pinchtab_pdf · Pinchtab MCP: Risk & Policy

WHAT IT DOES

What pinchtab_pdf does on Pinchtab

AI agents use pinchtab_pdf to create or update resources in Pinchtab — usually the action step of a workflow, after the agent has gathered context. Every call changes real data in your Pinchtab environment.

WHY IT NEEDS A POLICY

Why pinchtab_pdf needs a policy

The tool generates and exports a new PDF document, which is a reversible data creation action. While it doesn't modify existing state or delete data, exporting to PDF creates a new file artifact. This fits Write rather than Read (which would be passive retrieval only).

From the tool's definition Tool exports/saves the current page as a PDF and returns base64 content. Export operations create new artifacts (PDF files) on the system.

Attacks that exploit this kind of access

Recommended rule Ready

Verdict

pinchtab_pdf Rate-limited

pinchtab_pdf stays usable, but capped — an agent stuck in a loop can't make hundreds of changes a minute. Everything else on the server is denied unless you say otherwise.

View as policy code

policy.json

{
  "version": "1",
  "default": "deny",
  "tools": {
    "pinchtab_pdf": {
      "limits": [
        {
          "counter": "pinchtab_pdf_rate",
          "window": "minute",
          "max": 30,
          "scope": "grant"
        }
      ]
    }
  }
}

LIMIT THIS TOOL →

Instant setup, no code required.

PolicyLayer is an MCP gateway: every tool call is checked against your rule before it reaches Pinchtab, so you can run agents against it safely.

FAQ

Questions about pinchtab_pdf

What does the pinchtab_pdf tool do? +

Export the current page as a PDF. Returns the PDF as base64. It is categorised as a Write tool in the Pinchtab MCP Server, which means it can create or modify data. Consider rate limits to prevent runaway writes.

How do I enforce a policy on pinchtab_pdf? +

Register the Pinchtab MCP server in PolicyLayer and add a rule for pinchtab_pdf: allow, deny, rate-limit, or require approval. Point your MCP client at the PolicyLayer proxy URL and the rule is enforced on every call, before it reaches Pinchtab. Nothing to install.

What risk level is pinchtab_pdf? +

pinchtab_pdf is a Write tool with medium risk. Write tools should be rate-limited to prevent accidental bulk modifications.

Can I rate-limit pinchtab_pdf? +

Yes. Add a rate_limit block to the pinchtab_pdf rule in your PolicyLayer policy. For example, setting max: 10 and window: 60 limits the tool to 10 calls per minute. Rate limits are tracked per agent session and reset automatically.

How do I block pinchtab_pdf completely? +

Set action: deny in the PolicyLayer policy for pinchtab_pdf. The AI agent will receive a policy violation error and cannot call the tool. You can also include a reason field to explain why the tool is blocked.

What MCP server provides pinchtab_pdf? +

pinchtab_pdf is provided by the Pinchtab MCP server (maderwin/pinchtab-mcp). PolicyLayer sits as a proxy in front of this server to enforce policies before tool calls reach the server.