draft_review_response · Asc MCP: Risk & Policy

WHAT IT DOES

What draft_review_response does on Asc

AI agents use draft_review_response to create or update resources in Asc — usually the action step of a workflow, after the agent has gathered context. Every call changes real data in your Asc environment.

WHY IT NEEDS A POLICY

Why draft_review_response needs a policy

This tool creates/drafts a public reply to an App Store review, which is a reversible write operation. It posts content publicly but can typically be modified or removed. Medium severity because misuse could post inappropriate public responses on behalf of the app developer.

From the tool's definition Draft a public reply to a single App Store review via MCP Sampling

Attacks that exploit this kind of access

Recommended rule Ready

Verdict

draft_review_response Rate-limited

draft_review_response stays usable, but capped — an agent stuck in a loop can't make hundreds of changes a minute. Everything else on the server is denied unless you say otherwise.

View as policy code

policy.json

{
  "version": "1",
  "default": "deny",
  "tools": {
    "draft_review_response": {
      "limits": [
        {
          "counter": "draft_review_response_rate",
          "window": "minute",
          "max": 30,
          "scope": "grant"
        }
      ]
    }
  }
}

LIMIT THIS TOOL →

Instant setup, no code required.

PolicyLayer is an MCP gateway: every tool call is checked against your rule before it reaches Asc, so you can run agents against it safely.

FAQ

Questions about draft_review_response

What does the draft_review_response tool do? +

Draft a public reply to a single App Store review via MCP Sampling, in the review. It is categorised as a Write tool in the Asc MCP Server, which means it can create or modify data. Consider rate limits to prevent runaway writes.

How do I enforce a policy on draft_review_response? +

Register the Asc MCP server in PolicyLayer and add a rule for draft_review_response: allow, deny, rate-limit, or require approval. Point your MCP client at the PolicyLayer proxy URL and the rule is enforced on every call, before it reaches Asc. Nothing to install.

What risk level is draft_review_response? +

draft_review_response is a Write tool with medium risk. Write tools should be rate-limited to prevent accidental bulk modifications.

Can I rate-limit draft_review_response? +

Yes. Add a rate_limit block to the draft_review_response rule in your PolicyLayer policy. For example, setting max: 10 and window: 60 limits the tool to 10 calls per minute. Rate limits are tracked per agent session and reset automatically.

How do I block draft_review_response completely? +

Set action: deny in the PolicyLayer policy for draft_review_response. The AI agent will receive a policy violation error and cannot call the tool. You can also include a reason field to explain why the tool is blocked.

What MCP server provides draft_review_response? +

draft_review_response is provided by the Asc MCP server (pofky/asc-mcp). PolicyLayer sits as a proxy in front of this server to enforce policies before tool calls reach the server.