humanize_pass · Orpheus MCP: Risk & Policy

WHAT IT DOES

What humanize_pass does on Orpheus

AI agents use humanize_pass to create or update resources in Orpheus — usually the action step of a workflow, after the agent has gathered context. Every call changes real data in your Orpheus environment.

WHY IT NEEDS A POLICY

Why humanize_pass needs a policy

This tool modifies MIDI note timing and velocity parameters in a reversible manner—changes can be undone in REAPER. It does not execute arbitrary code, delete data irreversibly, or move money. The 'cheap, big quality win' language and focus on MIDI humanization confirm it is a write operation that transforms musical attributes.

From the tool's definition Tool applies timing jitter (~12ms) and velocity randomization (±6) to MIDI data, which modifies existing music project data. The description emphasizes this creates changes to generated MIDI.

Attacks that exploit this kind of access

Recommended rule Ready

Verdict

humanize_pass Rate-limited

humanize_pass stays usable, but capped — an agent stuck in a loop can't make hundreds of changes a minute. Everything else on the server is denied unless you say otherwise.

View as policy code

policy.json

{
  "version": "1",
  "default": "deny",
  "tools": {
    "humanize_pass": {
      "limits": [
        {
          "counter": "humanize_pass_rate",
          "window": "minute",
          "max": 30,
          "scope": "grant"
        }
      ]
    }
  }
}

LIMIT THIS TOOL →

Instant setup, no code required.

PolicyLayer is an MCP gateway: every tool call is checked against your rule before it reaches Orpheus, so you can run agents against it safely.

FAQ

Questions about humanize_pass

What does the humanize_pass tool do? +

~12ms timing + 6-velocity jitter on generated MIDI — a cheap, big quality win. It is categorised as a Write tool in the Orpheus MCP Server, which means it can create or modify data. Consider rate limits to prevent runaway writes.

How do I enforce a policy on humanize_pass? +

Register the Orpheus MCP server in PolicyLayer and add a rule for humanize_pass: allow, deny, rate-limit, or require approval. Point your MCP client at the PolicyLayer proxy URL and the rule is enforced on every call, before it reaches Orpheus. Nothing to install.

What risk level is humanize_pass? +

humanize_pass is a Write tool with medium risk. Write tools should be rate-limited to prevent accidental bulk modifications.

Can I rate-limit humanize_pass? +

Yes. Add a rate_limit block to the humanize_pass rule in your PolicyLayer policy. For example, setting max: 10 and window: 60 limits the tool to 10 calls per minute. Rate limits are tracked per agent session and reset automatically.

How do I block humanize_pass completely? +

Set action: deny in the PolicyLayer policy for humanize_pass. The AI agent will receive a policy violation error and cannot call the tool. You can also include a reason field to explain why the tool is blocked.

What MCP server provides humanize_pass? +

humanize_pass is provided by the Orpheus MCP server (mal0ware/orpheus). PolicyLayer sits as a proxy in front of this server to enforce policies before tool calls reach the server.