npm_renew_certificate · Nginx Manager MCP: Risk & Policy

WHAT IT DOES

What npm_renew_certificate does on Nginx Manager

AI agents invoke npm_renew_certificate to trigger actions in Nginx Manager. What it does depends on the arguments the agent supplies, and its effects often reach beyond the immediate call — builds kicked off, notifications sent, workflows started.

WHY IT NEEDS A POLICY

Why npm_renew_certificate needs a policy

Renewing a certificate triggers an external operation (contacting Let's Encrypt CA, validating domain, issuing new cert) rather than simply reading or writing local data. It has side effects on external systems and the certificate lifecycle. The description is truncated, lowering confidence slightly, but the intent is clear from the tool name and server context.

From the tool's definition 'npm_renew_certificate' and 'Renew a Let' (truncated, likely 'Renew a Let's Encrypt certificate') — triggers an external certificate renewal operation

Attacks that exploit this kind of access

Recommended rule Ready

Verdict

npm_renew_certificate Rate-limited

npm_renew_certificate stays usable, but rate-capped — a runaway agent can't fire it dozens of times a minute. Everything else on the server is denied unless you say otherwise.

View as policy code

policy.json

{
  "version": "1",
  "default": "deny",
  "tools": {
    "npm_renew_certificate": {
      "limits": [
        {
          "counter": "npm_renew_certificate_rate",
          "window": "minute",
          "max": 10,
          "scope": "grant"
        }
      ]
    }
  }
}

RATE-LIMIT THIS TOOL →

Instant setup, no code required.

PolicyLayer is an MCP gateway: every tool call is checked against your rule before it reaches Nginx Manager, so you can run agents against it safely.

FAQ

Questions about npm_renew_certificate

What does the npm_renew_certificate tool do? +

Renew a Let. It is categorised as a Execute tool in the Nginx Manager MCP Server, which means it can trigger actions or run processes. Use rate limits and argument validation.

How do I enforce a policy on npm_renew_certificate? +

Register the Nginx Manager MCP server in PolicyLayer and add a rule for npm_renew_certificate: allow, deny, rate-limit, or require approval. Point your MCP client at the PolicyLayer proxy URL and the rule is enforced on every call, before it reaches Nginx Manager. Nothing to install.

What risk level is npm_renew_certificate? +

npm_renew_certificate is a Execute tool with high risk. Execute tools should be rate-limited and have argument validation enabled.

Can I rate-limit npm_renew_certificate? +

Yes. Add a rate_limit block to the npm_renew_certificate rule in your PolicyLayer policy. For example, setting max: 10 and window: 60 limits the tool to 10 calls per minute. Rate limits are tracked per agent session and reset automatically.

How do I block npm_renew_certificate completely? +

Set action: deny in the PolicyLayer policy for npm_renew_certificate. The AI agent will receive a policy violation error and cannot call the tool. You can also include a reason field to explain why the tool is blocked.

What MCP server provides npm_renew_certificate? +

npm_renew_certificate is provided by the Nginx Manager MCP server (kognar-ai/ngnix-manager-mcp-server). PolicyLayer sits as a proxy in front of this server to enforce policies before tool calls reach the server.