eth_deploy_contract_with_signer · Portal MCP: Risk & Policy

WHAT IT DOES

What eth_deploy_contract_with_signer does on PortalMCP

AI agents invoke eth_deploy_contract_with_signer to trigger actions in PortalMCP. What it does depends on the arguments the agent supplies, and its effects often reach beyond the immediate call — builds kicked off, notifications sent, workflows started.

WHY IT NEEDS A POLICY

Why eth_deploy_contract_with_signer needs a policy

While contract deployment is technically an Execute action (running code on an external system), it warrants critical severity because: (1) it commits code to an immutable blockchain that cannot be undone, (2) it involves private key operations creating authentic blockchain transactions, (3) it often has associated gas costs (financial impact), and (4) a misconfigured or malicious contract could facilitate theft or…

From the tool's definition Tool deploys contracts using a configured private key signer. The description explicitly states it 'Deploy[s] a contract' with cryptographic signing capability, which executes code on the Ethereum blockchain with irreversible effects and real financial…

Attacks that exploit this kind of access

Recommended rule Ready

Verdict

eth_deploy_contract_with_signer Rate-limited

eth_deploy_contract_with_signer stays usable, but rate-capped — a runaway agent can't fire it dozens of times a minute. Everything else on the server is denied unless you say otherwise.

View as policy code

policy.json

{
  "version": "1",
  "default": "deny",
  "tools": {
    "eth_deploy_contract_with_signer": {
      "limits": [
        {
          "counter": "eth_deploy_contract_with_signer_rate",
          "window": "minute",
          "max": 10,
          "scope": "grant"
        }
      ]
    }
  }
}

RATE-LIMIT THIS TOOL →

Instant setup, no code required.

PolicyLayer is an MCP gateway: every tool call is checked against your rule before it reaches PortalMCP, so you can run agents against it safely.

FAQ

Questions about eth_deploy_contract_with_signer

What does the eth_deploy_contract_with_signer tool do? +

Deploy a contract using the configured private key (signer). It is categorised as a Execute tool in the PortalMCP MCP Server, which means it can trigger actions or run processes. Use rate limits and argument validation.

How do I enforce a policy on eth_deploy_contract_with_signer? +

Register the Portal MCP server in PolicyLayer and add a rule for eth_deploy_contract_with_signer: allow, deny, rate-limit, or require approval. Point your MCP client at the PolicyLayer proxy URL and the rule is enforced on every call, before it reaches PortalMCP. Nothing to install.

What risk level is eth_deploy_contract_with_signer? +

eth_deploy_contract_with_signer is a Execute tool with high risk. Execute tools should be rate-limited and have argument validation enabled.

Can I rate-limit eth_deploy_contract_with_signer? +

Yes. Add a rate_limit block to the eth_deploy_contract_with_signer rule in your PolicyLayer policy. For example, setting max: 10 and window: 60 limits the tool to 10 calls per minute. Rate limits are tracked per agent session and reset automatically.

How do I block eth_deploy_contract_with_signer completely? +

Set action: deny in the PolicyLayer policy for eth_deploy_contract_with_signer. The AI agent will receive a policy violation error and cannot call the tool. You can also include a reason field to explain why the tool is blocked.

What MCP server provides eth_deploy_contract_with_signer? +

eth_deploy_contract_with_signer is provided by the Portal MCP server (portalfnd/portalmcp). PolicyLayer sits as a proxy in front of this server to enforce policies before tool calls reach the server.