cost_guard_configure · Agent Safety MCP: Risk & Policy

WHAT IT DOES

What cost_guard_configure does on Agent Safety

AI agents use cost_guard_configure to create or update resources in Agent Safety — usually the action step of a workflow, after the agent has gathered context. Every call changes real data in your Agent Safety environment.

WHY IT NEEDS A POLICY

Why cost_guard_configure needs a policy

This tool creates or modifies cost guard budget configuration settings reversibly. While not destructive (budgets can be reconfigured), it is a Write operation that could have significant blast radius if an AI agent misconfigures budgets to allow excessive spending, potentially leading to financial impact through uncontrolled API costs.

From the tool's definition Tool name 'cost_guard_configure' and description 'Configure the cost guard budget' indicates modification of existing cost budget settings.

Attacks that exploit this kind of access

Recommended rule Ready

Verdict

cost_guard_configure Rate-limited

cost_guard_configure stays usable, but capped — an agent stuck in a loop can't make hundreds of changes a minute. Everything else on the server is denied unless you say otherwise.

View as policy code

policy.json

{
  "version": "1",
  "default": "deny",
  "tools": {
    "cost_guard_configure": {
      "limits": [
        {
          "counter": "cost_guard_configure_rate",
          "window": "minute",
          "max": 30,
          "scope": "grant"
        }
      ]
    }
  }
}

LIMIT THIS TOOL →

Instant setup, no code required.

PolicyLayer is an MCP gateway: every tool call is checked against your rule before it reaches Agent Safety, so you can run agents against it safely.

FAQ

Questions about cost_guard_configure

What does the cost_guard_configure tool do? +

Configure the cost guard budget. It is categorised as a Write tool in the Agent Safety MCP Server, which means it can create or modify data. Consider rate limits to prevent runaway writes.

How do I enforce a policy on cost_guard_configure? +

Register the Agent Safety MCP server in PolicyLayer and add a rule for cost_guard_configure: allow, deny, rate-limit, or require approval. Point your MCP client at the PolicyLayer proxy URL and the rule is enforced on every call, before it reaches Agent Safety. Nothing to install.

What risk level is cost_guard_configure? +

cost_guard_configure is a Write tool with medium risk. Write tools should be rate-limited to prevent accidental bulk modifications.

Can I rate-limit cost_guard_configure? +

Yes. Add a rate_limit block to the cost_guard_configure rule in your PolicyLayer policy. For example, setting max: 10 and window: 60 limits the tool to 10 calls per minute. Rate limits are tracked per agent session and reset automatically.

How do I block cost_guard_configure completely? +

Set action: deny in the PolicyLayer policy for cost_guard_configure. The AI agent will receive a policy violation error and cannot call the tool. You can also include a reason field to explain why the tool is blocked.

What MCP server provides cost_guard_configure? +

cost_guard_configure is provided by the Agent Safety MCP server (luciferforge/agent-safety-mcp). PolicyLayer sits as a proxy in front of this server to enforce policies before tool calls reach the server.