search_marketplace · Portals MCP: Risk & Policy

WHAT IT DOES

What search_marketplace does on Portals

AI agents call search_marketplace to retrieve information from Portals without modifying anything — typically the context-gathering step in research, monitoring, and reporting workflows, before the agent takes action elsewhere.

PARAMETERS

Parameter	Type	Required	Description
`type`	string	—	Asset type: '3d', 'sound', 'image', 'pack'. Omit to include all.
`biome`	string	—	Exact biome match, e.g. 'forest', 'desert', 'cave'.
`limit`	integer	—	Maximum results to return (default: 20).
`query`	string	—	Free-text search, e.g. 'dungeon door', 'sci-fi enemy', 'medieval key'.
`theme`	string	—	Exact theme match, e.g. 'dungeon', 'fantasy', 'sci-fi'.
`isPack`	boolean	—	If true, only return packs; if false, exclude packs.
`pricing`	string	—	Filter by price (default: any).
`category`	string	—	Exact category match.
`technical`	array	—	Technical tags; matches if item has ANY of them, e.g. ['animated', 'rigged'].
`excludeIds`	array	—	Item IDs to exclude (e.g. items already added to the room).
`subcategory`	string	—	Exact subcategory match.
`visualStyle`	string	—	Exact visual style match, e.g. 'pixel art', 'low-poly'.

Parameters from the server's own tool schema.

WHY IT NEEDS A POLICY

Why search_marketplace needs a policy

This tool performs a query operation that retrieves and returns marketplace data without side effects. It allows filtering and searching but does not create, modify, delete, or execute any actions—only retrieves information for presentation. Standard read operation with minimal security risk.

From the tool's definition Tool description states it "Search[es] the Portals creator marketplace" and "Returns" items with metadata (id, title, thumbnail, URLs, type, theme, price). No modification, deletion, or execution of external operations described.

Risk signalsAccepts freeform code/query input (query) · High parameter count (12 properties)

Attacks that exploit this kind of access

Questions about search_marketplace

What does the search_marketplace tool do? +

Search the Portals creator marketplace for assets (3D models, sounds, packs). Returns up to limit items with id, title, thumbnail, glb/audio URLs, type, theme, and price. Filter by type, theme, biome, technical tags, or pricing. Free-text query matches title/description/category/theme/biome/technical and is ranked by relevance. It is categorised as a Read tool in the Portals MCP Server, which means it retrieves data without modifying state.

What parameters does search_marketplace accept? +

search_marketplace accepts 12 parameters: type, biome, limit, query, theme, isPack, pricing, category, technical, excludeIds, subcategory, visualStyle. The full parameter table on this page comes from the server's own tool schema.

How do I enforce a policy on search_marketplace? +

Register the Portals MCP server in PolicyLayer and add a rule for search_marketplace: allow, deny, rate-limit, or require approval. Point your MCP client at the PolicyLayer proxy URL and the rule is enforced on every call, before it reaches Portals. Nothing to install.

What risk level is search_marketplace? +

search_marketplace is a Read tool with low risk. Read-only tools are generally safe to allow by default.

Can I rate-limit search_marketplace? +

Yes. Add a rate_limit block to the search_marketplace rule in your PolicyLayer policy. For example, setting max: 10 and window: 60 limits the tool to 10 calls per minute. Rate limits are tracked per agent session and reset automatically.

How do I block search_marketplace completely? +

Set action: deny in the PolicyLayer policy for search_marketplace. The AI agent will receive a policy violation error and cannot call the tool. You can also include a reason field to explain why the tool is blocked.

What MCP server provides search_marketplace? +

search_marketplace is provided by the Portals MCP server (portals-mcp). PolicyLayer sits as a proxy in front of this server to enforce policies before tool calls reach the server.