# update_budget

Use this when the user wants to modify an existing budget. Supports partial updates; omitted fields retain their current values. Setting type to fixed requires endPeriod; setting type to recurring requires timeInterval and forbids endPeriod; setting usePrevSpend to false requires amount. Changes apply immediately. Do NOT use this for viewing budgets (use list_budgets) or creating new budgets (use create_budget).

Agent View of the PolicyLayer registry record for `update_budget`. HTML page: https://policylayer.com/tools/doit/update-budget

## Facts

- Tool: `update_budget`
- Server: Doit (`@doitintl/doit-mcp-server`) — https://policylayer.com/tools/doit.md
- Install: `npx -y @doitintl/doit-mcp-server`
- Homepage: https://www.npmjs.com/package/@doitintl/doit-mcp-server
- Risk category: Write (Medium risk)
- Registry record: grade F, identity unverified
- Server rate-limited: no
- Parameters: 12 (1 required)
- Recommended policy verdict: Rate-limited

## Parameters

| Parameter | Type | Required | Description |
| --- | --- | --- | --- |
| `id` | string | yes | The ID of the budget to update (required). |
| `name` | string | no | Budget name. Must be non-empty if provided. |
| `type` | string | no | Budget type. If supplied, fixed requires endPeriod and recurring requires timeInterval. Accepted values: fixed, recurring. |
| `scope` | array | no | List of allocations that define the budget scope (deprecated). Cannot be combined with scopes. |
| `alerts` | array | no | List of up to three alert thresholds defined as a percentage of the amount. |
| `amount` | number | no | Budget period amount; required when usePrevSpend is explicitly false. Omitted means unchanged. |
| `metric` | string | no | Budget metric: cost or amortized_cost; omitted means unchanged. |
| `public` | string | no | Public sharing access level. Accepted values: owner, editor, viewer. |
| `scopes` | array | no | Filters that define the scope of the budget. Cannot be combined with scope. |
| `currency` | string | no | Currency code. Accepted values: USD, ILS, EUR, AUD, CAD, GBP, DKK, NOK, SEK, BRL, SGD, MXN, CHF, MYR, TWD, EGP, ZAR, JPY, IDR, AED, THB, COP. |
| `endPeriod` | integer | no | Fixed budget end date as a UNIX timestamp in milliseconds. Required when setting type to fixed; must not be set for recurring budgets. |
| `recipients` | array | no | List of email addresses to notify when reaching an alert threshold. |

Parameters from the server's own tool schema.

## Example call (MCP tools/call, JSON-RPC 2.0)

```json
{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "update_budget",
    "arguments": {
      "id": "<id>"
    }
  }
}
```

## Why update_budget is rated Medium

An AI agent can call update_budget faster than any human can review: one bad instruction and it creates or modifies resources in Doit by the hundred, each call as confident as the last.

Risk signals: High parameter count (34 properties)

## Use case

AI agents use update_budget to create or update resources in Doit, usually the action step of a workflow, after the agent has gathered context. Every call changes real data in your Doit environment.

## Recommended policy (PolicyLayer)

Verdict: **Rate-limited**. Enforced by the PolicyLayer MCP gateway (https://policylayer.com/mcp-gateway) before a call reaches Doit:

```json
{
  "version": "1",
  "default": "deny",
  "tools": {
    "update_budget": {
      "limits": [
        {
          "counter": "update_budget_rate",
          "window": "minute",
          "max": 30,
          "scope": "grant"
        }
      ]
    }
  }
}
```

## Other tools on Doit (237)

- `cancel_async_operation` — Destructive — https://policylayer.com/tools/doit/cancel-async-operation.md
- `cancel_invite` — Destructive — https://policylayer.com/tools/doit/cancel-invite.md
- `confirm_action` — Destructive — https://policylayer.com/tools/doit/confirm-action.md
- `delete_account_role` — Destructive — https://policylayer.com/tools/doit/delete-account-role.md
- `delete_alert` — Destructive — https://policylayer.com/tools/doit/delete-alert.md
- `delete_allocation` — Destructive — https://policylayer.com/tools/doit/delete-allocation.md
- `delete_annotation` — Destructive — https://policylayer.com/tools/doit/delete-annotation.md
- `delete_ava_conversation` — Destructive — https://policylayer.com/tools/doit/delete-ava-conversation.md
- `delete_budget` — Destructive — https://policylayer.com/tools/doit/delete-budget.md
- `delete_cloudflow_connection` — Destructive — https://policylayer.com/tools/doit/delete-cloudflow-connection.md
- `delete_custom_theme` — Destructive — https://policylayer.com/tools/doit/delete-custom-theme.md
- `delete_customer_geographic_access_scope` — Destructive — https://policylayer.com/tools/doit/delete-customer-geographic-access-scope.md
- `delete_customer_group` — Destructive — https://policylayer.com/tools/doit/delete-customer-group.md
- `delete_datahub_dataset` — Destructive — https://policylayer.com/tools/doit/delete-datahub-dataset.md
- `delete_datahub_datasets` — Destructive — https://policylayer.com/tools/doit/delete-datahub-datasets.md
- `delete_datahub_events_by_filter` — Destructive — https://policylayer.com/tools/doit/delete-datahub-events-by-filter.md
- `delete_folder` — Destructive — https://policylayer.com/tools/doit/delete-folder.md
- `delete_geographic_access_custom_region` — Destructive — https://policylayer.com/tools/doit/delete-geographic-access-custom-region.md
- `delete_insight_result` — Destructive — https://policylayer.com/tools/doit/delete-insight-result.md
- `delete_insight_results` — Destructive — https://policylayer.com/tools/doit/delete-insight-results.md
- `delete_label` — Destructive — https://policylayer.com/tools/doit/delete-label.md
- `delete_report` — Destructive — https://policylayer.com/tools/doit/delete-report.md
- `delete_role` — Destructive — https://policylayer.com/tools/doit/delete-role.md
- `delete_service_account` — Destructive — https://policylayer.com/tools/doit/delete-service-account.md
- `delete_service_account_token` — Destructive — https://policylayer.com/tools/doit/delete-service-account-token.md
- `delete_user` — Destructive — https://policylayer.com/tools/doit/delete-user.md
- `delete_user_geographic_access_scope` — Destructive — https://policylayer.com/tools/doit/delete-user-geographic-access-scope.md
- `id_of_asset` — Destructive — https://policylayer.com/tools/doit/id-of-asset.md
- `remove_ticket_tags` — Destructive — https://policylayer.com/tools/doit/remove-ticket-tags.md
- `async_run_inline` — Execute — https://policylayer.com/tools/doit/async-run-inline.md
- …and 207 more: https://policylayer.com/tools/doit.md

## For agents

This record is a snapshot. Live verdicts and the full registry:

- Check every server in your MCP config at once: `npx -y policylayer stack`
- Vet a server before you add it: install the mcp-precheck skill — `npx skills add https://policylayer.com` (skill text: https://policylayer.com/skill.md)
- Query the registry over MCP: endpoint `https://api.policylayer.com/mcp` — tools `check_mcp_server`, `check_mcp_stack`, `check_tool`, `search_registry`, `get_change_events`

---

Source: the PolicyLayer MCP registry — one continuously verified record per MCP server. Full record: https://policylayer.com/registry?q=doit · API: https://policylayer.com/registry/api · Policy library: https://policylayer.com/policies/doit