東方Projectのキャラクター「霧雨魔理沙」として発話を行うツール。通常会話用。
AI agents invoke speak_zunda_marisa to trigger actions in PVV MCP Server. What it does depends on the arguments the agent supplies, and its effects often reach beyond the immediate call — builds kicked off, notifications sent, workflows started.
This tool triggers text-to-speech synthesis via the VOICEVOX Web API, producing audio output as an external operation. It goes beyond a simple read/write — it executes a call to an external service that generates and presumably plays or returns audio. The blast radius is medium as misuse could generate unwanted audio output or spam the API, but it has no financial or destructive impact.
From the tool's definition 「霧雨魔理沙」として発話を行うツール (tool that performs speech as Kirisame Marisa)
Attacks that exploit this kind of access
東方Projectのキャラクター「霧雨魔理沙」として発話を行うツール。通常会話用。. It is categorised as a Execute tool in the PVV MCP Server MCP Server, which means it can trigger actions or run processes. Use rate limits and argument validation.
Register the PVV MCP Server MCP server in PolicyLayer and add a rule for speak_zunda_marisa: allow, deny, rate-limit, or require approval. Point your MCP client at the PolicyLayer proxy URL and the rule is enforced on every call, before it reaches PVV MCP Server. Nothing to install.
speak_zunda_marisa is a Execute tool with high risk. Execute tools should be rate-limited and have argument validation enabled.
Yes. Add a rate_limit block to the speak_zunda_marisa rule in your PolicyLayer policy. For example, setting max: 10 and window: 60 limits the tool to 10 calls per minute. Rate limits are tracked per agent session and reset automatically.
Set action: deny in the PolicyLayer policy for speak_zunda_marisa. The AI agent will receive a policy violation error and cannot call the tool. You can also include a reason field to explain why the tool is blocked.
speak_zunda_marisa is provided by the PVV MCP Server MCP server (lambda-tuber/pvv-mcp-server). PolicyLayer sits as a proxy in front of this server to enforce policies before tool calls reach the server.
Every MCP server has a record like this.
Type a name, get the same breakdown: verified identity, auth posture, risk grade, capabilities, recommended policy.
Teams ship this data inside their own products. See what a licence covers →