upload_document_content · Scifinder Route MCP: Risk & Policy

WHAT IT DOES

What upload_document_content does on Scifinder Route

AI agents use upload_document_content to create or update resources in Scifinder Route — usually the action step of a workflow, after the agent has gathered context. Every call changes real data in your Scifinder Route environment.

WHY IT NEEDS A POLICY

Why upload_document_content needs a policy

This tool modifies the indexed synthesis route database by adding new SciFinder export content. While not irreversible (backups and cleanup tools exist on the server), it creates/ingests data with potential side effects if malicious content bypasses validation. The 'safety validation' mention suggests the developers anticipated risk.

From the tool's definition Tool description states it 'Upload[s]' content, which creates or modifies data in the local SciFinder index. The 'base64-encoded' payload and 'safety validation' suggest structured data ingestion into the database.

Attacks that exploit this kind of access

Recommended rule Ready

Verdict

upload_document_content Rate-limited

upload_document_content stays usable, but capped — an agent stuck in a loop can't make hundreds of changes a minute. Everything else on the server is denied unless you say otherwise.

View as policy code

policy.json

{
  "version": "1",
  "default": "deny",
  "tools": {
    "upload_document_content": {
      "limits": [
        {
          "counter": "upload_document_content_rate",
          "window": "minute",
          "max": 30,
          "scope": "grant"
        }
      ]
    }
  }
}

LIMIT THIS TOOL →

Instant setup, no code required.

PolicyLayer is an MCP gateway: every tool call is checked against your rule before it reaches Scifinder Route, so you can run agents against it safely.

FAQ

Questions about upload_document_content

What does the upload_document_content tool do? +

Upload base64-encoded SciFinder export content through MCP after safety validation. It is categorised as a Write tool in the Scifinder Route MCP Server, which means it can create or modify data. Consider rate limits to prevent runaway writes.

How do I enforce a policy on upload_document_content? +

Register the Scifinder Route MCP server in PolicyLayer and add a rule for upload_document_content: allow, deny, rate-limit, or require approval. Point your MCP client at the PolicyLayer proxy URL and the rule is enforced on every call, before it reaches Scifinder Route. Nothing to install.

What risk level is upload_document_content? +

upload_document_content is a Write tool with medium risk. Write tools should be rate-limited to prevent accidental bulk modifications.

Can I rate-limit upload_document_content? +

Yes. Add a rate_limit block to the upload_document_content rule in your PolicyLayer policy. For example, setting max: 10 and window: 60 limits the tool to 10 calls per minute. Rate limits are tracked per agent session and reset automatically.

How do I block upload_document_content completely? +

Set action: deny in the PolicyLayer policy for upload_document_content. The AI agent will receive a policy violation error and cannot call the tool. You can also include a reason field to explain why the tool is blocked.

What MCP server provides upload_document_content? +

upload_document_content is provided by the Scifinder Route MCP server (kettly1260/scifinder-route-mcp). PolicyLayer sits as a proxy in front of this server to enforce policies before tool calls reach the server.