manage_false_positives · MCP Shamash MCP: Risk & Policy

WHAT IT DOES

What manage_false_positives does on MCP Shamash

AI agents use manage_false_positives to create or update resources in MCP Shamash — usually the action step of a workflow, after the agent has gathered context. Every call changes real data in your MCP Shamash environment.

WHY IT NEEDS A POLICY

Why manage_false_positives needs a policy

This tool modifies security testing configurations by creating, updating, or removing false positive suppressions. While reversible (Write rather than Destructive), it can affect the results of security audits and compliance checks if suppressions are added inappropriately or modified by an untrusted agent. This could mask real vulnerabilities from detection.

From the tool's definition Tool name is 'manage_false_positives' and description is 'Manage false positive suppressions.' The verb 'manage' in the context of suppressions indicates creation, modification, or deletion of suppression rules/configurations.

Attacks that exploit this kind of access

Recommended rule Ready

Verdict

manage_false_positives Rate-limited

manage_false_positives stays usable, but capped — an agent stuck in a loop can't make hundreds of changes a minute. Everything else on the server is denied unless you say otherwise.

View as policy code

policy.json

{
  "version": "1",
  "default": "deny",
  "tools": {
    "manage_false_positives": {
      "limits": [
        {
          "counter": "manage_false_positives_rate",
          "window": "minute",
          "max": 30,
          "scope": "grant"
        }
      ]
    }
  }
}

LIMIT THIS TOOL →

Instant setup, no code required.

PolicyLayer is an MCP gateway: every tool call is checked against your rule before it reaches MCP Shamash, so you can run agents against it safely.

FAQ

Questions about manage_false_positives

What does the manage_false_positives tool do? +

Manage false positive suppressions. It is categorised as a Write tool in the MCP Shamash MCP Server, which means it can create or modify data. Consider rate limits to prevent runaway writes.

How do I enforce a policy on manage_false_positives? +

Register the MCP Shamash MCP server in PolicyLayer and add a rule for manage_false_positives: allow, deny, rate-limit, or require approval. Point your MCP client at the PolicyLayer proxy URL and the rule is enforced on every call, before it reaches MCP Shamash. Nothing to install.

What risk level is manage_false_positives? +

manage_false_positives is a Write tool with medium risk. Write tools should be rate-limited to prevent accidental bulk modifications.

Can I rate-limit manage_false_positives? +

Yes. Add a rate_limit block to the manage_false_positives rule in your PolicyLayer policy. For example, setting max: 10 and window: 60 limits the tool to 10 calls per minute. Rate limits are tracked per agent session and reset automatically.

How do I block manage_false_positives completely? +

Set action: deny in the PolicyLayer policy for manage_false_positives. The AI agent will receive a policy violation error and cannot call the tool. You can also include a reason field to explain why the tool is blocked.

What MCP server provides manage_false_positives? +

manage_false_positives is provided by the MCP Shamash MCP server (neotecdigital/mcp_shamash). PolicyLayer sits as a proxy in front of this server to enforce policies before tool calls reach the server.