# lifecycle_transition

Execute a state transition on a session. Accepts either to_state (target state name per Servicialo spec: confirmed, in_progress, completed, verified, documented, cancelled, no_show) or action (semantic verb: confirm, start, complete, verify, document, cancel, no_show). When to_state=no_show, no_show_type is required. NOTE: to_state="delivered" / action="deliver" is NOT available via MCP (ref PDC-SEC-001) — MCP authentication cannot validate actor-as-Proveedor. Delivery must be performed via the REST endpoint PATCH /api/organizations/[orgSlug]/coordinalo/sessions/[sessionId]/deliver which enforces provider binding. Returns transition record with from, to, at, by, method fields. Requires X-Org-Api-Key.

Agent View of the PolicyLayer registry record for `lifecycle_transition`. HTML page: https://policylayer.com/tools/com-servicialo-mcp-server/lifecycle-transition

## Facts

- Tool: `lifecycle_transition`
- Server: Servicialo (`@servicialo/mcp-server`) — https://policylayer.com/tools/com-servicialo-mcp-server.md
- Install: `npx -y @servicialo/mcp-server`
- Homepage: https://github.com/servicialo/mcp-server
- Risk category: Execute (High risk)
- Registry record: grade F, identity unverified
- Server auth posture: open
- Server CORS policy: *
- Server rate-limited: no
- Parameters: 9 (2 required)
- Recommended policy verdict: Rate-limited

## Parameters

| Parameter | Type | Required | Description |
| --- | --- | --- | --- |
| `notes` | string | no |  |
| `action` | string | no |  |
| `apiKey` | string | no |  |
| `orgSlug` | string | yes |  |
| `evidence` | object | no |  |
| `to_state` | string | no |  |
| `session_id` | string | yes |  |
| `no_show_type` | string | no |  |
| `delivery_type` | string | no |  |

Parameters from the server's own tool schema.

## Example call (MCP tools/call, JSON-RPC 2.0)

```json
{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "lifecycle_transition",
    "arguments": {
      "orgSlug": "<orgSlug>",
      "session_id": "<session_id>"
    }
  }
}
```

## Why lifecycle_transition is rated High

This tool executes state transitions on sessions, which are external operations with real-world consequences (e.g., cancelling a session, marking no-show, confirming appointments). These are not simple writes — they trigger workflow state changes that may be irreversible (cancel, no_show) or have downstream effects on service delivery.

From the tool's own definition: "'Execute a state transition on a session' with actions including confirm, start, complete, verify, document, cancel, no_show — these trigger external state machine operations on live service sessions"

Risk signals: Handles credentials or secrets (apiKey)

## Use case

AI agents invoke lifecycle_transition to trigger actions in Servicialo. What it does depends on the arguments the agent supplies, and its effects often reach beyond the immediate call: builds kicked off, notifications sent, workflows started.

## Recommended policy (PolicyLayer)

Verdict: **Rate-limited**. Enforced by the PolicyLayer MCP gateway (https://policylayer.com/mcp-gateway) before a call reaches Servicialo:

```json
{
  "version": "1",
  "default": "deny",
  "tools": {
    "lifecycle_transition": {
      "limits": [
        {
          "counter": "lifecycle_transition_rate",
          "window": "minute",
          "max": 10,
          "scope": "grant"
        }
      ]
    }
  }
}
```

