consensus-step

SERVERDeliberation SOURCEantonbabenko/deliberation

High RISK CLASS

Category Execute

Parameters 00 required

Recommended Rate-limitedsee the rule below

Registry record Grade F, identity unverified Pull the record →

This record as markdown: /tools/deliberation/consensus-step.md

WHAT IT DOES

What consensus-step does on Deliberation

AI agents invoke consensus-step to trigger actions in Deliberation. What it does depends on the arguments the agent supplies, and its effects often reach beyond the immediate call: builds kicked off, notifications sent, workflows started.

RISK

Why consensus-step is rated High

This tool executes external operations (API calls to Codex, Gemini, Grok, OpenRouter models) whose side effects are deterministic but outcome-dependent on the host model's inputs and iterative decisions. It is not Read (generates structured outcomes, not just retrieval), not Write (no persistent data creation by this tool), not Destructive (ephemeral session store, no irreversible changes), not Financial.

From the tool's definition Tool description states it 'fans out to the providers' and makes external API calls via 'dispatch_peers action calls external providers', triggering unbounded execution across 400+ models.

Risk signalsBulk/mass operation — affects multiple targets

Attacks that exploit this kind of access

RECOMMENDED RULE

The rule that runs consensus-step safely

PolicyLayer is an MCP gateway: it sits between your AI agents and Deliberation, and checks every tool call against a rule you set before the call runs. Nothing changes on the server itself. For consensus-step, this is the rule to start with:

consensus-step Rate-limited

consensus-step stays usable, but rate-capped: a runaway agent can't fire it dozens of times a minute. Everything else on the server is denied unless you say otherwise.

View as policy code

policy.json

{
  "version": "1",
  "default": "deny",
  "tools": {
    "consensus-step": {
      "limits": [
        {
          "counter": "consensus-step_rate",
          "window": "minute",
          "max": 10,
          "scope": "grant"
        }
      ]
    }
  }
}

RATE-LIMIT THIS TOOL → Instant setup, no code required.

The button opens the PolicyLayer dashboard: create your workspace, connect Deliberation, apply this rule, and every consensus-step call is checked against it from then on.

FAQ

Questions about consensus-step

What does the consensus-step tool do? +

Client-driven consensus loop where YOU (the host model) are the arbiter, one action per call: init (returns sessionId + blind prompt) -> record_blind (your pre-commit verdict) -> dispatch_peers (server fans out to the providers) -> submit_adjudication (your verdict + per-issue accept/dismiss/defer) -> submit_revision (your revised plan), looping until converged or consensus.maxRounds rounds (default 5). Only the dispatch_peers action calls external providers; the others are local transitions on the ephemeral per-session loop store (keyed by sessionId, lost on server restart). Each call returns a text-wrapped JSON envelope with the next status/round (plus blindPrompt, opinions[], or finalReport by action). Advisory to the outside world, but mutates server loop state on every call. It is categorised as a Execute tool in the Deliberation MCP Server, which means it can trigger actions or run processes. Use rate limits and argument validation.

How do I enforce a policy on consensus-step? +

Register the Deliberation MCP server in PolicyLayer and add a rule for consensus-step: allow, deny, rate-limit, or require approval. Point your MCP client at the PolicyLayer proxy URL and the rule is enforced on every call, before it reaches Deliberation. Nothing to install.

What risk level is consensus-step? +

consensus-step is a Execute tool with high risk. Execute tools should be rate-limited and have argument validation enabled.

Can I rate-limit consensus-step? +

Yes. Add a rate_limit block to the consensus-step rule in your PolicyLayer policy. For example, setting max: 10 and window: 60 limits the tool to 10 calls per minute. Rate limits are tracked per agent session and reset automatically.

How do I block consensus-step completely? +

Set action: deny in the PolicyLayer policy for consensus-step. The AI agent will receive a policy violation error and cannot call the tool. You can also include a reason field to explain why the tool is blocked.

What MCP server provides consensus-step? +

consensus-step is provided by the Deliberation MCP server (antonbabenko/deliberation). PolicyLayer sits as a proxy in front of this server to enforce policies before tool calls reach the server.

KEEP EXPLORING

More on Deliberation, and thousands of servers like it.

This server

All 11 Deliberation tools → High-risk tools on this server →

Across the catalogue

All high-risk MCP tools → The MCP Attack Database →

Guides

Govern code and CI agents →Agent sandbox →Least privilege for MCP →