Triggers the 10th Man Protocol — spawns 3 contrarian agents to independently challenge proposed code changes before execution. Use when: - Changes touch 3+ files across modules - Architecture decisions (new patterns, major refactors) - Auth, security, or data model changes - DB migrations or sche...
AI agents invoke tenth_man_review to trigger actions in Tenth Man. What it does depends on the arguments the agent supplies, and its effects often reach beyond the immediate call — builds kicked off, notifications sent, workflows started.
The tool executes external agent operations (spawning and running multiple AI agents in parallel) rather than passively reading or writing data. While the agents are designed to provide review feedback (which could be considered Write, since it 'writes a review file'), the primary action is triggering external agent execution with effects that depend on the input arguments (the code changes being reviewed).
From the tool's definition Tool description states it 'spawns 3 contrarian agents' and 'runs in parallel' with external agents (Codex, Gemini) and Claude subagents. This triggers execution of external code/agents whose behavior depends on the proposed changes passed as arguments.
Attacks that exploit this kind of access
Triggers the 10th Man Protocol — spawns 3 contrarian agents to independently challenge proposed code changes before execution. Use when: - Changes touch 3+ files across modules - Architecture decisions (new patterns, major refactors) - Auth, security, or data model changes - DB migrations or schema changes - Any change where a mistake would be costly The protocol takes 2-5 minutes depending on agent availability. External agents (Codex, Gemini) run in parallel; Claude subagents run sequentially in isolated context windows. In STANDARD mode: writes a review file and waits for your verbal approval. After approval, you MUST create an execution plan. In AUTO mode: returns findings directly — incorporate them into your plan and proceed. It is categorised as a Execute tool in the Tenth Man MCP Server, which means it can trigger actions or run processes. Use rate limits and argument validation.
Register the Tenth Man MCP server in PolicyLayer and add a rule for tenth_man_review: allow, deny, rate-limit, or require approval. Point your MCP client at the PolicyLayer proxy URL and the rule is enforced on every call, before it reaches Tenth Man. Nothing to install.
tenth_man_review is a Execute tool with high risk. Execute tools should be rate-limited and have argument validation enabled.
Yes. Add a rate_limit block to the tenth_man_review rule in your PolicyLayer policy. For example, setting max: 10 and window: 60 limits the tool to 10 calls per minute. Rate limits are tracked per agent session and reset automatically.
Set action: deny in the PolicyLayer policy for tenth_man_review. The AI agent will receive a policy violation error and cannot call the tool. You can also include a reason field to explain why the tool is blocked.
tenth_man_review is provided by the Tenth Man MCP server (keeganthewhi/tenth-man-mcp). PolicyLayer sits as a proxy in front of this server to enforce policies before tool calls reach the server.
Every MCP server has a record like this.
Type a name, get the same breakdown: verified identity, auth posture, risk grade, capabilities, recommended policy.
Teams ship this data inside their own products. See what a licence covers →