle_transition? +

Yes. Add a rate_limit block to the lifecycle_transition rule in your PolicyLayer policy. For example, setting max: 10 and window: 60 limits the tool to 10 calls per minute. Rate limits are tracked per agent session and reset automatically.

How do I block lifecycle_transition completely? +

Set action: deny in the PolicyLayer policy for lifecycle_transition. The AI agent will receive a policy violation error and cannot call the tool. You can also include a reason field to explain why the tool is blocked.

What MCP server provides lifecycle_transition? +

lifecycle_transition is provided by the Servicialo MCP server (@servicialo/mcp-server). PolicyLayer sits as a proxy in front of this server to enforce policies before tool calls reach the server.

KEEP EXPLORING

More on Servicialo, and thousands of servers like it.

This server

All 111 Servicialo tools → High-risk tools on this server →

Across the catalogue

All high-risk MCP tools → The MCP Attack Database →

Guides

Govern code and CI agents →Agent sandbox →Least privilege for MCP →