gen_image
Generate an image from a text prompt via FAL Flux. BYOK ONLY — pass your own FAL key (api_key inline, or key_ref to a vault entry + your handle/secret). Returns {ok, image_url, model}. The image URL is provider-hosted (may be ephemeral).
This record as markdown: /tools/com-wingmanprotocol-agent-gateway/gen-image.md
What gen_image does on Gateway
AI agents invoke gen_image to trigger actions in Gateway. What it does depends on the arguments the agent supplies, and its effects often reach beyond the immediate call: builds kicked off, notifications sent, workflows started.
| Parameter | Type | Required | Description |
|---|---|---|---|
model | string | — | fal-ai/flux/schnell (default) | flux/dev | flux/pro |
handle | string | — | your handle (for BYOK via vault) |
prompt | string | Yes | what to generate |
secret | string | — | your agent secret (for BYOK via vault) |
api_key | string | — | your FAL key (BYOK, inline) |
key_ref | string | — | vault entry holding your FAL key (BYOK alt) |
image_size | string | — | square_hd (default)|portrait_16_9|landscape_16_9|… |
Parameters from the server's own tool schema.
Why gen_image is rated High
This tool triggers an external AI image generation service (FAL Flux), which constitutes running an external operation whose effects depend on the prompt argument. It is not a simple read (it creates an artifact) nor a write to a local store (the image is provider-hosted and potentially ephemeral).
From the tool's definition Generate an image from a text prompt via FAL Flux... Returns {ok, image_url, model}
Risk signalsHandles credentials or secrets (api_key)
Attacks that exploit this kind of access
The rule that runs gen_image safely
PolicyLayer is an MCP gateway: it sits between your AI agents and Gateway, and checks every tool call against a rule you set before the call runs. Nothing changes on the server itself. For gen_image, this is the rule to start with:
gen_image stays usable, but rate-capped: a runaway agent can't fire it dozens of times a minute. Everything else on the server is denied unless you say otherwise.
The button opens the PolicyLayer dashboard: create your workspace, connect Gateway, apply this rule, and every gen_image call is checked against it from then on.
Questions about gen_image
Generate an image from a text prompt via FAL Flux. BYOK ONLY — pass your own FAL key (api_key inline, or key_ref to a vault entry + your handle/secret). Returns {ok, image_url, model}. The image URL is provider-hosted (may be ephemeral). It is categorised as a Execute tool in the Gateway MCP Server, which means it can trigger actions or run processes. Use rate limits and argument validation.
gen_image accepts 7 parameters: model, handle, prompt, secret, api_key, key_ref, image_size. Required: prompt. The full parameter table on this page comes from the server's own tool schema.
Register the Gateway MCP server in PolicyLayer and add a rule for gen_image: allow, deny, rate-limit, or require approval. Point your MCP client at the PolicyLayer proxy URL and the rule is enforced on every call, before it reaches Gateway. Nothing to install.
gen_image is a Execute tool with high risk. Execute tools should be rate-limited and have argument validation enabled.
Yes. Add a rate_limit block to the gen_image rule in your PolicyLayer policy. For example, setting max: 10 and window: 60 limits the tool to 10 calls per minute. Rate limits are tracked per agent session and reset automatically.
Set action: deny in the PolicyLayer policy for gen_image. The AI agent will receive a policy violation error and cannot call the tool. You can also include a reason field to explain why the tool is blocked.
gen_image is provided by the Gateway MCP server (https://wingmanprotocol.com/mcp). PolicyLayer sits as a proxy in front of this server to enforce policies before tool calls reach the server.
More on Gateway, and thousands of servers like it.
Across the catalogue