# relocate_sprint_item_pointer [SUPPORT] W1-J — atomically UPDATE an existing generic pointer's targets/source_type/label IN PLACE (a single UPDATE statement), replacing the delete_sprint_item_pointer + add_sprint_item_pointer workaround the pointer CRUD previously required to 'move' or correct a stored pointer. That two-call workaround is non-atomic: an exception between the delete and the re-add permanently loses the pointer, a concurrent get_sprint_item_pointers call in that window sees ZERO pointers for the item, and the pointer's id/created_at change — breaking anything that referenced it by its stable id (a decision's evidence, an artifact-provenance link). This tool preserves id/project_id/sprint_item_id/created_at exactly and never has a window where the row is absent. At least one of targets/source_type/label is required; an omitted field keeps its CURRENT stored value (pass label explicitly — including null/empty — to change or clear it; omit the key entirely to leave it untouched). When targets IS supplied, the replacement is validated exactly like add_sprint_item_pointer BEFORE the write (same malformed-pointer errors, same target_kind/freshness/repo_root rules — see that tool's description for the full target shape) — a validation failure changes nothing; when targets is omitted, the stored targets are carried over untouched (never re-run through that same filesystem check — a stored pointer's target_kind is a normalized artifact of prior validation, not fresh input to re-verify). Cross-project safe: returns {error} when pointer_id doesn't exist in project_id, exactly like a nonexistent pointer id (never distinguishes a foreign-project pointer from a missing one). Persistent-state disclosure: on hosted Meridian, supplied text and project/session metadata -- including task log entries, pinned decisions, sprint items, notes, handoff/goal state, and HITL queue items -- are sent to and stored in Meridian's service, in an isolated per-tenant Postgres database (Neon); self-hosted deployments keep the same categories in the configured local SQLite/Postgres database. This data is visible in the dashboard and API, and may resurface in later project context or handoffs. Notes and pinned decisions can be deleted individually; task log entries and sprint items can be deleted via the dashboard/API (not exposed as an agent-facing tool); HITL queue items and handoff state have no per-record delete. Full removal of any of this data is available via project or account deletion, using the documented controls. Do not include secrets. Agent View of the PolicyLayer registry record for `relocate_sprint_item_pointer`. HTML page: https://policylayer.com/tools/io-github-ajc3xc-meridian/relocate-sprint-item-pointer ## Facts - Tool: `relocate_sprint_item_pointer` - Server: Meridian (`@meridianmcp/mcp`) — https://policylayer.com/tools/io-github-ajc3xc-meridian.md - Install: `npx -y @meridianmcp/mcp` - Homepage: https://github.com/meridianmcp/Meridian - Risk category: Destructive (Critical risk) - Registry record: grade D, identity unverified - Server auth posture: gated - Server CORS policy: * - Server rate-limited: no - Parameters: 6 (1 required) - Recommended policy verdict: Hidden ## Parameters | Parameter | Type | Required | Description | | --- | --- | --- | --- | | `label` | string | no | Optional replacement label. Pass it explicitly (even null/empty) to change or clear it; omit the key entirely to leave the current label untouched. | | `targets` | array | no | Optional replacement targets array — same {uri, selector, subSelector?, target_kind?, freshness?, repo_root?} shape as add_sprint_item_pointer. Omit to keep the | | `pointer_id` | string | yes | The id of the pointer to relocate (from add_sprint_item_pointer / get_sprint_item_pointers). | | `project_id` | string | no | | | `source_type` | string | no | Optional replacement source_type. Omit to keep the pointer's current source_type. | | `project_name` | string | no | Project name — an alternative to project_id; resolved to the id internally. project_id wins if both are given. | Parameters from the server's own tool schema. ## Example call (MCP tools/call, JSON-RPC 2.0) ```json { "jsonrpc": "2.0", "id": 1, "method": "tools/call", "params": { "name": "relocate_sprint_item_pointer", "arguments": { "pointer_id": "" } } } ``` ## Why relocate_sprint_item_pointer is rated Critical An AI agent that decides to call relocate_sprint_item_pointer doesn't hesitate, doesn't double-check, and doesn't stop at one. Whatever it removes from Meridian is gone. There is no undo for destructive operations. ## Use case AI agents call relocate_sprint_item_pointer to permanently remove