update-session-state

What update-session-state does on Frontmcp

AI agents use update-session-state to create or update resources in Frontmcp, usually the action step of a workflow, after the agent has gathered context. Every call changes real data in your Frontmcp environment.

Why update-session-state is rated Medium

This tool modifies session state, which is reversible data alteration. It falls under Write rather than Execute because it operates on state management rather than triggering external operations or code execution. Severity is medium because unauthorized session state changes could affect authentication, authorization, or user context, but the blast radius is limited to the session layer.

From the tool's definition Tool name 'update-session-state' and description 'Update transport session state' indicate modification of session data. The verb 'update' explicitly signals a write operation that changes existing state.

The rule that runs update-session-state safely

PolicyLayer is an MCP gateway: it sits between your AI agents and Frontmcp, and checks every tool call against a rule you set before the call runs. Nothing changes on the server itself. For update-session-state, this is the rule to start with:

{
  "version": "1",
  "default": "deny",
  "tools": {
    "update-session-state": {
      "limits": [
        {
          "counter": "update-session-state_rate",
          "window": "minute",
          "max": 30,
          "scope": "grant"
        }
      ]
    }
  }
}

Questions about update-session-state