url.map · MCP: Risk & Policy

WHAT IT DOES

What url.map does on Mcp

AI agents call url.map to retrieve information from Mcp without modifying anything — typically the context-gathering step in research, monitoring, and reporting workflows, before the agent takes action elsewhere.

WHY IT NEEDS A POLICY

Why url.map needs a policy

This tool retrieves and lists URLs without modifying, executing, or deleting anything. It extracts link metadata from public web resources (sitemaps and HTML). No data is written, no code is executed, no data is destroyed, and no financial transactions occur. The functionality is equivalent to fetching and parsing a webpage, which is a standard read operation.

From the tool's definition Tool performs URL discovery and link extraction from sitemaps and HTML pages. Exact description states: "Discover the URLs a page or sitemap points at in a single fetch — <loc> entries from an XML sitemap/sitemap-index, or <a href> links from an HTML page…

Attacks that exploit this kind of access

Questions about url.map

What does the url.map tool do? +

Discover the URLs a page or sitemap points at in a single fetch — <loc> entries from an XML sitemap/sitemap-index, or <a href> links from an HTML page (auto-detected). Resolved-absolute, deduped, http(s)-only. Stateless, no JS, NOT a recursive crawler — re-call on a child sitemap/page to go deeper. limit 1-2000 (default 200); sameHostOnly keeps same-host links. It is categorised as a Read tool in the Mcp MCP Server, which means it retrieves data without modifying state.

How do I enforce a policy on url.map? +

Register the MCP server in PolicyLayer and add a rule for url.map: allow, deny, rate-limit, or require approval. Point your MCP client at the PolicyLayer proxy URL and the rule is enforced on every call, before it reaches Mcp. Nothing to install.

What risk level is url.map? +

url.map is a Read tool with low risk. Read-only tools are generally safe to allow by default.

Can I rate-limit url.map? +

Yes. Add a rate_limit block to the url.map rule in your PolicyLayer policy. For example, setting max: 10 and window: 60 limits the tool to 10 calls per minute. Rate limits are tracked per agent session and reset automatically.

How do I block url.map completely? +

Set action: deny in the PolicyLayer policy for url.map. The AI agent will receive a policy violation error and cannot call the tool. You can also include a reason field to explain why the tool is blocked.

What MCP server provides url.map? +

url.map is provided by the MCP server (@2sio/mcp). PolicyLayer sits as a proxy in front of this server to enforce policies before tool calls reach the server.