roku_deep_link · Roku MCP Server MCP: Risk & Policy

WHAT IT DOES

What roku_deep_link does on Roku MCP Server

AI agents invoke roku_deep_link to trigger actions in Roku MCP Server. What it does depends on the arguments the agent supplies, and its effects often reach beyond the immediate call — builds kicked off, notifications sent, workflows started.

WHY IT NEEDS A POLICY

Why roku_deep_link needs a policy

This tool sends a POST request to a Roku device to launch an application with specific content, which is an external operation with side effects (launching/switching app state on a physical/virtual device). It is not a simple read, nor does it delete data or involve finances. The blast radius is medium: misuse could disrupt device state or interfere with running applications, but damage is generally recoverable.

From the tool's definition POST http://{host}:8060/launch/dev?contentId={id}&mediaType={type} — triggers an external operation on a Roku device by launching an app via deep link with specified content parameters

Attacks that exploit this kind of access

Recommended rule Ready

Verdict

roku_deep_link Rate-limited

roku_deep_link stays usable, but rate-capped — a runaway agent can't fire it dozens of times a minute. Everything else on the server is denied unless you say otherwise.

View as policy code

policy.json

{
  "version": "1",
  "default": "deny",
  "tools": {
    "roku_deep_link": {
      "limits": [
        {
          "counter": "roku_deep_link_rate",
          "window": "minute",
          "max": 10,
          "scope": "grant"
        }
      ]
    }
  }
}

RATE-LIMIT THIS TOOL →

Instant setup, no code required.

PolicyLayer is an MCP gateway: every tool call is checked against your rule before it reaches Roku MCP Server, so you can run agents against it safely.

FAQ

Questions about roku_deep_link

What does the roku_deep_link tool do? +

Test deep linking (Roku certification requirement). Roku API: POST http://{host}:8060/launch/dev?contentId={id}&mediaType={type} Deep linking is MANDATORY for Roku certification. mediaType examples: movie, episode, series, short-form, live, game Ref: developer.roku.com/docs/developer-program/discovery/deep-linking.md. It is categorised as a Execute tool in the Roku MCP Server MCP Server, which means it can trigger actions or run processes. Use rate limits and argument validation.

How do I enforce a policy on roku_deep_link? +

Register the Roku MCP Server MCP server in PolicyLayer and add a rule for roku_deep_link: allow, deny, rate-limit, or require approval. Point your MCP client at the PolicyLayer proxy URL and the rule is enforced on every call, before it reaches Roku MCP Server. Nothing to install.

What risk level is roku_deep_link? +

roku_deep_link is a Execute tool with high risk. Execute tools should be rate-limited and have argument validation enabled.

Can I rate-limit roku_deep_link? +

Yes. Add a rate_limit block to the roku_deep_link rule in your PolicyLayer policy. For example, setting max: 10 and window: 60 limits the tool to 10 calls per minute. Rate limits are tracked per agent session and reset automatically.

How do I block roku_deep_link completely? +

Set action: deny in the PolicyLayer policy for roku_deep_link. The AI agent will receive a policy violation error and cannot call the tool. You can also include a reason field to explain why the tool is blocked.

What MCP server provides roku_deep_link? +

roku_deep_link is provided by the Roku MCP Server MCP server (maskelog/roku-mcp). PolicyLayer sits as a proxy in front of this server to enforce policies before tool calls reach the server.