create_routing_firewall_rule

What create_routing_firewall_rule does on CloudStack MCP Server

AI agents use create_routing_firewall_rule to create or update resources in CloudStack MCP Server, usually the action step of a workflow, after the agent has gathered context. Every call changes real data in your CloudStack MCP Server environment.

Why create_routing_firewall_rule is rated Medium

This tool creates (writes) firewall rules, which are reversible configurations. While firewall rules control traffic and have security implications, they are not destructive (can be deleted), not financial, and not code execution. The high severity reflects that misconfigured firewall rules could disrupt network connectivity or expose infrastructure, but this remains a Write operation.

From the tool's definition Tool name 'create_routing_firewall_rule' and description 'Create IPv4 routing firewall rule' indicate creation of network security rules. The verb 'create' and the term 'firewall rule' demonstrate a write operation that modifies network configuration.

The rule that runs create_routing_firewall_rule safely

PolicyLayer is an MCP gateway: it sits between your AI agents and CloudStack MCP Server, and checks every tool call against a rule you set before the call runs. Nothing changes on the server itself. For create_routing_firewall_rule, this is the rule to start with:

{
  "version": "1",
  "default": "deny",
  "tools": {
    "create_routing_firewall_rule": {
      "limits": [
        {
          "counter": "create_routing_firewall_rule_rate",
          "window": "minute",
          "max": 30,
          "scope": "grant"
        }
      ]
    }
  }
}

Questions about create_routing_firewall_rule