## Other tools on Servicialo (110)

- `agendas_delete` — Destructive — https://policylayer.com/tools/com-servicialo-mcp-server/agendas-delete.md
- `cierre_cerrar_org` — Destructive — https://policylayer.com/tools/com-servicialo-mcp-server/cierre-cerrar-org.md
- `cierre_eliminar_cliente` — Destructive — https://policylayer.com/tools/com-servicialo-mcp-server/cierre-eliminar-cliente.md
- `email_domain_delete` — Destructive — https://policylayer.com/tools/com-servicialo-mcp-server/email-domain-delete.md
- `portal_cancel_reschedule_request` — Destructive — https://policylayer.com/tools/com-servicialo-mcp-server/portal-cancel-reschedule-request.md
- `portal_session_cancel` — Destructive — https://policylayer.com/tools/com-servicialo-mcp-server/portal-session-cancel.md
- `public_booking_cancel` — Destructive — https://policylayer.com/tools/com-servicialo-mcp-server/public-booking-cancel.md
- `comms_send_campaign` — Execute — https://policylayer.com/tools/com-servicialo-mcp-server/comms-send-campaign.md
- `email_domain_verify` — Execute — https://policylayer.com/tools/com-servicialo-mcp-server/email-domain-verify.md
- `booking_cancel` — Financial — https://policylayer.com/tools/com-servicialo-mcp-server/booking-cancel.md
- `cierre_crear_cliente` — Financial — https://policylayer.com/tools/com-servicialo-mcp-server/cierre-crear-cliente.md
- `cierre_distribuir_utilidades` — Financial — https://policylayer.com/tools/com-servicialo-mcp-server/cierre-distribuir-utilidades.md
- `finance_create_cobro` — Financial — https://policylayer.com/tools/com-servicialo-mcp-server/finance-create-cobro.md
- `finance_create_venta` — Financial — https://policylayer.com/tools/com-servicialo-mcp-server/finance-create-venta.md
- `finance_register_payment` — Financial — https://policylayer.com/tools/com-servicialo-mcp-server/finance-register-payment.md
- `finance_send_confirmations` — Financial — https://policylayer.com/tools/com-servicialo-mcp-server/finance-send-confirmations.md
- `admin_list_providers` — Read — https://policylayer.com/tools/com-servicialo-mcp-server/admin-list-providers.md
- `agendas_get` — Read — https://policylayer.com/tools/com-servicialo-mcp-server/agendas-get.md
- `agendas_list` — Read — https://policylayer.com/tools/com-servicialo-mcp-server/agendas-list.md
- `availability_get_provider_schedule` — Read — https://policylayer.com/tools/com-servicialo-mcp-server/availability-get-provider-schedule.md
- `availability_get_slots` — Read — https://policylayer.com/tools/com-servicialo-mcp-server/availability-get-slots.md
- `booking_get` — Read — https://policylayer.com/tools/com-servicialo-mcp-server/booking-get.md
- `booking_list` — Read — https://policylayer.com/tools/com-servicialo-mcp-server/booking-list.md
- `booking_list_requests` — Read — https://policylayer.com/tools/com-servicialo-mcp-server/booking-list-requests.md
- `cierre_evaluar_org` — Read — https://policylayer.com/tools/com-servicialo-mcp-server/cierre-evaluar-org.md
- `cierre_listar_clientes` — Read — https://policylayer.com/tools/com-servicialo-mcp-server/cierre-listar-clientes.md
- `cierre_listar_utilidades` — Read — https://policylayer.com/tools/com-servicialo-mcp-server/cierre-listar-utilidades.md
- `cierre_preview_cliente` — Read — https://policylayer.com/tools/com-servicialo-mcp-server/cierre-preview-cliente.md
- `client_get` — Read — https://policylayer.com/tools/com-servicialo-mcp-server/client-get.md
- `client_list` — Read — https://policylayer.com/tools/com-servicialo-mcp-server/client-list.md
- …and 80 more: https://policylayer.com/tools/com-servicialo-mcp-server.md

## For agents

This record is a snapshot. Live verdicts and the full registry:

- Check every server in your MCP config at once: `npx -y policylayer stack`
- Vet a server before you add it: install the mcp-precheck skill — `npx skills add https://policylayer.com` (skill text: https://policylayer.com/skill.md)
- Query the registry over MCP: endpoint `https://api.policylayer.com/mcp` — tools `check_mcp_server`, `check_mcp_stack`, `check_tool`, `search_registry`, `get_change_events`

---

Source: the PolicyLayer MCP registry — one continuously verified record per MCP server. Full record: https://policylayer.com/registry?q=com-servicialo-mcp-server · API: https://policylayer.com/registry/api · Policy library: https://policylayer.com/policies/com-servicialo-mcp-server