testpass_save_pack · UnClick MCP: Risk & Policy

WHAT IT DOES

What testpass_save_pack does on UnClick

AI agents use testpass_save_pack to create or update resources in UnClick — usually the action step of a workflow, after the agent has gathered context. Every call changes real data in your UnClick environment.

PARAMETERS

Parameter	Type	Required	Description
`yaml`	string	Yes	Full pack definition as a YAML string
`pack_id`	string	Yes	Unique slug for the pack (e.g. 'my-mcp-pack')

Parameters from the server's own tool schema.

WHY IT NEEDS A POLICY

Why testpass_save_pack needs a policy

This tool modifies data reversibly by creating or updating a TestPass pack configuration. It is a Write operation (create/update) rather than Destructive since packs can be overwritten or deleted separately. Severity is medium because misconfiguration of a test pack could affect test execution or system behavior, but the blast radius depends on what the pack controls and is not irreversible.

From the tool's definition Tool description states it 'Creates or updates the pack identified by pack_id' - explicit create/update operations on data.

Attacks that exploit this kind of access

Recommended rule Ready

Verdict

testpass_save_pack Rate-limited

testpass_save_pack stays usable, but capped — an agent stuck in a loop can't make hundreds of changes a minute. Everything else on the server is denied unless you say otherwise.

View as policy code

policy.json

{
  "version": "1",
  "default": "deny",
  "tools": {
    "testpass_save_pack": {
      "limits": [
        {
          "counter": "testpass_save_pack_rate",
          "window": "minute",
          "max": 30,
          "scope": "grant"
        }
      ]
    }
  }
}

LIMIT THIS TOOL →

Instant setup, no code required.

PolicyLayer is an MCP gateway: every tool call is checked against your rule before it reaches UnClick, so you can run agents against it safely.

FAQ

Questions about testpass_save_pack

What does the testpass_save_pack tool do? +

Save a TestPass pack YAML definition for the caller. Creates or updates the pack identified by pack_id. It is categorised as a Write tool in the UnClick MCP Server, which means it can create or modify data. Consider rate limits to prevent runaway writes.

What parameters does testpass_save_pack accept? +

testpass_save_pack accepts 2 parameters: yaml, pack_id. Required: yaml, pack_id. The full parameter table on this page comes from the server's own tool schema.

How do I enforce a policy on testpass_save_pack? +

Register the UnClick MCP server in PolicyLayer and add a rule for testpass_save_pack: allow, deny, rate-limit, or require approval. Point your MCP client at the PolicyLayer proxy URL and the rule is enforced on every call, before it reaches UnClick. Nothing to install.

What risk level is testpass_save_pack? +

testpass_save_pack is a Write tool with medium risk. Write tools should be rate-limited to prevent accidental bulk modifications.

Can I rate-limit testpass_save_pack? +

Yes. Add a rate_limit block to the testpass_save_pack rule in your PolicyLayer policy. For example, setting max: 10 and window: 60 limits the tool to 10 calls per minute. Rate limits are tracked per agent session and reset automatically.

How do I block testpass_save_pack completely? +

Set action: deny in the PolicyLayer policy for testpass_save_pack. The AI agent will receive a policy violation error and cannot call the tool. You can also include a reason field to explain why the tool is blocked.

What MCP server provides testpass_save_pack? +

testpass_save_pack is provided by the UnClick MCP server (@unclick/mcp-server). PolicyLayer sits as a proxy in front of this server to enforce policies before tool calls reach the server.