create-poem · Pplog MCP: Risk & Policy

WHAT IT DOES

What create-poem does on Pplog

AI agents use create-poem to create or update resources in Pplog — usually the action step of a workflow, after the agent has gathered context. Every call changes real data in your Pplog environment.

WHY IT NEEDS A POLICY

Why create-poem needs a policy

This tool creates new data (a poem post) and modifies existing data (hides previous poem), both reversible actions. The severity is medium because an AI agent could spam numerous posts, but individual posts can be deleted and the service appears informal (casual notes, not critical data). Not Destructive since posts are not permanently deleted and can presumably be recovered or removed. Not Financial or Execute.

From the tool's definition Tool description states it 'Creates a pplog poem' and 'Posting hides your previous poem from other readers', indicating it creates new content and modifies visibility state of existing content.

Attacks that exploit this kind of access

Recommended rule Ready

Verdict

create-poem Rate-limited

create-poem stays usable, but capped — an agent stuck in a loop can't make hundreds of changes a minute. Everything else on the server is denied unless you say otherwise.

View as policy code

policy.json

{
  "version": "1",
  "default": "deny",
  "tools": {
    "create-poem": {
      "limits": [
        {
          "counter": "create-poem_rate",
          "window": "minute",
          "max": 30,
          "scope": "grant"
        }
      ]
    }
  }
}

LIMIT THIS TOOL →

Instant setup, no code required.

PolicyLayer is an MCP gateway: every tool call is checked against your rule before it reaches Pplog, so you can run agents against it safely.

FAQ

Questions about create-poem

What does the create-poem tool do? +

Creates a pplog poem: a casual short note (not literary verse). Posting hides your previous poem from other readers. It is categorised as a Write tool in the Pplog MCP Server, which means it can create or modify data. Consider rate limits to prevent runaway writes.

How do I enforce a policy on create-poem? +

Register the Pplog MCP server in PolicyLayer and add a rule for create-poem: allow, deny, rate-limit, or require approval. Point your MCP client at the PolicyLayer proxy URL and the rule is enforced on every call, before it reaches Pplog. Nothing to install.

What risk level is create-poem? +

create-poem is a Write tool with medium risk. Write tools should be rate-limited to prevent accidental bulk modifications.

Can I rate-limit create-poem? +

Yes. Add a rate_limit block to the create-poem rule in your PolicyLayer policy. For example, setting max: 10 and window: 60 limits the tool to 10 calls per minute. Rate limits are tracked per agent session and reset automatically.

How do I block create-poem completely? +

Set action: deny in the PolicyLayer policy for create-poem. The AI agent will receive a policy violation error and cannot call the tool. You can also include a reason field to explain why the tool is blocked.

What MCP server provides create-poem? +

create-poem is provided by the Pplog MCP server (oci:ghcr.io/esaio/pplog-mcp-server:0.4.1). PolicyLayer sits as a proxy in front of this server to enforce policies before tool calls reach the server.