resources in Meridian, typically in cleanup and lifecycle workflows. It does its job in a single call, and there is no undo. ## Recommended policy (PolicyLayer) Verdict: **Hidden**. Enforced by the PolicyLayer MCP gateway (https://policylayer.com/mcp-gateway) before a call reaches Meridian: ```json { "version": "1", "default": "deny", "hide": [ "relocate_sprint_item_pointer" ] } ``` ## Other tools on Meridian (234) - `accept_handoff` — Destructive — https://policylayer.com/tools/io-github-ajc3xc-meridian/accept-handoff.md - `acquire_docx_document_lease` — Destructive — https://policylayer.com/tools/io-github-ajc3xc-meridian/acquire-docx-document-lease.md - `answer_hitl` — Destructive — https://policylayer.com/tools/io-github-ajc3xc-meridian/answer-hitl.md - `batch_mutate` — Destructive — https://policylayer.com/tools/io-github-ajc3xc-meridian/batch-mutate.md - `capture_research_finding` — Destructive — https://policylayer.com/tools/io-github-ajc3xc-meridian/capture-research-finding.md - `checkpoint` — Destructive — https://policylayer.com/tools/io-github-ajc3xc-meridian/checkpoint.md - `claim_docx_region` — Destructive — https://policylayer.com/tools/io-github-ajc3xc-meridian/claim-docx-region.md - `claim_file` — Destructive — https://policylayer.com/tools/io-github-ajc3xc-meridian/claim-file.md - `claim_sprint_item` — Destructive — https://policylayer.com/tools/io-github-ajc3xc-meridian/claim-sprint-item.md - `clear_capability_profile` — Destructive — https://policylayer.com/tools/io-github-ajc3xc-meridian/clear-capability-profile.md - `clone_profile_layer` — Destructive — https://policylayer.com/tools/io-github-ajc3xc-meridian/clone-profile-layer.md - `delete_custom_hook` — Destructive — https://policylayer.com/tools/io-github-ajc3xc-meridian/delete-custom-hook.md - `delete_note` — Destructive — https://policylayer.com/tools/io-github-ajc3xc-meridian/delete-note.md - `delete_sprint_item_pointer` — Destructive — https://policylayer.com/tools/io-github-ajc3xc-meridian/delete-sprint-item-pointer.md - `delete_watchlist_query` — Destructive — https://policylayer.com/tools/io-github-ajc3xc-meridian/delete-watchlist-query.md - `dismiss_hitl` — Destructive — https://policylayer.com/tools/io-github-ajc3xc-meridian/dismiss-hitl.md - `fan_out_sprint_items` — Destructive — https://policylayer.com/tools/io-github-ajc3xc-meridian/fan-out-sprint-items.md - `idle_until_all_done` — Destructive — https://policylayer.com/tools/io-github-ajc3xc-meridian/idle-until-all-done.md - `index_equation` — Destructive — https://policylayer.com/tools/io-github-ajc3xc-meridian/index-equation.md - `index_figure` — Destructive — https://policylayer.com/tools/io-github-ajc3xc-meridian/index-figure.md - `index_table` — Destructive — https://policylayer.com/tools/io-github-ajc3xc-meridian/index-table.md - `ingest_document` — Destructive — https://policylayer.com/tools/io-github-ajc3xc-meridian/ingest-document.md - `ingest_document_structure` — Destructive — https://policylayer.com/tools/io-github-ajc3xc-meridian/ingest-document-structure.md - `link_figure_caption` — Destructive — https://policylayer.com/tools/io-github-ajc3xc-meridian/link-figure-caption.md - `link_flag_to_section` — Destructive — https://policylayer.com/tools/io-github-ajc3xc-meridian/link-flag-to-section.md - `link_proposal_lineage` — Destructive — https://policylayer.com/tools/io-github-ajc3xc-meridian/link-proposal-lineage.md - `link_table_caption` — Destructive — https://policylayer.com/tools/io-github-ajc3xc-meridian/link-table-caption.md - `log_task` — Destructive — https://policylayer.com/tools/io-github-ajc3xc-meridian/log-task.md - `purge_ai_log` — Destructive — https://policylayer.com/tools/io-github-ajc3xc-meridian/purge-ai-log.md - `receive_messages` — Destructive — https://policylayer.com/tools/io-github-ajc3xc-meridian/receive-messages.md - …and 204 more: https://policylayer.com/tools/io-github-ajc3xc-meridian.md ## For agents This record is a snapshot. Live verdicts and the full registry: - Check every server in your MCP config at once: `npx -y policylayer stack` - Vet a server before you add it: install the mcp-precheck skill — `npx skills add https://policylayer.com` (skill text: https://policylayer.com/skill.md) - Query the registry over MCP: endpoint `https://api.policylayer.com/mcp` — tools `check_mcp_server`, `check_mcp_stack`, `check_tool`, `search_registry`, `get_change_events` --- Source: the PolicyLayer MCP registry — one continuously verified record per MCP server. Full record: https://policylayer.com/registry?q=io-github-ajc3xc-meridian · API: https://policylayer.com/registry/api · Policy library: https://policylayer.com/policies/io-github-ajc3xc-meridian