# brc_process_vat_category_rates

Processes VAT rates for VAT categories via POST /v1/vatCategories/vatRates. Requires a full vatCategoryRates array and confirmProcess=true. Requires routeToken from brc_route_request for the matching action workflow. Call brc_route_request first with the user's complete original action request. Retain the returned routeToken through lookup, preview, and confirmation, and pass the same token on the final permitted transactional tool call. Never invent a placeholder token. A routeToken is not permission to post — preview-before-posting and confirmWrite/confirmDelete still apply.

Agent View of the PolicyLayer registry record for `brc_process_vat_category_rates`. HTML page: https://policylayer.com/tools/io-github-bigredcloud-red-mcp-server/brc-process-vat-category-rates

## Facts

- Tool: `brc_process_vat_category_rates`
- Server: Red by Big Red Cloud (`https://red.bigredcloud.com/mcp`) — https://policylayer.com/tools/io-github-bigredcloud-red-mcp-server.md
- Homepage: https://github.com/BigRedCloud/red-mcp-server
- Risk category: Read (Low risk)
- Registry record: grade F, identity unverified
- Server auth posture: open
- Server CORS policy: *
- Server rate-limited: no
- Parameters: 8 (2 required)
- Recommended policy verdict: Allowed

## Parameters

| Parameter | Type | Required | Description |
| --- | --- | --- | --- |
| `payload` | object | no | Deprecated. Use vatCategoryRates instead of a raw payload object. |
| `routeToken` | string | yes | Opaque routeToken from brc_route_request for this action workflow. Required for transactional tools. Routing permission only — does not replace preview-before-p |
| `companyName` | string | yes | Company context name, for example YOUR-COMPANY-NAME. |
| `confirmWrite` | boolean | no | Must be true only after a plain-English preview before posting has been shown in the current conversation and the user explicitly confirmed posting (for example |
| `connectionRef` | string | no | Opaque Red connection reference returned by brc_confirm_company_connection. Pass this exact value on every later tool call when the MCP client rotates session i |
| `effectiveDate` | string | no | Not a valid standalone payload. Use vatCategoryRates instead. |
| `confirmProcess` | boolean | no |  |
| `vatCategoryRates` | array | no | Full BRC payload array for POST /v1/vatCategories/vatRates, e.g. [{ vatCategoryId: 1, vatRates: [...] }]. |

Parameters from the server's own tool schema.

## Example call (MCP tools/call, JSON-RPC 2.0)

```json
{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "brc_process_vat_category_rates",
    "arguments": {
      "routeToken": "<routeToken>",
      "companyName": "<companyName>"
    }
  }
}
```

## Why brc_process_vat_category_rates is rated Low

Even though brc_process_vat_category_rates only reads data, uncontrolled read access leaks sensitive information and racks up API costs: an agent caught in a retry loop can make thousands of calls a minute without anyone noticing.

Risk signals: Accepts raw HTML/template content (payload) · High parameter count (16 properties)

## Use case

AI agents call brc_process_vat_category_rates to retrieve information from Red by Big Red Cloud without modifying anything. It is typically the context-gathering step in research, monitoring, and reporting workflows, before the agent takes action elsewhere.

## Recommended policy (PolicyLayer)

Verdict: **Allowed**. Enforced by the PolicyLayer MCP gateway (https://policylayer.com/mcp-gateway) before a call reaches Red by Big Red Cloud:

```json
{
  "version": "1",
  "default": "deny",
  "tools": {
    "brc_process_vat_category_rates": {}
  }
}
```

