Inspect vault health and migrate legacy data. Default mode (dry_run: true) inspects and reports issues. Set dry_run: false to apply fixes. Fixable issues: unprefixed_children (renames children to Parent - Section.md), corrupted_headings (strips wiki-links from H1). Report-only: orphaned_fragments...
AI agents use palace_migrate to create or update resources in Obsidian Palace MCP — usually the action step of a workflow, after the agent has gathered context. Every call changes real data in your Obsidian Palace MCP environment.
palace_migrate is Write rather than Destructive because it reversibly modifies data (renames files, strips formatting) rather than irreversibly deleting or destroying it. The fixes can theoretically be undone by reverting file renames and re-adding stripped content.
From the tool's definition Tool applies fixes that modify vault data (renames children files to 'Parent - Section.md', strips wiki-links from H1 headings) when dry_run is set to false.
Attacks that exploit this kind of access
Inspect vault health and migrate legacy data. Default mode (dry_run: true) inspects and reports issues. Set dry_run: false to apply fixes. Fixable issues: unprefixed_children (renames children to Parent - Section.md), corrupted_headings (strips wiki-links from H1). Report-only: orphaned_fragments, naming_inconsistencies, broken_wiki_links (malformed [[X]]es]] patterns), code_block_links (wiki-links inside code blocks). Always inspect first, then present findings to user before executing. It is categorised as a Write tool in the Obsidian Palace MCP MCP Server, which means it can create or modify data. Consider rate limits to prevent runaway writes.
Register the Obsidian Palace MCP server in PolicyLayer and add a rule for palace_migrate: allow, deny, rate-limit, or require approval. Point your MCP client at the PolicyLayer proxy URL and the rule is enforced on every call, before it reaches Obsidian Palace MCP. Nothing to install.
palace_migrate is a Write tool with medium risk. Write tools should be rate-limited to prevent accidental bulk modifications.
Yes. Add a rate_limit block to the palace_migrate rule in your PolicyLayer policy. For example, setting max: 10 and window: 60 limits the tool to 10 calls per minute. Rate limits are tracked per agent session and reset automatically.
Set action: deny in the PolicyLayer policy for palace_migrate. The AI agent will receive a policy violation error and cannot call the tool. You can also include a reason field to explain why the tool is blocked.
palace_migrate is provided by the Obsidian Palace MCP server (probably-computers/obsidian-palace-mcp). PolicyLayer sits as a proxy in front of this server to enforce policies before tool calls reach the server.
Every MCP server has a record like this.
Type a name, get the same breakdown: verified identity, auth posture, risk grade, capabilities, recommended policy.
Teams ship this data inside their own products. See what a licence covers →