signup · ProofSlip MCP: Risk & Policy

WHAT IT DOES

What signup does on ProofSlip

AI agents use signup to create or update resources in ProofSlip — usually the action step of a workflow, after the agent has gathered context. Every call changes real data in your ProofSlip environment.

WHY IT NEEDS A POLICY

Why signup needs a policy

This tool creates and returns credentials (an API key), which is a write operation that generates new persistent data. While not destructive or financial, the security-sensitive nature of API key generation and the one-time retrievability elevates this beyond Read.

From the tool's definition Tool creates a new API key resource ('Get a free ProofSlip API key. Returns the key directly') and instructs user to 'save it immediately, it cannot be retrieved later,' indicating persistent state creation with one-time exposure.

Attacks that exploit this kind of access

Recommended rule Ready

Verdict

signup Rate-limited

signup stays usable, but capped — an agent stuck in a loop can't make hundreds of changes a minute. Everything else on the server is denied unless you say otherwise.

View as policy code

policy.json

{
  "version": "1",
  "default": "deny",
  "tools": {
    "signup": {
      "limits": [
        {
          "counter": "signup_rate",
          "window": "minute",
          "max": 30,
          "scope": "grant"
        }
      ]
    }
  }
}

LIMIT THIS TOOL →

Instant setup, no code required.

PolicyLayer is an MCP gateway: every tool call is checked against your rule before it reaches ProofSlip, so you can run agents against it safely.

FAQ

Questions about signup

What does the signup tool do? +

Get a free ProofSlip API key. Returns the key directly — save it immediately, it cannot be retrieved later. It is categorised as a Write tool in the ProofSlip MCP Server, which means it can create or modify data. Consider rate limits to prevent runaway writes.

How do I enforce a policy on signup? +

Register the ProofSlip MCP server in PolicyLayer and add a rule for signup: allow, deny, rate-limit, or require approval. Point your MCP client at the PolicyLayer proxy URL and the rule is enforced on every call, before it reaches ProofSlip. Nothing to install.

What risk level is signup? +

signup is a Write tool with medium risk. Write tools should be rate-limited to prevent accidental bulk modifications.

Can I rate-limit signup? +

Yes. Add a rate_limit block to the signup rule in your PolicyLayer policy. For example, setting max: 10 and window: 60 limits the tool to 10 calls per minute. Rate limits are tracked per agent session and reset automatically.

How do I block signup completely? +

Set action: deny in the PolicyLayer policy for signup. The AI agent will receive a policy violation error and cannot call the tool. You can also include a reason field to explain why the tool is blocked.

What MCP server provides signup? +

signup is provided by the ProofSlip MCP server (@proofslip/mcp-server). PolicyLayer sits as a proxy in front of this server to enforce policies before tool calls reach the server.