upload_image_archive_and_deploy · PlugLayer MCP Server MCP

WHAT IT DOES

What upload_image_archive_and_deploy does on PlugLayer MCP Server

AI agents invoke upload_image_archive_and_deploy to trigger actions in PlugLayer MCP Server. What it does depends on the arguments the agent supplies, and its effects often reach beyond the immediate call — builds kicked off, notifications sent, workflows started.

WHY IT NEEDS A POLICY

Why upload_image_archive_and_deploy needs a policy

This tool both uploads an image (Write) and triggers a deployment/redeployment (Execute). Since it runs infrastructure deployments — spinning up or replacing running compute nodes — the dominant risk is Execute. Misuse could deploy malicious images or disrupt production workloads, warranting high severity.

From the tool's definition 'upload a locally built Docker/OCI image archive to PlugLayer' and 'redeploy it' or 'create a new app from the mirrored image'

Attacks that exploit this kind of access

Recommended rule Ready

Verdict

upload_image_archive_and_deploy Rate-limited

upload_image_archive_and_deploy stays usable, but rate-capped — a runaway agent can't fire it dozens of times a minute. Everything else on the server is denied unless you say otherwise.

View as policy code

policy.json

{
  "version": "1",
  "default": "deny",
  "tools": {
    "upload_image_archive_and_deploy": {
      "limits": [
        {
          "counter": "upload_image_archive_and_deploy_rate",
          "window": "minute",
          "max": 10,
          "scope": "grant"
        }
      ]
    }
  }
}

RATE-LIMIT THIS TOOL →

Instant setup, no code required.

PolicyLayer is an MCP gateway: every tool call is checked against your rule before it reaches PlugLayer MCP Server, so you can run agents against it safely.

FAQ

Questions about upload_image_archive_and_deploy

What does the upload_image_archive_and_deploy tool do? +

Upload a locally built Docker/OCI image archive to PlugLayer. If the target app already exists in the project, upload to that app first and redeploy it; otherwise create a new app from the mirrored image. It is categorised as a Execute tool in the PlugLayer MCP Server MCP Server, which means it can trigger actions or run processes. Use rate limits and argument validation.

How do I enforce a policy on upload_image_archive_and_deploy? +

Register the PlugLayer MCP Server MCP server in PolicyLayer and add a rule for upload_image_archive_and_deploy: allow, deny, rate-limit, or require approval. Point your MCP client at the PolicyLayer proxy URL and the rule is enforced on every call, before it reaches PlugLayer MCP Server. Nothing to install.

What risk level is upload_image_archive_and_deploy? +

upload_image_archive_and_deploy is a Execute tool with high risk. Execute tools should be rate-limited and have argument validation enabled.

Can I rate-limit upload_image_archive_and_deploy? +

Yes. Add a rate_limit block to the upload_image_archive_and_deploy rule in your PolicyLayer policy. For example, setting max: 10 and window: 60 limits the tool to 10 calls per minute. Rate limits are tracked per agent session and reset automatically.

How do I block upload_image_archive_and_deploy completely? +

Set action: deny in the PolicyLayer policy for upload_image_archive_and_deploy. The AI agent will receive a policy violation error and cannot call the tool. You can also include a reason field to explain why the tool is blocked.

What MCP server provides upload_image_archive_and_deploy? +

upload_image_archive_and_deploy is provided by the PlugLayer MCP Server MCP server (pluglayer/mcp). PolicyLayer sits as a proxy in front of this server to enforce policies before tool calls reach the server.