lexq_deploy_live · LexQ MCP: Risk & Policy

WHAT IT DOES

What lexq_deploy_live does on LexQ

AI agents invoke lexq_deploy_live to trigger actions in LexQ. What it does depends on the arguments the agent supplies, and its effects often reach beyond the immediate call — builds kicked off, notifications sent, workflows started.

WHY IT NEEDS A POLICY

Why lexq_deploy_live needs a policy

While this tool modifies production state (which could suggest Write category), the immediate, irreversible application to live traffic with business-critical consequences elevates it to Execute severity. An AI agent misusing this tool could instantly break business logic, disable critical policies, or cause widespread operational disruption without the ability to stop it mid-deployment.

From the tool's definition Tool deploys an ACTIVE (published) version to live traffic with immediate effect. The description explicitly states "Takes effect immediately," indicating irreversible execution of business rule changes in a production environment.

Attacks that exploit this kind of access

Recommended rule Ready

Verdict

lexq_deploy_live Rate-limited

lexq_deploy_live stays usable, but rate-capped — a runaway agent can't fire it dozens of times a minute. Everything else on the server is denied unless you say otherwise.

View as policy code

policy.json

{
  "version": "1",
  "default": "deny",
  "tools": {
    "lexq_deploy_live": {
      "limits": [
        {
          "counter": "lexq_deploy_live_rate",
          "window": "minute",
          "max": 10,
          "scope": "grant"
        }
      ]
    }
  }
}

RATE-LIMIT THIS TOOL →

Instant setup, no code required.

PolicyLayer is an MCP gateway: every tool call is checked against your rule before it reaches LexQ, so you can run agents against it safely.

FAQ

Questions about lexq_deploy_live

What does the lexq_deploy_live tool do? +

Deploy an ACTIVE (published) version to live traffic. Takes effect immediately. Undefined facts do not block deployment (INV-4); use lexq_facts_unregistered to review what the version references but has not defined. It is categorised as a Execute tool in the LexQ MCP Server, which means it can trigger actions or run processes. Use rate limits and argument validation.

How do I enforce a policy on lexq_deploy_live? +

Register the LexQ MCP server in PolicyLayer and add a rule for lexq_deploy_live: allow, deny, rate-limit, or require approval. Point your MCP client at the PolicyLayer proxy URL and the rule is enforced on every call, before it reaches LexQ. Nothing to install.

What risk level is lexq_deploy_live? +

lexq_deploy_live is a Execute tool with high risk. Execute tools should be rate-limited and have argument validation enabled.

Can I rate-limit lexq_deploy_live? +

Yes. Add a rate_limit block to the lexq_deploy_live rule in your PolicyLayer policy. For example, setting max: 10 and window: 60 limits the tool to 10 calls per minute. Rate limits are tracked per agent session and reset automatically.

How do I block lexq_deploy_live completely? +

Set action: deny in the PolicyLayer policy for lexq_deploy_live. The AI agent will receive a policy violation error and cannot call the tool. You can also include a reason field to explain why the tool is blocked.

What MCP server provides lexq_deploy_live? +

lexq_deploy_live is provided by the LexQ MCP server (lexq-io/lexq-cli). PolicyLayer sits as a proxy in front of this server to enforce policies before tool calls reach the server.