macro_start_session · MCP Agent Mail MCP: Risk & Policy

WHAT IT DOES

What macro_start_session does on MCP Agent Mail

AI agents invoke macro_start_session to trigger actions in MCP Agent Mail. What it does depends on the arguments the agent supplies, and its effects often reach beyond the immediate call — builds kicked off, notifications sent, workflows started.

WHY IT NEEDS A POLICY

Why macro_start_session needs a policy

Without a description, classification relies on the name and server context. 'Start session' typically initiates a state-changing operation. Given the MCP Agent Mail server coordinates coding agents and manages file leases, starting a session could trigger agent workflows or macro execution—actions with external side effects that depend on runtime context.

From the tool's definition Tool name 'macro_start_session' suggests initiating a session, likely with macro execution capabilities. The broader server context involves 'identities', 'message threading', and 'file reservation' coordination in multi-agent environments, indicating the…

Attacks that exploit this kind of access

Recommended rule Ready

Verdict

macro_start_session Rate-limited

macro_start_session stays usable, but rate-capped — a runaway agent can't fire it dozens of times a minute. Everything else on the server is denied unless you say otherwise.

View as policy code

policy.json

{
  "version": "1",
  "default": "deny",
  "tools": {
    "macro_start_session": {
      "limits": [
        {
          "counter": "macro_start_session_rate",
          "window": "minute",
          "max": 10,
          "scope": "grant"
        }
      ]
    }
  }
}

RATE-LIMIT THIS TOOL →

Instant setup, no code required.

PolicyLayer is an MCP gateway: every tool call is checked against your rule before it reaches MCP Agent Mail, so you can run agents against it safely.

FAQ

Questions about macro_start_session

What does the macro_start_session tool do? +

macro_start_session. It is categorised as a Execute tool in the MCP Agent Mail MCP Server, which means it can trigger actions or run processes. Use rate limits and argument validation.

How do I enforce a policy on macro_start_session? +

Register the MCP Agent Mail MCP server in PolicyLayer and add a rule for macro_start_session: allow, deny, rate-limit, or require approval. Point your MCP client at the PolicyLayer proxy URL and the rule is enforced on every call, before it reaches MCP Agent Mail. Nothing to install.

What risk level is macro_start_session? +

macro_start_session is a Execute tool with high risk. Execute tools should be rate-limited and have argument validation enabled.

Can I rate-limit macro_start_session? +

Yes. Add a rate_limit block to the macro_start_session rule in your PolicyLayer policy. For example, setting max: 10 and window: 60 limits the tool to 10 calls per minute. Rate limits are tracked per agent session and reset automatically.

How do I block macro_start_session completely? +

Set action: deny in the PolicyLayer policy for macro_start_session. The AI agent will receive a policy violation error and cannot call the tool. You can also include a reason field to explain why the tool is blocked.

What MCP server provides macro_start_session? +

macro_start_session is provided by the MCP Agent Mail MCP server (omelchmichael/mcp_agent_mail). PolicyLayer sits as a proxy in front of this server to enforce policies before tool calls reach the server.