## Other tools on Red by Big Red Cloud (158)

- `brc_clear_all_company_api_keys` — Destructive — https://policylayer.com/tools/io-github-bigredcloud-red-mcp-server/brc-clear-all-company-api-keys.md
- `brc_clear_audit_log` — Destructive — https://policylayer.com/tools/io-github-bigredcloud-red-mcp-server/brc-clear-audit-log.md
- `brc_clear_company_api_key` — Destructive — https://policylayer.com/tools/io-github-bigredcloud-red-mcp-server/brc-clear-company-api-key.md
- `brc_delete_accrual` — Destructive — https://policylayer.com/tools/io-github-bigredcloud-red-mcp-server/brc-delete-accrual.md
- `brc_delete_allocation_resolver` — Destructive — https://policylayer.com/tools/io-github-bigredcloud-red-mcp-server/brc-delete-allocation-resolver.md
- `brc_delete_bank_account` — Destructive — https://policylayer.com/tools/io-github-bigredcloud-red-mcp-server/brc-delete-bank-account.md
- `brc_delete_cash_payment` — Destructive — https://policylayer.com/tools/io-github-bigredcloud-red-mcp-server/brc-delete-cash-payment.md
- `brc_delete_cash_receipt` — Destructive — https://policylayer.com/tools/io-github-bigredcloud-red-mcp-server/brc-delete-cash-receipt.md
- `brc_delete_customer` — Destructive — https://policylayer.com/tools/io-github-bigredcloud-red-mcp-server/brc-delete-customer.md
- `brc_delete_nominal_journal_batch` — Destructive — https://policylayer.com/tools/io-github-bigredcloud-red-mcp-server/brc-delete-nominal-journal-batch.md
- `brc_delete_payment` — Destructive — https://policylayer.com/tools/io-github-bigredcloud-red-mcp-server/brc-delete-payment.md
- `brc_delete_prepayment` — Destructive — https://policylayer.com/tools/io-github-bigredcloud-red-mcp-server/brc-delete-prepayment.md
- `brc_delete_product` — Destructive — https://policylayer.com/tools/io-github-bigredcloud-red-mcp-server/brc-delete-product.md
- `brc_delete_purchase` — Destructive — https://policylayer.com/tools/io-github-bigredcloud-red-mcp-server/brc-delete-purchase.md
- `brc_delete_quote` — Destructive — https://policylayer.com/tools/io-github-bigredcloud-red-mcp-server/brc-delete-quote.md
- `brc_delete_sales_credit_note` — Destructive — https://policylayer.com/tools/io-github-bigredcloud-red-mcp-server/brc-delete-sales-credit-note.md
- `brc_delete_sales_entry` — Destructive — https://policylayer.com/tools/io-github-bigredcloud-red-mcp-server/brc-delete-sales-entry.md
- `brc_delete_sales_invoice` — Destructive — https://policylayer.com/tools/io-github-bigredcloud-red-mcp-server/brc-delete-sales-invoice.md
- `brc_delete_sales_rep` — Destructive — https://policylayer.com/tools/io-github-bigredcloud-red-mcp-server/brc-delete-sales-rep.md
- `brc_delete_supplier` — Destructive — https://policylayer.com/tools/io-github-bigredcloud-red-mcp-server/brc-delete-supplier.md
- `brc_red_help` — Destructive — https://policylayer.com/tools/io-github-bigredcloud-red-mcp-server/brc-red-help.md
- `brc_route_request` — Destructive — https://policylayer.com/tools/io-github-bigredcloud-red-mcp-server/brc-route-request.md
- `brc_getting_started` — Execute — https://policylayer.com/tools/io-github-bigredcloud-red-mcp-server/brc-getting-started.md
- `brc_start_company_connection` — Execute — https://policylayer.com/tools/io-github-bigredcloud-red-mcp-server/brc-start-company-connection.md
- `brc_create_payment` — Financial — https://policylayer.com/tools/io-github-bigredcloud-red-mcp-server/brc-create-payment.md
- `brc_batch_cash_payments` — Read — https://policylayer.com/tools/io-github-bigredcloud-red-mcp-server/brc-batch-cash-payments.md
- `brc_batch_cash_receipts` — Read — https://policylayer.com/tools/io-github-bigredcloud-red-mcp-server/brc-batch-cash-receipts.md
- `brc_batch_customers` — Read — https://policylayer.com/tools/io-github-bigredcloud-red-mcp-server/brc-batch-customers.md
- `brc_batch_payments` — Read — https://policylayer.com/tools/io-github-bigredcloud-red-mcp-server/brc-batch-payments.md
- `brc_batch_products` — Read — https://policylayer.com/tools/io-github-bigredcloud-red-mcp-server/brc-batch-products.md
- …and 128 more: https://policylayer.com/tools/io-github-bigredcloud-red-mcp-server.md

## For agents

This record is a snapshot. Live verdicts and the full registry:

- Check every server in your MCP config at once: `npx -y policylayer stack`
- Vet a server before you add it: install the mcp-precheck skill — `npx skills add https://policylayer.com` (skill text: https://policylayer.com/skill.md)
- Query the registry over MCP: endpoint `https://api.policylayer.com/mcp` — tools `check_mcp_server`, `check_mcp_stack`, `check_tool`, `search_registry`, `get_change_events`

---

Source: the PolicyLayer MCP registry — one continuously verified record per MCP server. Full record: https://policylayer.com/registry?q=io-github-bigredcloud-red-mcp-server · API: https://policylayer.com/registry/api · Policy library: https://policylayer.com/policies/io-github-bigredcloud-red-mcp-server