ovh_request · Ovh MCP: Risk & Policy

WHAT IT DOES

What ovh_request does on Ovh

AI agents invoke ovh_request to trigger actions in Ovh. What it does depends on the arguments the agent supplies, and its effects often reach beyond the immediate call — builds kicked off, notifications sent, workflows started.

WHY IT NEEDS A POLICY

Why ovh_request needs a policy

This tool appears to be a generic OVH API request tool with no constraints on the type of request (GET, POST, PUT, DELETE, etc.) or the endpoint targeted. It could be used to read data, modify resources, delete infrastructure, trigger financial transactions (orders, payments), or any other OVH API operation.

From the tool's definition "Make a request to OVH API" - the tool name 'ovh_request' and description indicate it can make arbitrary requests to the OVH API without specifying any restriction on HTTP method or endpoint

Attacks that exploit this kind of access

Recommended rule Ready

Verdict

ovh_request Rate-limited

ovh_request stays usable, but rate-capped — a runaway agent can't fire it dozens of times a minute. Everything else on the server is denied unless you say otherwise.

View as policy code

policy.json

{
  "version": "1",
  "default": "deny",
  "tools": {
    "ovh_request": {
      "limits": [
        {
          "counter": "ovh_request_rate",
          "window": "minute",
          "max": 10,
          "scope": "grant"
        }
      ]
    }
  }
}

RATE-LIMIT THIS TOOL →

Instant setup, no code required.

PolicyLayer is an MCP gateway: every tool call is checked against your rule before it reaches Ovh, so you can run agents against it safely.

FAQ

Questions about ovh_request

What does the ovh_request tool do? +

Make a request to OVH API. It is categorised as a Execute tool in the Ovh MCP Server, which means it can trigger actions or run processes. Use rate limits and argument validation.

How do I enforce a policy on ovh_request? +

Register the Ovh MCP server in PolicyLayer and add a rule for ovh_request: allow, deny, rate-limit, or require approval. Point your MCP client at the PolicyLayer proxy URL and the rule is enforced on every call, before it reaches Ovh. Nothing to install.

What risk level is ovh_request? +

ovh_request is a Execute tool with high risk. Execute tools should be rate-limited and have argument validation enabled.

Can I rate-limit ovh_request? +

Yes. Add a rate_limit block to the ovh_request rule in your PolicyLayer policy. For example, setting max: 10 and window: 60 limits the tool to 10 calls per minute. Rate limits are tracked per agent session and reset automatically.

How do I block ovh_request completely? +

Set action: deny in the PolicyLayer policy for ovh_request. The AI agent will receive a policy violation error and cannot call the tool. You can also include a reason field to explain why the tool is blocked.

What MCP server provides ovh_request? +

ovh_request is provided by the Ovh MCP server (mcp-server-ovh). PolicyLayer sits as a proxy in front of this server to enforce policies before tool calls reach the server.