create_integration · Nango MCP: Risk & Policy

WHAT IT DOES

What create_integration does on Nango

AI agents use create_integration to create or update resources in Nango — usually the action step of a workflow, after the agent has gathered context. Every call changes real data in your Nango environment.

WHY IT NEEDS A POLICY

Why create_integration needs a policy

Creating an integration in Nango establishes a new third-party service connection configuration. This is a reversible modification (integrations can be deleted as evidenced by the sibling 'delete_integration' tool) with moderate blast radius—a misconfigured integration could cause operational issues or expose API credentials, but it does not directly execute external code, delete data irreversibly, or move funds.

From the tool's definition Tool name 'create_integration' and description 'Create a Nango integration using the Nango API payload shape' indicate data creation. The verb 'Create' is characteristic of Write operations that modify system state reversibly.

Attacks that exploit this kind of access

Recommended rule Ready

Verdict

create_integration Rate-limited

create_integration stays usable, but capped — an agent stuck in a loop can't make hundreds of changes a minute. Everything else on the server is denied unless you say otherwise.

View as policy code

policy.json

{
  "version": "1",
  "default": "deny",
  "tools": {
    "create_integration": {
      "limits": [
        {
          "counter": "create_integration_rate",
          "window": "minute",
          "max": 30,
          "scope": "grant"
        }
      ]
    }
  }
}

LIMIT THIS TOOL →

Instant setup, no code required.

PolicyLayer is an MCP gateway: every tool call is checked against your rule before it reaches Nango, so you can run agents against it safely.

FAQ

Questions about create_integration

What does the create_integration tool do? +

Create a Nango integration using the Nango API payload shape. It is categorised as a Write tool in the Nango MCP Server, which means it can create or modify data. Consider rate limits to prevent runaway writes.

How do I enforce a policy on create_integration? +

Register the Nango MCP server in PolicyLayer and add a rule for create_integration: allow, deny, rate-limit, or require approval. Point your MCP client at the PolicyLayer proxy URL and the rule is enforced on every call, before it reaches Nango. Nothing to install.

What risk level is create_integration? +

create_integration is a Write tool with medium risk. Write tools should be rate-limited to prevent accidental bulk modifications.

Can I rate-limit create_integration? +

Yes. Add a rate_limit block to the create_integration rule in your PolicyLayer policy. For example, setting max: 10 and window: 60 limits the tool to 10 calls per minute. Rate limits are tracked per agent session and reset automatically.

How do I block create_integration completely? +

Set action: deny in the PolicyLayer policy for create_integration. The AI agent will receive a policy violation error and cannot call the tool. You can also include a reason field to explain why the tool is blocked.

What MCP server provides create_integration? +

create_integration is provided by the Nango MCP server (levsky22/nango-mcp-server). PolicyLayer sits as a proxy in front of this server to enforce policies before tool calls reach the server.