github_rerun_workflow

What github_rerun_workflow does on Github

AI agents invoke github_rerun_workflow to trigger actions in Github. What it does depends on the arguments the agent supplies, and its effects often reach beyond the immediate call: builds kicked off, notifications sent, workflows started.

Why github_rerun_workflow is rated High

Re-running a workflow executes potentially arbitrary code defined in GitHub Actions (shell commands, scripts, deployments, API calls, etc.). While the workflow definition itself is fixed and not controlled by this tool invocation, the action still triggers external operations that can have side effects on systems, repositories, and infrastructure.

From the tool's definition Tool name: 'github_rerun_workflow'; description: 'Re-run a workflow.' The tool triggers the execution of a GitHub Actions workflow, which runs code/scripts whose effects depend on the workflow definition and external systems.

The rule that runs github_rerun_workflow safely

PolicyLayer is an MCP gateway: it sits between your AI agents and Github, and checks every tool call against a rule you set before the call runs. Nothing changes on the server itself. For github_rerun_workflow, this is the rule to start with:

{
  "version": "1",
  "default": "deny",
  "tools": {
    "github_rerun_workflow": {
      "limits": [
        {
          "counter": "github_rerun_workflow_rate",
          "window": "minute",
          "max": 10,
          "scope": "grant"
        }
      ]
    }
  }
}

Questions about github_rerun_workflow