# set-api-key

Set an API key for RPC or subgraph services (stored securely)

Agent View of the PolicyLayer registry record for `set-api-key`. HTML page: https://policylayer.com/tools/dennisonbertram-mcp-hats/set-api-key

## Facts

- Tool: `set-api-key`
- Server: Hats Protocol MCP Server (`dennisonbertram/mcp-hats`) — https://policylayer.com/tools/dennisonbertram-mcp-hats.md
- Homepage: https://github.com/dennisonbertram/mcp-hats
- Risk category: Write (Medium risk)
- Registry record: grade F, identity unverified
- Server rate-limited: no
- Parameters: 0
- Recommended policy verdict: Rate-limited

## Example call (MCP tools/call, JSON-RPC 2.0)

```json
{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "set-api-key",
    "arguments": {}
  }
}
```

## Why set-api-key is rated Medium

This tool modifies system state by storing API credentials. While not destructive (reversible), it is a Write operation as it creates/stores configuration data. Severity is high because compromised API key storage or misuse of credentials could enable unauthorized blockchain operations, given the context of managing decentralized organizational roles and permissions.

From the tool's own definition: "Tool description explicitly states it 'Set[s] an API key for RPC or subgraph services (stored securely)'. This is a data modification operation that creates or stores sensitive credentials."

## Use case

AI agents use set-api-key to create or update resources in Hats Protocol MCP Server, usually the action step of a workflow, after the agent has gathered context. Every call changes real data in your Hats Protocol MCP Server environment.

## Recommended policy (PolicyLayer)

Verdict: **Rate-limited**. Enforced by the PolicyLayer MCP gateway (https://policylayer.com/mcp-gateway) before a call reaches Hats Protocol MCP Server:

```json
{
  "version": "1",
  "default": "deny",
  "tools": {
    "set-api-key": {
      "limits": [
        {
          "counter": "set-api-key_rate",
          "window": "minute",
          "max": 30,
          "scope": "grant"
        }
      ]
    }
  }
}
```

## Other tools on Hats Protocol MCP Server (10)

- `prepare-burn-hat` — Destructive — https://policylayer.com/tools/dennisonbertram-mcp-hats/prepare-burn-hat.md
- `check-hat-wearer` — Read — https://policylayer.com/tools/dennisonbertram-mcp-hats/check-hat-wearer.md
- `get-hat-details` — Read — https://policylayer.com/tools/dennisonbertram-mcp-hats/get-hat-details.md
- `get-tree-structure` — Read — https://policylayer.com/tools/dennisonbertram-mcp-hats/get-tree-structure.md
- `list-networks` — Read — https://policylayer.com/tools/dennisonbertram-mcp-hats/list-networks.md
- `query-hats-by-wearer` — Read — https://policylayer.com/tools/dennisonbertram-mcp-hats/query-hats-by-wearer.md
- `prepare-create-hat` — Write — https://policylayer.com/tools/dennisonbertram-mcp-hats/prepare-create-hat.md
- `prepare-mint-hat` — Write — https://policylayer.com/tools/dennisonbertram-mcp-hats/prepare-mint-hat.md
- `prepare-mint-top-hat` — Write — https://policylayer.com/tools/dennisonbertram-mcp-hats/prepare-mint-top-hat.md
- `prepare-transfer-hat` — Write — https://policylayer.com/tools/dennisonbertram-mcp-hats/prepare-transfer-hat.md

## For agents

This record is a snapshot. Live verdicts and the full registry:

- Check every server in your MCP config at once: `npx -y policylayer stack`
- Vet a server before you add it: install the mcp-precheck skill — `npx skills add https://policylayer.com` (skill text: https://policylayer.com/skill.md)
- Query the registry over MCP: endpoint `https://api.policylayer.com/mcp` — tools `check_mcp_server`, `check_mcp_stack`, `check_tool`, `search_registry`, `get_change_events`

---

Source: the PolicyLayer MCP registry — one continuously verified record per MCP server. Full record: https://policylayer.com/registry?q=dennisonbertram-mcp-hats · API: https://policylayer.com/registry/api · Policy library: https://policylayer.com/policies/dennisonbertram-mcp-hats