noteplan_ui · Noteplan MCP: Risk & Policy

WHAT IT DOES

What noteplan_ui does on Noteplan

AI agents invoke noteplan_ui to trigger actions in Noteplan. What it does depends on the arguments the agent supplies, and its effects often reach beyond the immediate call — builds kicked off, notifications sent, workflows started.

WHY IT NEEDS A POLICY

Why noteplan_ui needs a policy

The tool uses AppleScript to control the NotePlan UI, which constitutes executing external operations/automation scripts. AppleScript execution can trigger various system-level actions depending on what UI operations are performed.

From the tool's definition UI control via AppleScript

Attacks that exploit this kind of access

Recommended rule Ready

Verdict

noteplan_ui Rate-limited

noteplan_ui stays usable, but rate-capped — a runaway agent can't fire it dozens of times a minute. Everything else on the server is denied unless you say otherwise.

View as policy code

policy.json

{
  "version": "1",
  "default": "deny",
  "tools": {
    "noteplan_ui": {
      "limits": [
        {
          "counter": "noteplan_ui_rate",
          "window": "minute",
          "max": 10,
          "scope": "grant"
        }
      ]
    }
  }
}

RATE-LIMIT THIS TOOL →

Instant setup, no code required.

PolicyLayer is an MCP gateway: every tool call is checked against your rule before it reaches Noteplan, so you can run agents against it safely.

FAQ

Questions about noteplan_ui

What does the noteplan_ui tool do? +

NotePlan UI control via AppleScript.\n\nActions:\n- open_note: Open a note (title or filename)\n- open_today: Open today\. It is categorised as a Execute tool in the Noteplan MCP Server, which means it can trigger actions or run processes. Use rate limits and argument validation.

How do I enforce a policy on noteplan_ui? +

Register the Noteplan MCP server in PolicyLayer and add a rule for noteplan_ui: allow, deny, rate-limit, or require approval. Point your MCP client at the PolicyLayer proxy URL and the rule is enforced on every call, before it reaches Noteplan. Nothing to install.

What risk level is noteplan_ui? +

noteplan_ui is a Execute tool with high risk. Execute tools should be rate-limited and have argument validation enabled.

Can I rate-limit noteplan_ui? +

Yes. Add a rate_limit block to the noteplan_ui rule in your PolicyLayer policy. For example, setting max: 10 and window: 60 limits the tool to 10 calls per minute. Rate limits are tracked per agent session and reset automatically.

How do I block noteplan_ui completely? +

Set action: deny in the PolicyLayer policy for noteplan_ui. The AI agent will receive a policy violation error and cannot call the tool. You can also include a reason field to explain why the tool is blocked.

What MCP server provides noteplan_ui? +

noteplan_ui is provided by the Noteplan MCP server (@noteplanco/noteplan-mcp). PolicyLayer sits as a proxy in front of this server to enforce policies before tool calls reach the server.