startWebAuthnRegistrationWithId

What startWebAuthnRegistrationWithId does on Fusionauth

AI agents invoke startWebAuthnRegistrationWithId to trigger actions in Fusionauth. What it does depends on the arguments the agent supplies, and its effects often reach beyond the immediate call: builds kicked off, notifications sent, workflows started.

Why startWebAuthnRegistrationWithId is rated High

While the tool does not immediately delete, overwrite, or move funds, it executes a ceremony that generates authentication credentials and modifies server state. It is not a simple read operation (no side effects) nor purely a write operation (more than data creation). WebAuthn registration ceremonies trigger cryptographic operations and subsequent authentication system changes, fitting the Execute category.

From the tool's definition The tool initiates a WebAuthn registration ceremony by generating a new challenge. This performs a cryptographic operation and modifies authentication state for a user (generating and likely storing a challenge server-side), which constitutes an external…

The rule that runs startWebAuthnRegistrationWithId safely

PolicyLayer is an MCP gateway: it sits between your AI agents and Fusionauth, and checks every tool call against a rule you set before the call runs. Nothing changes on the server itself. For startWebAuthnRegistrationWithId, this is the rule to start with:

{
  "version": "1",
  "default": "deny",
  "tools": {
    "startWebAuthnRegistrationWithId": {
      "limits": [
        {
          "counter": "startwebauthnregistrationwithid_rate",
          "window": "minute",
          "max": 10,
          "scope": "grant"
        }
      ]
    }
  }
}

Questions about startWebAuthnRegistrationWithId