assign_volume

What assign_volume does on CloudStack MCP Server

AI agents use assign_volume to create or update resources in CloudStack MCP Server, usually the action step of a workflow, after the agent has gathered context. Every call changes real data in your CloudStack MCP Server environment.

Why assign_volume is rated Medium

Assigning a volume changes metadata and ownership but does not destroy data or execute arbitrary code. However, the severity is elevated (high rather than medium) because reassigning storage volumes could impact availability and access control for other accounts, and an unauthorized reassignment could expose sensitive data or deny legitimate users access to their storage.

From the tool's definition Tool description states 'Assign volume to different account', which modifies the ownership/association of a storage volume. The action is reversible—a volume can be reassigned to another account. This is a data modification operation without deletion.

The rule that runs assign_volume safely

PolicyLayer is an MCP gateway: it sits between your AI agents and CloudStack MCP Server, and checks every tool call against a rule you set before the call runs. Nothing changes on the server itself. For assign_volume, this is the rule to start with:

{
  "version": "1",
  "default": "deny",
  "tools": {
    "assign_volume": {
      "limits": [
        {
          "counter": "assign_volume_rate",
          "window": "minute",
          "max": 30,
          "scope": "grant"
        }
      ]
    }
  }
}

Questions about assign_volume