users-update

What users-update does on Frontmcp

AI agents use users-update to create or update resources in Frontmcp, usually the action step of a workflow, after the agent has gathered context. Every call changes real data in your Frontmcp environment.

Why users-update is rated Medium

This tool modifies user records but does not permanently delete them (which would be Destructive) nor does it execute arbitrary code (which would be Execute). The blast radius depends on what user fields can be modified—if it permits privilege escalation or critical account changes, severity could rise, but 'medium' is appropriate for a standard user data modification without evidence of financial or destructive…

From the tool's definition Tool name 'users-update' and description 'Update an existing user' indicate modification of user data records. This is a reversible write operation that creates or modifies existing data.

The rule that runs users-update safely

PolicyLayer is an MCP gateway: it sits between your AI agents and Frontmcp, and checks every tool call against a rule you set before the call runs. Nothing changes on the server itself. For users-update, this is the rule to start with:

{
  "version": "1",
  "default": "deny",
  "tools": {
    "users-update": {
      "limits": [
        {
          "counter": "users-update_rate",
          "window": "minute",
          "max": 30,
          "scope": "grant"
        }
      ]
    }
  }
}

Questions about users-update