Run AFTER both building (Forge) and scanning (postrc_scan). Maps Post-RC findings and RC task completions back to the requirement IDs from trace_enhance_prd. Calculates: implementation coverage %, verification coverage %, orphan requirements (specified but never built), and orphan tasks (built bu...
AI agents invoke trace_map_findings to trigger actions in RC Engine. What it does depends on the arguments the agent supplies, and its effects often reach beyond the immediate call — builds kicked off, notifications sent, workflows started.
This tool runs a multi-step analysis pipeline that processes data from prior build and scan phases, calculates coverage metrics, and generates an HTML report artifact. It triggers an active computation/reporting workflow rather than simply reading existing data. The generated report is a new artifact (Write-like), but the primary action is executing an analysis pipeline across multiple data sources.
From the tool's definition 'Run AFTER both building (Forge) and scanning (postrc_scan)... Maps Post-RC findings and RC task completions back to requirement IDs... Calculates: implementation coverage %, verification coverage %... Generates a consulting-grade HTML traceability report'
Attacks that exploit this kind of access
Run AFTER both building (Forge) and scanning (postrc_scan). Maps Post-RC findings and RC task completions back to the requirement IDs from trace_enhance_prd. Calculates: implementation coverage %, verification coverage %, orphan requirements (specified but never built), and orphan tasks (built but not in PRD). Generates a consulting-grade HTML traceability report. Prerequisites: trace_enhance_prd must have been run, and ideally postrc_scan completed. Present coverage gaps to user - orphan requirements are the most critical signal. It is categorised as a Execute tool in the RC Engine MCP Server, which means it can trigger actions or run processes. Use rate limits and argument validation.
Register the RC Engine MCP server in PolicyLayer and add a rule for trace_map_findings: allow, deny, rate-limit, or require approval. Point your MCP client at the PolicyLayer proxy URL and the rule is enforced on every call, before it reaches RC Engine. Nothing to install.
trace_map_findings is a Execute tool with high risk. Execute tools should be rate-limited and have argument validation enabled.
Yes. Add a rate_limit block to the trace_map_findings rule in your PolicyLayer policy. For example, setting max: 10 and window: 60 limits the tool to 10 calls per minute. Rate limits are tracked per agent session and reset automatically.
Set action: deny in the PolicyLayer policy for trace_map_findings. The AI agent will receive a policy violation error and cannot call the tool. You can also include a reason field to explain why the tool is blocked.
trace_map_findings is provided by the RC Engine MCP server (originalrashmi/rc-engine-product-framework). PolicyLayer sits as a proxy in front of this server to enforce policies before tool calls reach the server.
Every MCP server has a record like this.
Type a name, get the same breakdown: verified identity, auth posture, risk grade, capabilities, recommended policy.
Teams ship this data inside their own products. See what a licence covers →