up

What up does on Ncp

AI agents invoke up to trigger actions in Ncp. What it does depends on the arguments the agent supplies, and its effects often reach beyond the immediate call: builds kicked off, notifications sent, workflows started.

Why up is rated High

This tool triggers external operations (cloud infrastructure deployment) whose effects depend on the Pulumi configuration and state. While not immediately destructive, deployment operations can create, modify, or remove cloud resources with significant blast radius. Classified as Execute rather than Write because it invokes an external orchestration engine with complex, environment-dependent side effects.

From the tool's definition Tool name 'up' and description 'Deploy Pulumi stack' indicate execution of infrastructure deployment operations. Pulumi is an infrastructure-as-code framework that executes real-world changes to cloud resources.

The rule that runs up safely

PolicyLayer is an MCP gateway: it sits between your AI agents and Ncp, and checks every tool call against a rule you set before the call runs. Nothing changes on the server itself. For up, this is the rule to start with:

{
  "version": "1",
  "default": "deny",
  "tools": {
    "up": {
      "limits": [
        {
          "counter": "up_rate",
          "window": "minute",
          "max": 10,
          "scope": "grant"
        }
      ]
    }
  }
}

Questions about up