# reply_to_thread

Post a reply to a Threads post — the brand’s own or someone else’s. This PUBLISHES publicly under the brand’s account, so show the user the exact wording and get their go-ahead first.

Agent View of the PolicyLayer registry record for `reply_to_thread`. HTML page: https://policylayer.com/tools/hermoso/reply-to-thread

## Facts

- Tool: `reply_to_thread`
- Server: Hermoso (`https://app.hermoso.ai/mcp`) — https://policylayer.com/tools/hermoso.md
- Homepage: git+https://github.com/hermoso-ai/hermoso.git
- Risk category: Write (Medium risk)
- Registry record: grade D, identity unverified
- Server auth posture: gated
- Server CORS policy: *
- Server rate-limited: no
- Parameters: 0
- Recommended policy verdict: Rate-limited

## Example call (MCP tools/call, JSON-RPC 2.0)

```json
{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "reply_to_thread",
    "arguments": {}
  }
}
```

## Why reply_to_thread is rated Medium

This tool creates a new public post on Threads under the brand's account. It is a Write action (creating content) that is reversible in principle but carries high severity because it publishes content publicly on behalf of a brand, with potential reputational and legal consequences if misused. It does not delete data (not Destructive) or move money (not Financial), so Write is the most severe applicable category.

From the tool's own definition: "Post a reply to a Threads post — this PUBLISHES publicly under the brand's account"

## Use case

AI agents use reply_to_thread to create or update resources in Hermoso, usually the action step of a workflow, after the agent has gathered context. Every call changes real data in your Hermoso environment.

## Recommended policy (PolicyLayer)

Verdict: **Rate-limited**. Enforced by the PolicyLayer MCP gateway (https://policylayer.com/mcp-gateway) before a call reaches Hermoso:

```json
{
  "version": "1",
  "default": "deny",
  "tools": {
    "reply_to_thread": {
      "limits": [
        {
          "counter": "reply_to_thread_rate",
          "window": "minute",
          "max": 30,
          "scope": "grant"
        }
      ]
    }
  }
}
```

## Other tools on Hermoso (895)

- `answer_google_business_question` — Destructive — https://policylayer.com/tools/hermoso/answer-google-business-question.md
- `apple_ads_change_history` — Destructive — https://policylayer.com/tools/hermoso/apple-ads-change-history.md
- `associate_linkedin_conversion_campaigns` — Destructive — https://policylayer.com/tools/hermoso/associate-linkedin-conversion-campaigns.md
- `cancel_openai_ads_audience_operation` — Destructive — https://policylayer.com/tools/hermoso/cancel-openai-ads-audience-operation.md
- `cancel_scheduled` — Destructive — https://policylayer.com/tools/hermoso/cancel-scheduled.md
- `cancel_stripe_subscription` — Destructive — https://policylayer.com/tools/hermoso/cancel-stripe-subscription.md
- `clear_sheet_range` — Destructive — https://policylayer.com/tools/hermoso/clear-sheet-range.md
- `create_analytics_custom_dimension` — Destructive — https://policylayer.com/tools/hermoso/create-analytics-custom-dimension.md
- `create_openai_ads_campaign` — Destructive — https://policylayer.com/tools/hermoso/create-openai-ads-campaign.md
- `delete_analytics_key_event` — Destructive — https://policylayer.com/tools/hermoso/delete-analytics-key-event.md
- `delete_apple_ads_object` — Destructive — https://policylayer.com/tools/hermoso/delete-apple-ads-object.md
- `delete_bluesky_post` — Destructive — https://policylayer.com/tools/hermoso/delete-bluesky-post.md
- `delete_brand` — Destructive — https://policylayer.com/tools/hermoso/delete-brand.md
- `delete_creator` — Destructive — https://policylayer.com/tools/hermoso/delete-creator.md
- `delete_dm_automation` — Destructive — https://policylayer.com/tools/hermoso/delete-dm-automation.md
- `delete_drive_file` — Destructive — https://policylayer.com/tools/hermoso/delete-drive-file.md
- `delete_google_ads_object` — Destructive — https://policylayer.com/tools/hermoso/delete-google-ads-object.md
- `delete_google_business_post` — Destructive — https://policylayer.com/tools/hermoso/delete-google-business-post.md
- `delete_instagram_dm_automation` — Destructive — https://policylayer.com/tools/hermoso/delete-instagram-dm-automation.md
- `delete_linkedin_ads_object` — Destructive — https://policylayer.com/tools/hermoso/delete-linkedin-ads-object.md
- `delete_linkedin_comment` — Destructive — https://policylayer.com/tools/hermoso/delete-linkedin-comment.md
- `delete_linkedin_lead_subscription` — Destructive — https://policylayer.com/tools/hermoso/delete-linkedin-lead-subscription.md
- `delete_merchant_data_source` — Destructive — https://policylayer.com/tools/hermoso/delete-merchant-data-source.md
- `delete_merchant_product` — Destructive — https://policylayer.com/tools/hermoso/delete-merchant-product.md
- `delete_messenger_marketing_campaign` — Destructive — https://policylayer.com/tools/hermoso/delete-messenger-marketing-campaign.md
- `delete_meta_audience` — Destructive — https://policylayer.com/tools/hermoso/delete-meta-audience.md
- `delete_meta_catalog` — Destructive — https://policylayer.com/tools/hermoso/delete-meta-catalog.md
- `delete_meta_object` — Destructive — https://policylayer.com/tools/hermoso/delete-meta-object.md
- `delete_microsoft_ads_object` — Destructive — https://policylayer.com/tools/hermoso/delete-microsoft-ads-object.md
- `delete_microsoft_merchant_product` — Destructive — https://policylayer.com/tools/hermoso/delete-microsoft-merchant-product.md
- …and 865 more: https://policylayer.com/tools/hermoso.md

## For agents

This record is a snapshot. Live verdicts and the full registry:

- Check every server in your MCP config at once: `npx -y policylayer stack`
- Vet a server before you add it: install the mcp-precheck skill — `npx skills add https://policylayer.com` (skill text: https://policylayer.com/skill.md)
- Query the registry over MCP: endpoint `https://api.policylayer.com/mcp` — tools `check_mcp_server`, `check_mcp_stack`, `check_tool`, `search_registry`, `get_change_events`

---

Source: the PolicyLayer MCP registry — one continuously verified record per MCP server. Full record: https://policylayer.com/registry?q=hermoso · API: https://policylayer.com/registry/api · Policy library: https://policylayer.com/policies/hermoso