createWorkout · Hevy MCP Server MCP: Risk & Policy

WHAT IT DOES

What createWorkout does on Hevy MCP Server

AI agents use createWorkout to create or update resources in Hevy MCP Server — usually the action step of a workflow, after the agent has gathered context. Every call changes real data in your Hevy MCP Server environment.

WHY IT NEEDS A POLICY

Why createWorkout needs a policy

This tool creates new workout records in the Hevy fitness platform. Creation operations are Write-category actions as they add new data reversibly (the created workout can later be modified or deleted). Severity is medium because misuse could result in spam/pollution of user workout data, but the impact is limited to the user's own fitness records and there are no irreversible consequences or financial implications.

From the tool's definition Tool name 'createWorkout' combined with description 'Create a new workout' indicates data creation. The Hevy API context shows this is a fitness tracking platform where workouts are user records that can be created and modified.

Attacks that exploit this kind of access

Recommended rule Ready

Verdict

createWorkout Rate-limited

createWorkout stays usable, but capped — an agent stuck in a loop can't make hundreds of changes a minute. Everything else on the server is denied unless you say otherwise.

View as policy code

policy.json

{
  "version": "1",
  "default": "deny",
  "tools": {
    "createWorkout": {
      "limits": [
        {
          "counter": "createworkout_rate",
          "window": "minute",
          "max": 30,
          "scope": "grant"
        }
      ]
    }
  }
}

LIMIT THIS TOOL →

Instant setup, no code required.

PolicyLayer is an MCP gateway: every tool call is checked against your rule before it reaches Hevy MCP Server, so you can run agents against it safely.

FAQ

Questions about createWorkout

What does the createWorkout tool do? +

Create a new workout. It is categorised as a Write tool in the Hevy MCP Server MCP Server, which means it can create or modify data. Consider rate limits to prevent runaway writes.

How do I enforce a policy on createWorkout? +

Register the Hevy MCP Server MCP server in PolicyLayer and add a rule for createWorkout: allow, deny, rate-limit, or require approval. Point your MCP client at the PolicyLayer proxy URL and the rule is enforced on every call, before it reaches Hevy MCP Server. Nothing to install.

What risk level is createWorkout? +

createWorkout is a Write tool with medium risk. Write tools should be rate-limited to prevent accidental bulk modifications.

Can I rate-limit createWorkout? +

Yes. Add a rate_limit block to the createWorkout rule in your PolicyLayer policy. For example, setting max: 10 and window: 60 limits the tool to 10 calls per minute. Rate limits are tracked per agent session and reset automatically.

How do I block createWorkout completely? +

Set action: deny in the PolicyLayer policy for createWorkout. The AI agent will receive a policy violation error and cannot call the tool. You can also include a reason field to explain why the tool is blocked.

What MCP server provides createWorkout? +

createWorkout is provided by the Hevy MCP Server MCP server (jcjiron/hevy-mcp). PolicyLayer sits as a proxy in front of this server to enforce policies before tool calls reach the server.