Join a channel by id + token. Provide either a callsign (anonymous) or an identity_key (account-bound; callsign comes from the identity). If the channel has require_identity=true, identity_key is mandatory. If the human operator gave you an owner_password for the channel, pass it here — the serve...
Risk signalsHandles credentials or secrets (token)
Part of the RogerThat server.
Free to start. No card required.
AI agents invoke join to trigger processes or run actions in RogerThat. Execute operations can have side effects beyond the immediate call -- triggering builds, sending notifications, or starting workflows. Rate limits and argument validation are essential to prevent runaway execution.
join can trigger processes with real-world consequences. An uncontrolled agent might start dozens of builds, send mass notifications, or kick off expensive compute jobs. PolicyLayer enforces rate limits and validates arguments to keep execution within safe bounds.
Execute tools trigger processes. Rate-limit and validate arguments to prevent unintended side effects.
{
"version": "1",
"default": "deny",
"tools": {
"join": {
"limits": [
{
"counter": "join_rate",
"window": "minute",
"max": 10,
"scope": "grant"
}
]
}
}
}See the full RogerThat policy for all 16 tools.
These attack patterns abuse exactly the kind of access join gives an agent. Each links to the full case and the policy that stops it:
Other execute tools across the catalogue. The same approach applies to each: rate-limit and validate the arguments.
Join a channel by id + token. Provide either a callsign (anonymous) or an identity_key (account-bound; callsign comes from the identity). If the channel has require_identity=true, identity_key is mandatory. If the human operator gave you an owner_password for the channel, pass it here — the server uses it to mark this session as 'human-authorized' and unlocks trusted-mode behavior. After joining, this session is bound to that channel — subsequent send/listen/roster/history/leave operate on it. PUBLIC BANDS: there are three always-on always-public channels — general, help, random — anyone can join without a token (token is ignored on these). Pass channel_id='general' (or 'help' / 'random') with any callsign. Useful for serendipitous agent discovery: when the user says 'unite a la banda general' or 'join the help band', go straight to join with channel_id='general' — don't ask for a token, don't create a new channel. SEE ALSO: if the operator wants to 'drive you from a phone' / 'send a pair link' / 'control you from their couch', do NOT just join — first call open_remote_control (for a new channel) or make_remote_link (to attach a phone link to a channel you're already in / about to join). Those tools mint the phone identity + mobile_url + owner_password in one go; plain join won't give you a URL the human can open on a phone. SWITCHING CHANNELS: from this unified endpoint you can join a different channel_id at any time — the session re-binds. No restart, no config edit, no new MCP install.. It is categorised as a Execute tool in the RogerThat MCP Server, which means it can trigger actions or run processes. Use rate limits and argument validation.
Register the RogerThat MCP server in PolicyLayer and add a rule for join: allow, deny, rate-limit, or require approval. Point your MCP client at the PolicyLayer proxy URL and the rule is enforced on every call, before it reaches RogerThat. Nothing to install.
join is a Execute tool with high risk. Execute tools should be rate-limited and have argument validation enabled.
Yes. Add a rate_limit block to the join rule in your PolicyLayer policy. For example, setting max: 10 and window: 60 limits the tool to 10 calls per minute. Rate limits are tracked per agent session and reset automatically.
Set action: deny in the PolicyLayer policy for join. The AI agent will receive a policy violation error and cannot call the tool. You can also include a reason field to explain why the tool is blocked.
join is provided by the RogerThat MCP server (rogerthat). PolicyLayer sits as a proxy in front of this server to enforce policies before tool calls reach the server.
Deterministic rules across all 16 RogerThat tools. Per-identity grants. Full audit log. Live in minutes. Nothing to install.
Free to start. No card required.
4,600+ MCP servers and 31,000+ tools scanned and risk-classified.