move_lesson · Reddit MCP Server MCP: Risk & Policy

WHAT IT DOES

What move_lesson does on Reddit MCP Server

AI agents use move_lesson to create or update resources in Reddit MCP Server — usually the action step of a workflow, after the agent has gathered context. Every call changes real data in your Reddit MCP Server environment.

WHY IT NEEDS A POLICY

Why move_lesson needs a policy

This tool creates or modifies data reversibly by changing lesson positions and unit assignments. It does not execute arbitrary code, delete data permanently, or move money. The modification is reversible—lessons can be moved back. Severity is medium because misuse could disorganize learning content, but the action is non-destructive and contained within a brainloop structure.

From the tool's definition Tool description states 'Move a lesson from its current unit to a different unit' and 'The lesson will be moved to the target unit', indicating it modifies the organizational structure and position of existing data (lesson placement/order within units).

Attacks that exploit this kind of access

Recommended rule Ready

Verdict

move_lesson Rate-limited

move_lesson stays usable, but capped — an agent stuck in a loop can't make hundreds of changes a minute. Everything else on the server is denied unless you say otherwise.

View as policy code

policy.json

{
  "version": "1",
  "default": "deny",
  "tools": {
    "move_lesson": {
      "limits": [
        {
          "counter": "move_lesson_rate",
          "window": "minute",
          "max": 30,
          "scope": "grant"
        }
      ]
    }
  }
}

LIMIT THIS TOOL →

Instant setup, no code required.

PolicyLayer is an MCP gateway: every tool call is checked against your rule before it reaches Reddit MCP Server, so you can run agents against it safely.

FAQ

Questions about move_lesson

What does the move_lesson tool do? +

Move a lesson from its current unit to a different unit. Use this to reorganize lessons within a brainloop. The lesson will be moved to the target unit, and you can optionally specify its position (order) in the new unit. If no order is specified, the lesson will be appended to the end of the target unit. It is categorised as a Write tool in the Reddit MCP Server MCP Server, which means it can create or modify data. Consider rate limits to prevent runaway writes.

How do I enforce a policy on move_lesson? +

Register the Reddit MCP Server MCP server in PolicyLayer and add a rule for move_lesson: allow, deny, rate-limit, or require approval. Point your MCP client at the PolicyLayer proxy URL and the rule is enforced on every call, before it reaches Reddit MCP Server. Nothing to install.

What risk level is move_lesson? +

move_lesson is a Write tool with medium risk. Write tools should be rate-limited to prevent accidental bulk modifications.

Can I rate-limit move_lesson? +

Yes. Add a rate_limit block to the move_lesson rule in your PolicyLayer policy. For example, setting max: 10 and window: 60 limits the tool to 10 calls per minute. Rate limits are tracked per agent session and reset automatically.

How do I block move_lesson completely? +

Set action: deny in the PolicyLayer policy for move_lesson. The AI agent will receive a policy violation error and cannot call the tool. You can also include a reason field to explain why the tool is blocked.

What MCP server provides move_lesson? +

move_lesson is provided by the Reddit MCP Server MCP server (ozipi/brainloop-mcp-server-v2). PolicyLayer sits as a proxy in front of this server to enforce policies before tool calls reach the server.