create_project_grant · Run402 MCP: Risk & Policy

WHAT IT DOES

What create_project_grant does on Run402

AI agents use create_project_grant to commit financial operations through Run402 — usually the final step of a payment, billing, or trading workflow. A call moves real money.

WHY IT NEEDS A POLICY

Why create_project_grant needs a policy

This tool issues capability grants to wallets, which is a financial operation involving authorization of funds or payment capabilities to wallet addresses. In the context of an X402 payment infrastructure server, granting wallet capabilities constitutes committing financial obligations or enabling financial transactions.

From the tool's definition Issue a per-project capability grant to a wallet (for agent/CI principals that aren

Attacks that exploit this kind of access

Recommended rule Ready

Verdict

create_project_grant Approval-gated

Any call to create_project_grant is blocked until a human approves it. The rest of the server keeps working.

View as policy code

policy.json

{
  "version": "1",
  "default": "deny",
  "tools": {
    "create_project_grant": {
      "deny_if": [
        {
          "conditions": [],
          "on_deny": "Requires human approval."
        }
      ]
    }
  }
}

GATE THIS TOOL →

Instant setup, no code required.

PolicyLayer is an MCP gateway: every tool call is checked against your rule before it reaches Run402, so you can run agents against it safely.

FAQ

Questions about create_project_grant

What does the create_project_grant tool do? +

Issue a per-project capability grant to a wallet (for agent/CI principals that aren. It is categorised as a Financial tool in the Run402 MCP Server, which means it involves financial transactions. Block by default and require explicit approval.

How do I enforce a policy on create_project_grant? +

Register the Run402 MCP server in PolicyLayer and add a rule for create_project_grant: allow, deny, rate-limit, or require approval. Point your MCP client at the PolicyLayer proxy URL and the rule is enforced on every call, before it reaches Run402. Nothing to install.

What risk level is create_project_grant? +

create_project_grant is a Financial tool with critical risk. Critical-risk tools should be blocked by default and only enabled with explicit human approval.

Can I rate-limit create_project_grant? +

Yes. Add a rate_limit block to the create_project_grant rule in your PolicyLayer policy. For example, setting max: 10 and window: 60 limits the tool to 10 calls per minute. Rate limits are tracked per agent session and reset automatically.

How do I block create_project_grant completely? +

Set action: deny in the PolicyLayer policy for create_project_grant. The AI agent will receive a policy violation error and cannot call the tool. You can also include a reason field to explain why the tool is blocked.

What MCP server provides create_project_grant? +

create_project_grant is provided by the Run402 MCP server (kychee-com/run402). PolicyLayer sits as a proxy in front of this server to enforce policies before tool calls reach the server.