# insertWhiteboardImage Insert a real IMAGE (photo, screenshot, logo, picture) into a whiteboard — the storage-backed equivalent of insertImageInDocument. Provide the image as imageUrl (fetched and re-hosted), imageBase64, or imageBinary; for large files call createImageUploadSession(documentId) first then pass the returned assetUrl as imageUrl. The bytes are stored in the document-images bucket and the scene only holds a reference (never base64), exactly like pasted images. Options: caption (a text label placed + grouped beneath the image), width/height in px to RESIZE (if only one is given the other follows a 4:3 ratio; ~360px wide if neither), and placement via x/y (top-left) OR align ('left'|'center'|'right', positioned just below existing content) — omit both to auto-place to the right of the current content. After inserting, call getWhiteboardImage to verify. To move or resize the image later, patch its element via updateWhiteboardScene (mode:'patch' with {id, x, y, width, height}). For curated software-architecture ICONS (AWS/Docker/etc.) use addWhiteboardElements with an {type:'image', iconPath} spec instead. Agent View of the PolicyLayer registry record for `insertWhiteboardImage`. HTML page: https://policylayer.com/tools/io-stablebaseline-sb/insertwhiteboardimage ## Facts - Tool: `insertWhiteboardImage` - Server: Stable Baseline (`https://api.stablebaseline.io/functions/v1/cloud-serve/mcp`) — https://policylayer.com/tools/io-stablebaseline-sb.md - Homepage: https://github.com/stablebaseline/mcp - Risk category: Write (Medium risk) - Registry record: grade F, identity unverified - Server auth posture: open - Server CORS policy: https://app.stablebaseline.io - Server rate-limited: no - Parameters: 12 (1 required) - Recommended policy verdict: Rate-limited ## Parameters | Parameter | Type | Required | Description | | --- | --- | --- | --- | | `x` | number | no | Top-left x on the canvas. Omit to auto-place. | | `y` | number | no | Top-left y on the canvas. Omit to auto-place. | | `align` | string | no | Horizontal alignment relative to existing content (placed below it). Ignored if x/y are provided. | | `width` | number | no | Display width in px (resize). Defaults to ~360. | | `height` | number | no | Display height in px. Derived from width at 4:3 if omitted. | | `locked` | boolean | no | Lock the placed image so it cannot be moved, resized, or deleted by hand (e.g. a deck-owned framed slide image that changes only via the deck conversation). Def | | `caption` | string | no | Optional caption shown as a text label grouped beneath the image. | | `fileName` | string | no | Optional original filename (for storage + type hinting). | | `imageUrl` | string | no | URL to fetch the image from, or an assetUrl returned by createImageUploadSession. | | `documentId` | string | yes | The whiteboard's documentId. | | `imageBase64` | string | no | Base64-encoded image bytes (a data: URL prefix is allowed). Best for small images. | | `imageBinary` | array | no | Raw image bytes as an array of 0-255 values (alternative to imageBase64). | Parameters from the server's own tool schema. ## Example call (MCP tools/call, JSON-RPC 2.0) ```json { "jsonrpc": "2.0", "id": 1, "method": "tools/call", "params": { "name": "insertWhiteboardImage", "arguments": { "documentId": "" } } } ``` ## Why insertWhiteboardImage is rated Medium This tool creates new content (images and metadata) in a whiteboard document and persists it to cloud storage. While the action is reversible (images can typically be deleted), the primary function is to write/modify document state. It does not execute arbitrary code, delete data irreversibly, or move money. From the tool's own definition: "The tool 'insertWhiteboardImage' creates and modifies whiteboard content by inserting images with options to add captions and resize." Risk signals: Accepts file system path (fileName) · High parameter count (12 properties) ## Use case AI agents use insertWhiteboardImage to create or update resources in Stable Baseline, usually the action step of a workflow, after the agent has gathered context. Every call changes real data in your Stable Baseline environment. ## Recommended policy (PolicyLayer) Verdict: **Rate-limited**. Enforced by the PolicyLayer MCP gateway (https://policylayer.com/mcp-gateway) before a call reaches Stable Baseline: ```json { "version": "1", "default": "deny", "tools": { "insertWhiteboardImage": { "limits": [ { "counter": "insertwhiteboardimage_rate", "window": "minute", "max": 30, "scope": "grant" } ] } } } ``` ## Other tools on Stable Baseline (195) - `cancelAllKgInScope` — Destructive — https://policylayer.com/tools/io-stablebaseline-sb/cancelallkginscope.md - `cancelKgBuildBatch` — Destructive — https://policylayer.com/tools/io-stablebaseline-sb/cancelkgbuildbatch.md - `deleteDiagramInDocument` — Destructive — https://policylayer.com/tools/io-stablebaseline-sb/deletediagramindocument.md - `deleteDocument` — Destructive — https://policylayer.com/tools/io-stablebaseline-sb/deletedocument.md - `deleteFolder` — Destructive — https://policylayer.com/tools/io-stablebaseline-sb/deletefolder.md - `deleteImageInDocument` — Destructive — https://policylayer.com/tools/io-stablebaseline-sb/deleteimageindocument.md - `deleteImprovement` — Destructive — https://policylayer.com/tools/io-stablebaseline-sb/deleteimprovement.md - `deleteImprovementCategory` — Destructive — https://policylayer.com/tools/io-stablebaseline-sb/deleteimprovementcategory.md - `deleteImprovementComment` — Destructive — https://policylayer.com/tools/io-stablebaseline-sb/deleteimprovementcomment.md - `deletePlan` — Destructive — https://policylayer.com/tools/io-stablebaseline-sb/deleteplan.md - `deletePlanComment` — Destructive — https://policylayer.com/tools/io-stablebaseline-sb/deleteplancomment.md - `deletePlanPhase` — Destructive — https://policylayer.com/tools/io-stablebaseline-sb/deleteplanphase.md - `deleteResourcePermission` — Destructive — https://policylayer.com/tools/io-stablebaseline-sb/deleteresourcepermission.md - `deleteTaskDependency` — Destructive — https://policylayer.com/tools/io-stablebaseline-sb/deletetaskdependency.md - `deleteTeam` — Destructive — https://policylayer.com/tools/io-stablebaseline-sb/deleteteam.md - `deleteVegaDataFile` — Destructive — https://policylayer.com/tools/io-stablebaseline-sb/deletevegadatafile.md - `deleteWhiteboard` — Destructive — https://policylayer.com/tools/io-stablebaseline-sb/deletewhiteboard.md - `removeMember` — Destructive — https://policylayer.com/tools/io-stablebaseline-sb/removemember.md - `removeTeamMember` — Destructive — https://policylayer.com/tools/io-stablebaseline-sb/removeteammember.md - `removeWorkspaceMember` — Destructive — https://policylayer.com/tools/io-stablebaseline-sb/removeworkspacemember.md - `resetDocumentInBrain` — Destructive — https://policylayer.com/tools/io-stablebaseline-sb/resetdocumentinbrain.md - `revokeTeamWorkspaceAccess` — Destructive — https://policylayer.com/tools/io-stablebaseline-sb/revoketeamworkspaceaccess.md - `autoDesignWhiteboard` — Execute — https://policylayer.com/tools/io-stablebaseline-sb/autodesignwhiteboard.md - `renderDiagram` — Execute — https://policylayer.com/tools/io-stablebaseline-sb/renderdiagram.md - `startMeetingScribe` — Execute — https://policylayer.com/tools/io-stablebaseline-sb/startmeetingscribe.md - `stopMeetingScribe` — Execute — https://policylayer.com/tools/io-stablebaseline-sb/stopmeetingscribe.md - `triggerKgRebuild` — Execute — https://policylayer.com/tools/io-stablebaseline-sb/triggerkgrebuild.md - `applySubscriptionChange` — Financial — https://policylayer.com/tools/io-stablebaseline-sb/applysubscriptionchange.md - `cancelSubscription` — Financial — https://policylayer.com/tools/io-stablebaseline-sb/cancelsubscription.md - `getCustomerPortalLink` — Financial — https://policylayer.com/tools/io-stablebaseline-sb/getcustomerportallink.md - …and 165 more: https://policylayer.com/tools/io-stablebaseline-sb.md ## For agents This record is a snapshot. Live verdicts and the full registry: - Check every server in your MCP config at once: `npx -y policylayer stack` - Vet a server before you add it: install the mcp-precheck skill — `npx skills add https://policylayer.com` (skill text: https://policylayer.com/skill.md) - Query the registry over MCP: endpoint `https://api.policylayer.com/mcp` — tools `check_mcp_server`, `check_mcp_stack`, `check_tool`, `search_registry`, `get_change_events` --- Source: the PolicyLayer MCP registry — one continuously verified record per MCP server. Full record: https://policylayer.com/registry?q=io-stablebaseline-sb · API: https://policylayer.com/registry/api · Policy library: https://policylayer.com/policies/io-stablebaseline-sb