add_ips_rule

What add_ips_rule does on Fortimanager

AI agents use add_ips_rule to create or update resources in Fortimanager, usually the action step of a workflow, after the agent has gathered context. Every call changes real data in your Fortimanager environment.

Why add_ips_rule is rated Medium

This tool creates or adds IPS rules to a security system, which modifies network security configuration. While reversible (rules can be updated or removed), it affects network security posture and could be abused to weaken intrusion prevention if an AI agent is compromised or misdirected. Categorized as Write (not Execute, since it doesn't run arbitrary code) with high severity due to security infrastructure impact.

From the tool's definition Tool name 'add_ips_rule' indicates creation of an IPS (Intrusion Prevention System) rule. The 'add_' prefix and context within FortiManager (a security management platform) confirms this creates or modifies security policy data.

The rule that runs add_ips_rule safely

PolicyLayer is an MCP gateway: it sits between your AI agents and Fortimanager, and checks every tool call against a rule you set before the call runs. Nothing changes on the server itself. For add_ips_rule, this is the rule to start with:

{
  "version": "1",
  "default": "deny",
  "tools": {
    "add_ips_rule": {
      "limits": [
        {
          "counter": "add_ips_rule_rate",
          "window": "minute",
          "max": 30,
          "scope": "grant"
        }
      ]
    }
  }
}

Questions about add_ips_rule