# create_budget

Use this when the user wants to create a new cloud budget with spending limits and alert thresholds. Requires name, currency, type, startPeriod, and exactly one of scope/scopes. Requires amount unless usePrevSpend is true, endPeriod for fixed budgets, and timeInterval for recurring budgets (ignored for fixed). Changes apply immediately. Do NOT use this for viewing existing budgets (use list_budgets or get_budget) or creating alerts (use create_alert).

Agent View of the PolicyLayer registry record for `create_budget`. HTML page: https://policylayer.com/tools/doit/create-budget

## Facts

- Tool: `create_budget`
- Server: Doit (`@doitintl/doit-mcp-server`) — https://policylayer.com/tools/doit.md
- Install: `npx -y @doitintl/doit-mcp-server`
- Homepage: https://www.npmjs.com/package/@doitintl/doit-mcp-server
- Risk category: Write (Medium risk)
- Registry record: grade F, identity unverified
- Server rate-limited: no
- Parameters: 12 (3 required)
- Recommended policy verdict: Rate-limited

## Parameters

| Parameter | Type | Required | Description |
| --- | --- | --- | --- |
| `name` | string | yes | Budget name (required, non-empty). |
| `type` | string | yes | Budget type (required). Accepted values: fixed, recurring. |
| `scope` | array | no | List of allocations that define the budget scope (deprecated). Exactly one of scope or scopes must be provided. |
| `alerts` | array | no | List of up to three alert thresholds defined as a percentage of the amount. |
| `amount` | number | no | Budget period amount. Required unless usePrevSpend is true. |
| `metric` | string | no | Budget metric. Accepted values: cost, amortized_cost. Defaults to cost. |
| `public` | string | no | Public sharing access level. Accepted values: owner, editor, viewer. |
| `scopes` | array | no | Filters that define the scope of the budget. Exactly one of scope or scopes must be provided. |
| `currency` | string | yes | Currency code (required). Accepted values: USD, ILS, EUR, AUD, CAD, GBP, DKK, NOK, SEK, BRL, SGD, MXN, CHF, MYR, TWD, EGP, ZAR, JPY, IDR, AED, THB, COP. |
| `endPeriod` | integer | no | Fixed budget end date as a UNIX timestamp in milliseconds. Required if type is fixed, must not be set for recurring. |
| `recipients` | array | no | List of email addresses to notify when reaching an alert threshold. |
| `description` | string | no | Budget description. |

Parameters from the server's own tool schema.

## Example call (MCP tools/call, JSON-RPC 2.0)

```json
{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "create_budget",
    "arguments": {
      "name": "<name>",
      "type": "<type>",
      "currency": "<currency>"
    }
  }
}
```

## Why create_budget is rated Medium

An AI agent can call create_budget faster than any human can review: one bad instruction and it creates or modifies resources in Doit by the hundred, each call as confident as the last.

Risk signals: High parameter count (33 properties)

## Use case

AI agents use create_budget to create or update resources in Doit, usually the action step of a workflow, after the agent has gathered context. Every call changes real data in your Doit environment.

## Recommended policy (PolicyLayer)

Verdict: **Rate-limited**. Enforced by the PolicyLayer MCP gateway (https://policylayer.com/mcp-gateway) before a call reaches Doit:

```json
{
  "version": "1",
  "default": "deny",
  "tools": {
    "create_budget": {
      "limits": [
        {
          "counter": "create_budget_rate",
          "window": "minute",
          "max": 30,
          "scope": "grant"
        }
      ]
    }
  }
}
```

## Other tools on Doit (237)

- `cancel_async_operation` — Destructive — https://policylayer.com/tools/doit/cancel-async-operation.md
- `cancel_invite` — Destructive — https://policylayer.com/tools/doit/cancel-invite.md
- `confirm_action` — Destructive — https://policylayer.com/tools/doit/confirm-action.md
- `delete_account_role` — Destructive — https://policylayer.com/tools/doit/delete-account-role.md
- `delete_alert` — Destructive — https://policylayer.com/tools/doit/delete-alert.md
- `delete_allocation` — Destructive — https://policylayer.com/tools/doit/delete-allocation.md
- `delete_annotation` — Destructive — https://policylayer.com/tools/doit/delete-annotation.md
- `delete_ava_conversation` — Destructive — https://policylayer.com/tools/doit/delete-ava-conversation.md
- `delete_budget` — Destructive — https://policylayer.com/tools/doit/delete-budget.md
- `delete_cloudflow_connection` — Destructive — https://policylayer.com/tools/doit/delete-cloudflow-connection.md
- `delete_custom_theme` — Destructive — https://policylayer.com/tools/doit/delete-custom-theme.md
- `delete_customer_geographic_access_scope` — Destructive — https://policylayer.com/tools/doit/delete-customer-geographic-access-scope.md
- `delete_customer_group` — Destructive — https://policylayer.com/tools/doit/delete-customer-group.md
- `delete_datahub_dataset` — Destructive — https://policylayer.com/tools/doit/delete-datahub-dataset.md
- `delete_datahub_datasets` — Destructive — https://policylayer.com/tools/doit/delete-datahub-datasets.md
- `delete_datahub_events_by_filter` — Destructive — https://policylayer.com/tools/doit/delete-datahub-events-by-filter.md
- `delete_folder` — Destructive — https://policylayer.com/tools/doit/delete-folder.md
- `delete_geographic_access_custom_region` — Destructive — https://policylayer.com/tools/doit/delete-geographic-access-custom-region.md
- `delete_insight_result` — Destructive — https://policylayer.com/tools/doit/delete-insight-result.md
- `delete_insight_results` — Destructive — https://policylayer.com/tools/doit/delete-insight-results.md
- `delete_label` — Destructive — https://policylayer.com/tools/doit/delete-label.md
- `delete_report` — Destructive — https://policylayer.com/tools/doit/delete-report.md
- `delete_role` — Destructive — https://policylayer.com/tools/doit/delete-role.md
- `delete_service_account` — Destructive — https://policylayer.com/tools/doit/delete-service-account.md
- `delete_service_account_token` — Destructive — https://policylayer.com/tools/doit/delete-service-account-token.md
- `delete_user` — Destructive — https://policylayer.com/tools/doit/delete-user.md
- `delete_user_geographic_access_scope` — Destructive — https://policylayer.com/tools/doit/delete-user-geographic-access-scope.md
- `id_of_asset` — Destructive — https://policylayer.com/tools/doit/id-of-asset.md
- `remove_ticket_tags` — Destructive — https://policylayer.com/tools/doit/remove-ticket-tags.md
- `async_run_inline` — Execute — https://policylayer.com/tools/doit/async-run-inline.md
- …and 207 more: https://policylayer.com/tools/doit.md

## For agents

This record is a snapshot. Live verdicts and the full registry:

- Check every server in your MCP config at once: `npx -y policylayer stack`
- Vet a server before you add it: install the mcp-precheck skill — `npx skills add https://policylayer.com` (skill text: https://policylayer.com/skill.md)
- Query the registry over MCP: endpoint `https://api.policylayer.com/mcp` — tools `check_mcp_server`, `check_mcp_stack`, `check_tool`, `search_registry`, `get_change_events`

---

Source: the PolicyLayer MCP registry — one continuously verified record per MCP server. Full record: https://policylayer.com/registry?q=doit · API: https://policylayer.com/registry/api · Policy library: https://policylayer.com/policies/doit