merge_viewpoints · Navisworks Viewpoints MCP: Risk & Policy

WHAT IT DOES

What merge_viewpoints does on Navisworks Viewpoints

AI agents use merge_viewpoints to create or update resources in Navisworks Viewpoints — usually the action step of a workflow, after the agent has gathered context. Every call changes real data in your Navisworks Viewpoints environment.

WHY IT NEEDS A POLICY

Why merge_viewpoints needs a policy

The tool merges viewpoints by adding view elements from one file into another, which is a reversible data modification operation. While it modifies XML structure and viewpoint collections, it does not irreversibly delete data (Destructive), execute arbitrary commands (Execute), involve financial transactions (Financial), or merely read data (Read).

From the tool's definition Tool description indicates adding all <view> elements from a source export into a folder within a base file: 'Добавить все <view> из выгрузки src в папку folder файла base' (Add all <view> from src export to folder in base file).

Attacks that exploit this kind of access

Recommended rule Ready

Verdict

merge_viewpoints Rate-limited

merge_viewpoints stays usable, but capped — an agent stuck in a loop can't make hundreds of changes a minute. Everything else on the server is denied unless you say otherwise.

View as policy code

policy.json

{
  "version": "1",
  "default": "deny",
  "tools": {
    "merge_viewpoints": {
      "limits": [
        {
          "counter": "merge_viewpoints_rate",
          "window": "minute",
          "max": 30,
          "scope": "grant"
        }
      ]
    }
  }
}

LIMIT THIS TOOL →

Instant setup, no code required.

PolicyLayer is an MCP gateway: every tool call is checked against your rule before it reaches Navisworks Viewpoints, so you can run agents against it safely.

FAQ

Questions about merge_viewpoints

What does the merge_viewpoints tool do? +

Добавить все <view> из выгрузки src в папку folder файла base. It is categorised as a Write tool in the Navisworks Viewpoints MCP Server, which means it can create or modify data. Consider rate limits to prevent runaway writes.

How do I enforce a policy on merge_viewpoints? +

Register the Navisworks Viewpoints MCP server in PolicyLayer and add a rule for merge_viewpoints: allow, deny, rate-limit, or require approval. Point your MCP client at the PolicyLayer proxy URL and the rule is enforced on every call, before it reaches Navisworks Viewpoints. Nothing to install.

What risk level is merge_viewpoints? +

merge_viewpoints is a Write tool with medium risk. Write tools should be rate-limited to prevent accidental bulk modifications.

Can I rate-limit merge_viewpoints? +

Yes. Add a rate_limit block to the merge_viewpoints rule in your PolicyLayer policy. For example, setting max: 10 and window: 60 limits the tool to 10 calls per minute. Rate limits are tracked per agent session and reset automatically.

How do I block merge_viewpoints completely? +

Set action: deny in the PolicyLayer policy for merge_viewpoints. The AI agent will receive a policy violation error and cannot call the tool. You can also include a reason field to explain why the tool is blocked.

What MCP server provides merge_viewpoints? +

merge_viewpoints is provided by the Navisworks Viewpoints MCP server (mikhalchankasm/navisworks-viewpoints-mcp). PolicyLayer sits as a proxy in front of this server to enforce policies before tool calls reach the server.