create_posts_batch · Posterly MCP: Risk & Policy

WHAT IT DOES

What create_posts_batch does on Posterly

AI agents use create_posts_batch to create or update resources in Posterly — usually the action step of a workflow, after the agent has gathered context. Every call changes real data in your Posterly environment.

WHY IT NEEDS A POLICY

Why create_posts_batch needs a policy

This tool creates scheduled or immediate social media posts—a reversible write operation. While it modifies user data (social posts), posts can typically be deleted or edited afterward, making it Write rather than Destructive. The batch capability (1-25 posts) increases blast radius to medium severity; an agent could spam numerous posts if misused.

From the tool's definition Tool description explicitly states it 'creates...social posts' which are reversible modifications to user's social media content. The description calls it a 'DESTRUCTIVE WRITE' but the actual operation is creating/posting content (Write) not destroying it.

Attacks that exploit this kind of access

Recommended rule Ready

Verdict

create_posts_batch Rate-limited

create_posts_batch stays usable, but capped — an agent stuck in a loop can't make hundreds of changes a minute. Everything else on the server is denied unless you say otherwise.

View as policy code

policy.json

{
  "version": "1",
  "default": "deny",
  "tools": {
    "create_posts_batch": {
      "limits": [
        {
          "counter": "create_posts_batch_rate",
          "window": "minute",
          "max": 30,
          "scope": "grant"
        }
      ]
    }
  }
}

LIMIT THIS TOOL →

Instant setup, no code required.

PolicyLayer is an MCP gateway: every tool call is checked against your rule before it reaches Posterly, so you can run agents against it safely.

FAQ

Questions about create_posts_batch

What does the create_posts_batch tool do? +

Create 1-25 scheduled or immediate social posts in one API request. This is a DESTRUCTIVE WRITE that creates content on the user\. It is categorised as a Write tool in the Posterly MCP Server, which means it can create or modify data. Consider rate limits to prevent runaway writes.

How do I enforce a policy on create_posts_batch? +

Register the Posterly MCP server in PolicyLayer and add a rule for create_posts_batch: allow, deny, rate-limit, or require approval. Point your MCP client at the PolicyLayer proxy URL and the rule is enforced on every call, before it reaches Posterly. Nothing to install.

What risk level is create_posts_batch? +

create_posts_batch is a Write tool with medium risk. Write tools should be rate-limited to prevent accidental bulk modifications.

Can I rate-limit create_posts_batch? +

Yes. Add a rate_limit block to the create_posts_batch rule in your PolicyLayer policy. For example, setting max: 10 and window: 60 limits the tool to 10 calls per minute. Rate limits are tracked per agent session and reset automatically.

How do I block create_posts_batch completely? +

Set action: deny in the PolicyLayer policy for create_posts_batch. The AI agent will receive a policy violation error and cannot call the tool. You can also include a reason field to explain why the tool is blocked.

What MCP server provides create_posts_batch? +

create_posts_batch is provided by the Posterly MCP server (posterly-mcp-server). PolicyLayer sits as a proxy in front of this server to enforce policies before tool calls reach the server.