# set_member_role

Change a member's role between editor, viewer, and billing. Identify the member by their member ID or email (from list_members); the project owner's own role cannot be changed. Returns the updated member record. Owner only.

Agent View of the PolicyLayer registry record for `set_member_role`. HTML page: https://policylayer.com/tools/dev-echorelay-management/set-member-role

## Facts

- Tool: `set_member_role`
- Server: EchoRelay (`https://mcp.echorelay.dev`) — https://policylayer.com/tools/dev-echorelay-management.md
- Homepage: https://github.com/https://mcp.echorelay.dev
- Risk category: Write (Medium risk)
- Registry record: grade F, identity unverified
- Server auth posture: open
- Server rate-limited: no
- Parameters: 3 (1 required)
- Recommended policy verdict: Rate-limited

## Parameters

| Parameter | Type | Required | Description |
| --- | --- | --- | --- |
| `role` | string | yes | The new role. |
| `email` | string | no | Email address (alternative to memberId — targets the first matching member). |
| `memberId` | string | no | Member record UUID (from list_members). |

Parameters from the server's own tool schema.

## Example call (MCP tools/call, JSON-RPC 2.0)

```json
{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "set_member_role",
    "arguments": {
      "role": "<role>"
    }
  }
}
```

## Why set_member_role is rated Medium

This tool creates or modifies data (member role assignments) in a reversible manner. While it affects permissions and could have downstream consequences, the action itself is a metadata update that can be undone by changing the role again. It does not delete data (Destructive), execute arbitrary code (Execute), move money (Financial), or trigger external operations (Execute).

From the tool's own definition: "Tool description explicitly states it 'Change[s] a member's role' and 'Returns the updated member record.' This modifies access control metadata reversibly. The description also notes 'Owner only' access restriction."

## Use case

AI agents use set_member_role to create or update resources in EchoRelay, usually the action step of a workflow, after the agent has gathered context. Every call changes real data in your EchoRelay environment.

## Recommended policy (PolicyLayer)

Verdict: **Rate-limited**. Enforced by the PolicyLayer MCP gateway (https://policylayer.com/mcp-gateway) before a call reaches EchoRelay:

```json
{
  "version": "1",
  "default": "deny",
  "tools": {
    "set_member_role": {
      "limits": [
        {
          "counter": "set_member_role_rate",
          "window": "minute",
          "max": 30,
          "scope": "grant"
        }
      ]
    }
  }
}
```

## Other tools on EchoRelay (77)

- `cancel_line_publish` — Destructive — https://policylayer.com/tools/dev-echorelay-management/cancel-line-publish.md
- `delete_credential` — Destructive — https://policylayer.com/tools/dev-echorelay-management/delete-credential.md
- `delete_endpoint` — Destructive — https://policylayer.com/tools/dev-echorelay-management/delete-endpoint.md
- `delete_line` — Destructive — https://policylayer.com/tools/dev-echorelay-management/delete-line.md
- `discard_dlq_entry` — Destructive — https://policylayer.com/tools/dev-echorelay-management/discard-dlq-entry.md
- `discard_draft_endpoint` — Destructive — https://policylayer.com/tools/dev-echorelay-management/discard-draft-endpoint.md
- `discard_line_draft` — Destructive — https://policylayer.com/tools/dev-echorelay-management/discard-line-draft.md
- `remove_member` — Destructive — https://policylayer.com/tools/dev-echorelay-management/remove-member.md
- `revoke_api_key` — Destructive — https://policylayer.com/tools/dev-echorelay-management/revoke-api-key.md
- `revoke_project_token` — Destructive — https://policylayer.com/tools/dev-echorelay-management/revoke-project-token.md
- `rollback_config` — Destructive — https://policylayer.com/tools/dev-echorelay-management/rollback-config.md
- `dry_run_endpoint` — Execute — https://policylayer.com/tools/dev-echorelay-management/dry-run-endpoint.md
- `duplicate_line` — Execute — https://policylayer.com/tools/dev-echorelay-management/duplicate-line.md
- `cancel_subscription` — Financial — https://policylayer.com/tools/dev-echorelay-management/cancel-subscription.md
- `change_plan` — Financial — https://policylayer.com/tools/dev-echorelay-management/change-plan.md
- `downgrade_addon` — Financial — https://policylayer.com/tools/dev-echorelay-management/downgrade-addon.md
- `retry_dlq_entry` — Financial — https://policylayer.com/tools/dev-echorelay-management/retry-dlq-entry.md
- `start_subscription` — Financial — https://policylayer.com/tools/dev-echorelay-management/start-subscription.md
- `start_topup` — Financial — https://policylayer.com/tools/dev-echorelay-management/start-topup.md
- `subscribe_addon` — Financial — https://policylayer.com/tools/dev-echorelay-management/subscribe-addon.md
- `unsubscribe_addon` — Financial — https://policylayer.com/tools/dev-echorelay-management/unsubscribe-addon.md
- `default_endpoint_template` — Read — https://policylayer.com/tools/dev-echorelay-management/default-endpoint-template.md
- `get_billing` — Read — https://policylayer.com/tools/dev-echorelay-management/get-billing.md
- `get_config` — Read — https://policylayer.com/tools/dev-echorelay-management/get-config.md
- `get_dlq_entry` — Read — https://policylayer.com/tools/dev-echorelay-management/get-dlq-entry.md
- `get_endpoint` — Read — https://policylayer.com/tools/dev-echorelay-management/get-endpoint.md
- `get_key_policy` — Read — https://policylayer.com/tools/dev-echorelay-management/get-key-policy.md
- `get_line_draft` — Read — https://policylayer.com/tools/dev-echorelay-management/get-line-draft.md
- `get_metrics` — Read — https://policylayer.com/tools/dev-echorelay-management/get-metrics.md
- `get_project` — Read — https://policylayer.com/tools/dev-echorelay-management/get-project.md
- …and 47 more: https://policylayer.com/tools/dev-echorelay-management.md

## For agents

This record is a snapshot. Live verdicts and the full registry:

- Check every server in your MCP config at once: `npx -y policylayer stack`
- Vet a server before you add it: install the mcp-precheck skill — `npx skills add https://policylayer.com` (skill text: https://policylayer.com/skill.md)
- Query the registry over MCP: endpoint `https://api.policylayer.com/mcp` — tools `check_mcp_server`, `check_mcp_stack`, `check_tool`, `search_registry`, `get_change_events`

---

Source: the PolicyLayer MCP registry — one continuously verified record per MCP server. Full record: https://policylayer.com/registry?q=dev-echorelay-management · API: https://policylayer.com/registry/api · Policy library: https://policylayer.com/policies/dev-echorelay-management