# local_ydb_set_root_password

Rotate the runtime root password with ALTER USER and sync the host auth config and root password file to match. YDB may reject passwords that violate auth_config.password_complexity; this tool requires a non-empty password value.

Agent View of the PolicyLayer registry record for `local_ydb_set_root_password`. HTML page: https://policylayer.com/tools/local-ydb/local-ydb-set-root-password

## Facts

- Tool: `local_ydb_set_root_password`
- Server: Local Ydb (`@astandrik/local-ydb-mcp`) — https://policylayer.com/tools/local-ydb.md
- Install: `npx -y @astandrik/local-ydb-mcp`
- Homepage: git+https://github.com/astandrik/local-ydb-toolkit.git
- Risk category: Write (Medium risk)
- Registry record: grade F, identity unverified
- Server rate-limited: no
- Parameters: 0
- Recommended policy verdict: Rate-limited

## Example call (MCP tools/call, JSON-RPC 2.0)

```json
{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "local_ydb_set_root_password",
    "arguments": {}
  }
}
```

## Why local_ydb_set_root_password is rated Medium

While password changes are reversible (the previous password can be set again), this tool modifies authentication credentials that control access to the entire YDB system. This is a Write operation rather than Destructive because password rotations are inherently reversible.

From the tool's own definition: "Tool explicitly performs password rotation via ALTER USER, synchronizes host auth config, and modifies root password file."

Risk signals: Admin/system-level operation

## Use case

AI agents use local_ydb_set_root_password to create or update resources in Local Ydb, usually the action step of a workflow, after the agent has gathered context. Every call changes real data in your Local Ydb environment.

## Recommended policy (PolicyLayer)

Verdict: **Rate-limited**. Enforced by the PolicyLayer MCP gateway (https://policylayer.com/mcp-gateway) before a call reaches Local Ydb:

```json
{
  "version": "1",
  "default": "deny",
  "tools": {
    "local_ydb_set_root_password": {
      "limits": [
        {
          "counter": "local_ydb_set_root_password_rate",
          "window": "minute",
          "max": 30,
          "scope": "grant"
        }
      ]
    }
  }
}
```

## Other tools on Local Ydb (37)

- `local_ydb_cleanup_storage` — Destructive — https://policylayer.com/tools/local-ydb/local-ydb-cleanup-storage.md
- `local_ydb_destroy_stack` — Destructive — https://policylayer.com/tools/local-ydb/local-ydb-destroy-stack.md
- `local_ydb_remove_dynamic_nodes` — Destructive — https://policylayer.com/tools/local-ydb/local-ydb-remove-dynamic-nodes.md
- `local_ydb_add_dynamic_nodes` — Execute — https://policylayer.com/tools/local-ydb/local-ydb-add-dynamic-nodes.md
- `local_ydb_apply_auth_hardening` — Execute — https://policylayer.com/tools/local-ydb/local-ydb-apply-auth-hardening.md
- `local_ydb_bootstrap` — Execute — https://policylayer.com/tools/local-ydb/local-ydb-bootstrap.md
- `local_ydb_bootstrap_root_database` — Execute — https://policylayer.com/tools/local-ydb/local-ydb-bootstrap-root-database.md
- `local_ydb_check_prerequisites` — Execute — https://policylayer.com/tools/local-ydb/local-ydb-check-prerequisites.md
- `local_ydb_pull_image` — Execute — https://policylayer.com/tools/local-ydb/local-ydb-pull-image.md
- `local_ydb_restart_stack` — Execute — https://policylayer.com/tools/local-ydb/local-ydb-restart-stack.md
- `local_ydb_start_dynamic_node` — Execute — https://policylayer.com/tools/local-ydb/local-ydb-start-dynamic-node.md
- `local_ydb_upgrade_version` — Execute — https://policylayer.com/tools/local-ydb/local-ydb-upgrade-version.md
- `local_ydb_auth_check` — Read — https://policylayer.com/tools/local-ydb/local-ydb-auth-check.md
- `local_ydb_container_logs` — Read — https://policylayer.com/tools/local-ydb/local-ydb-container-logs.md
- `local_ydb_database_status` — Read — https://policylayer.com/tools/local-ydb/local-ydb-database-status.md
- `local_ydb_dump_tenant` — Read — https://policylayer.com/tools/local-ydb/local-ydb-dump-tenant.md
- `local_ydb_generate_schema` — Read — https://policylayer.com/tools/local-ydb/local-ydb-generate-schema.md
- `local_ydb_graphshard_check` — Read — https://policylayer.com/tools/local-ydb/local-ydb-graphshard-check.md
- `local_ydb_healthcheck` — Read — https://policylayer.com/tools/local-ydb/local-ydb-healthcheck.md
- `local_ydb_inventory` — Read — https://policylayer.com/tools/local-ydb/local-ydb-inventory.md
- `local_ydb_list_dumps` — Read — https://policylayer.com/tools/local-ydb/local-ydb-list-dumps.md
- `local_ydb_list_versions` — Read — https://policylayer.com/tools/local-ydb/local-ydb-list-versions.md
- `local_ydb_nodes_check` — Read — https://policylayer.com/tools/local-ydb/local-ydb-nodes-check.md
- `local_ydb_pull_status` — Read — https://policylayer.com/tools/local-ydb/local-ydb-pull-status.md
- `local_ydb_reduce_storage_groups` — Read — https://policylayer.com/tools/local-ydb/local-ydb-reduce-storage-groups.md
- `local_ydb_scheme` — Read — https://policylayer.com/tools/local-ydb/local-ydb-scheme.md
- `local_ydb_status_report` — Read — https://policylayer.com/tools/local-ydb/local-ydb-status-report.md
- `local_ydb_storage_leftovers` — Read — https://policylayer.com/tools/local-ydb/local-ydb-storage-leftovers.md
- `local_ydb_storage_placement` — Read — https://policylayer.com/tools/local-ydb/local-ydb-storage-placement.md
- `local_ydb_tenant_check` — Read — https://policylayer.com/tools/local-ydb/local-ydb-tenant-check.md
- …and 7 more: https://policylayer.com/tools/local-ydb.md

## For agents

This record is a snapshot. Live verdicts and the full registry:

- Check every server in your MCP config at once: `npx -y policylayer stack`
- Vet a server before you add it: install the mcp-precheck skill — `npx skills add https://policylayer.com` (skill text: https://policylayer.com/skill.md)
- Query the registry over MCP: endpoint `https://api.policylayer.com/mcp` — tools `check_mcp_server`, `check_mcp_stack`, `check_tool`, `search_registry`, `get_change_events`

---

Source: the PolicyLayer MCP registry — one continuously verified record per MCP server. Full record: https://policylayer.com/registry?q=local-ydb · API: https://policylayer.com/registry/api · Policy library: https://policylayer.com/policies/local-ydb