jobhound_update · JobHound MCP: Risk & Policy

WHAT IT DOES

What jobhound_update does on JobHound

AI agents use jobhound_update to create or update resources in JobHound — usually the action step of a workflow, after the agent has gathered context. Every call changes real data in your JobHound environment.

WHY IT NEEDS A POLICY

Why jobhound_update needs a policy

The tool creates or modifies data (job status) in a reversible manner. While it changes application state, it does not delete data, execute arbitrary code, or move money. The 'medium' severity reflects that status updates could affect job search automation flow and potentially trigger downstream actions, but the change is non-destructive and localized to metadata rather than application logic or financial impact.

From the tool's definition Tool name contains 'update' and description states 'Manually update a job's status' — this modifies state of a job tracking record.

Attacks that exploit this kind of access

Recommended rule Ready

Verdict

jobhound_update Rate-limited

jobhound_update stays usable, but capped — an agent stuck in a loop can't make hundreds of changes a minute. Everything else on the server is denied unless you say otherwise.

View as policy code

policy.json

{
  "version": "1",
  "default": "deny",
  "tools": {
    "jobhound_update": {
      "limits": [
        {
          "counter": "jobhound_update_rate",
          "window": "minute",
          "max": 30,
          "scope": "grant"
        }
      ]
    }
  }
}

LIMIT THIS TOOL →

Instant setup, no code required.

PolicyLayer is an MCP gateway: every tool call is checked against your rule before it reaches JobHound, so you can run agents against it safely.

FAQ

Questions about jobhound_update

What does the jobhound_update tool do? +

Manually update a job's status. It is categorised as a Write tool in the JobHound MCP Server, which means it can create or modify data. Consider rate limits to prevent runaway writes.

How do I enforce a policy on jobhound_update? +

Register the JobHound MCP server in PolicyLayer and add a rule for jobhound_update: allow, deny, rate-limit, or require approval. Point your MCP client at the PolicyLayer proxy URL and the rule is enforced on every call, before it reaches JobHound. Nothing to install.

What risk level is jobhound_update? +

jobhound_update is a Write tool with medium risk. Write tools should be rate-limited to prevent accidental bulk modifications.

Can I rate-limit jobhound_update? +

Yes. Add a rate_limit block to the jobhound_update rule in your PolicyLayer policy. For example, setting max: 10 and window: 60 limits the tool to 10 calls per minute. Rate limits are tracked per agent session and reset automatically.

How do I block jobhound_update completely? +

Set action: deny in the PolicyLayer policy for jobhound_update. The AI agent will receive a policy violation error and cannot call the tool. You can also include a reason field to explain why the tool is blocked.

What MCP server provides jobhound_update? +

jobhound_update is provided by the JobHound MCP server (null-phnix/jobhound). PolicyLayer sits as a proxy in front of this server to enforce policies before tool calls reach the server.