# update_cloudflow_connection

Updates a CloudFlow connection immediately using connectionId and the last observed ETag (ifMatch). A stale ETag fails with 412. Other fields are optional; supplied gcpConfig/awsConfig and collaborators replace their stored values wholesale. Retain exactly one owner when replacing collaborators. At most one provider config may be supplied. Serialize updates because the API version check is not atomic with the write. If an HTTP failure has only generic text, do not infer its status or retry automatically.

Agent View of the PolicyLayer registry record for `update_cloudflow_connection`. HTML page: https://policylayer.com/tools/doit/update-cloudflow-connection

## Facts

- Tool: `update_cloudflow_connection`
- Server: Doit (`@doitintl/doit-mcp-server`) — https://policylayer.com/tools/doit.md
- Install: `npx -y @doitintl/doit-mcp-server`
- Homepage: https://www.npmjs.com/package/@doitintl/doit-mcp-server
- Risk category: Write (Medium risk)
- Registry record: grade F, identity unverified
- Server rate-limited: no
- Parameters: 8 (2 required)
- Recommended policy verdict: Rate-limited

## Parameters

| Parameter | Type | Required | Description |
| --- | --- | --- | --- |
| `name` | string | no | New connection name. |
| `enabled` | boolean | no | Set to false to disable the connection, true to re-enable it. |
| `ifMatch` | string | yes | ETag from the connection's last read or write response (etag), including quotes. Sent as If-Match; a stale version fails with 412. Wildcards are rejected. The A |
| `awsConfig` | object | no | Full replacement AWS configuration, not a merge. At most one of gcpConfig or awsConfig may be set per request. |
| `gcpConfig` | object | no | Full replacement GCP configuration, not a merge. At most one of gcpConfig or awsConfig may be set per request. |
| `description` | string | no | New description for the connection. |
| `connectionId` | string | yes | The ID of the CloudFlow connection to update (required). |
| `collaborators` | array | no | Full replacement list of collaborators and roles; retain exactly one owner. Omitted leaves unchanged; an empty list is invalid. |

Parameters from the server's own tool schema.

## Example call (MCP tools/call, JSON-RPC 2.0)

```json
{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "update_cloudflow_connection",
    "arguments": {
      "ifMatch": "<ifMatch>",
      "connectionId": "<connectionId>"
    }
  }
}
```

## Why update_cloudflow_connection is rated Medium

An AI agent can call update_cloudflow_connection faster than any human can review: one bad instruction and it creates or modifies resources in Doit by the hundred, each call as confident as the last.

Risk signals: High parameter count (33 properties)

## Use case

AI agents use update_cloudflow_connection to create or update resources in Doit, usually the action step of a workflow, after the agent has gathered context. Every call changes real data in your Doit environment.

## Recommended policy (PolicyLayer)

Verdict: **Rate-limited**. Enforced by the PolicyLayer MCP gateway (https://policylayer.com/mcp-gateway) before a call reaches Doit:

```json
{
  "version": "1",
  "default": "deny",
  "tools": {
    "update_cloudflow_connection": {
      "limits": [
        {
          "counter": "update_cloudflow_connection_rate",
          "window": "minute",
          "max": 30,
          "scope": "grant"
        }
      ]
    }
  }
}
```

## Other tools on Doit (237)

- `cancel_async_operation` — Destructive — https://policylayer.com/tools/doit/cancel-async-operation.md
- `cancel_invite` — Destructive — https://policylayer.com/tools/doit/cancel-invite.md
- `confirm_action` — Destructive — https://policylayer.com/tools/doit/confirm-action.md
- `delete_account_role` — Destructive — https://policylayer.com/tools/doit/delete-account-role.md
- `delete_alert` — Destructive — https://policylayer.com/tools/doit/delete-alert.md
- `delete_allocation` — Destructive — https://policylayer.com/tools/doit/delete-allocation.md
- `delete_annotation` — Destructive — https://policylayer.com/tools/doit/delete-annotation.md
- `delete_ava_conversation` — Destructive — https://policylayer.com/tools/doit/delete-ava-conversation.md
- `delete_budget` — Destructive — https://policylayer.com/tools/doit/delete-budget.md
- `delete_cloudflow_connection` — Destructive — https://policylayer.com/tools/doit/delete-cloudflow-connection.md
- `delete_custom_theme` — Destructive — https://policylayer.com/tools/doit/delete-custom-theme.md
- `delete_customer_geographic_access_scope` — Destructive — https://policylayer.com/tools/doit/delete-customer-geographic-access-scope.md
- `delete_customer_group` — Destructive — https://policylayer.com/tools/doit/delete-customer-group.md
- `delete_datahub_dataset` — Destructive — https://policylayer.com/tools/doit/delete-datahub-dataset.md
- `delete_datahub_datasets` — Destructive — https://policylayer.com/tools/doit/delete-datahub-datasets.md
- `delete_datahub_events_by_filter` — Destructive — https://policylayer.com/tools/doit/delete-datahub-events-by-filter.md
- `delete_folder` — Destructive — https://policylayer.com/tools/doit/delete-folder.md
- `delete_geographic_access_custom_region` — Destructive — https://policylayer.com/tools/doit/delete-geographic-access-custom-region.md
- `delete_insight_result` — Destructive — https://policylayer.com/tools/doit/delete-insight-result.md
- `delete_insight_results` — Destructive — https://policylayer.com/tools/doit/delete-insight-results.md
- `delete_label` — Destructive — https://policylayer.com/tools/doit/delete-label.md
- `delete_report` — Destructive — https://policylayer.com/tools/doit/delete-report.md
- `delete_role` — Destructive — https://policylayer.com/tools/doit/delete-role.md
- `delete_service_account` — Destructive — https://policylayer.com/tools/doit/delete-service-account.md
- `delete_service_account_token` — Destructive — https://policylayer.com/tools/doit/delete-service-account-token.md
- `delete_user` — Destructive — https://policylayer.com/tools/doit/delete-user.md
- `delete_user_geographic_access_scope` — Destructive — https://policylayer.com/tools/doit/delete-user-geographic-access-scope.md
- `id_of_asset` — Destructive — https://policylayer.com/tools/doit/id-of-asset.md
- `remove_ticket_tags` — Destructive — https://policylayer.com/tools/doit/remove-ticket-tags.md
- `async_run_inline` — Execute — https://policylayer.com/tools/doit/async-run-inline.md
- …and 207 more: https://policylayer.com/tools/doit.md

## For agents

This record is a snapshot. Live verdicts and the full registry:

- Check every server in your MCP config at once: `npx -y policylayer stack`
- Vet a server before you add it: install the mcp-precheck skill — `npx skills add https://policylayer.com` (skill text: https://policylayer.com/skill.md)
- Query the registry over MCP: endpoint `https://api.policylayer.com/mcp` — tools `check_mcp_server`, `check_mcp_stack`, `check_tool`, `search_registry`, `get_change_events`

---

Source: the PolicyLayer MCP registry — one continuously verified record per MCP server. Full record: https://policylayer.com/registry?q=doit · API: https://policylayer.com/registry/api · Policy library: https://policylayer.com/policies/doit