Call an ERPNext/Frappe whitelisted server-side API method. Can invoke any whitelisted method — use with caution. Args are passed as JSON body (POST) or query params (GET).
AI agents invoke call_method to trigger actions in ERPNext MCP Server. What it does depends on the arguments the agent supplies, and its effects often reach beyond the immediate call — builds kicked off, notifications sent, workflows started.
The call_method tool enables execution of arbitrary whitelisted server-side methods in ERPNext/Frappe. While the whitelisting mechanism provides some guardrails, the tool's capability to invoke 'any whitelisted method' with caller-controlled arguments means it can trigger code execution with unpredictable effects depending on which methods are whitelisted in the target system.
From the tool's definition Tool description states it 'Call[s] an ERPNext/Frappe whitelisted server-side API method' and can 'invoke any whitelisted method' with arguments passed via POST or GET. This is a generic method invocation mechanism.
Documented attack patterns abuse exactly the kind of access call_method gives an agent:
PolicyLayer is an MCP gateway — it sits between your AI agents and ERPNext MCP Server, and nothing reaches the server without passing your rules. This is the rule we recommend for call_method:
{
"version": "1",
"default": "deny",
"tools": {
"call_method": {
"limits": [
{
"counter": "call_method_rate",
"window": "minute",
"max": 10,
"scope": "grant"
}
]
}
}
}call_method stays usable, but rate-capped — a runaway agent can't fire it dozens of times a minute. Everything else on the server is denied unless you say otherwise.
Free to start. No card required.
Call an ERPNext/Frappe whitelisted server-side API method. Can invoke any whitelisted method — use with caution. Args are passed as JSON body (POST) or query params (GET). It is categorised as a Execute tool in the ERPNext MCP Server MCP Server, which means it can trigger actions or run processes. Use rate limits and argument validation.
Register the ERPNext MCP Server MCP server in PolicyLayer and add a rule for call_method: allow, deny, rate-limit, or require approval. Point your MCP client at the PolicyLayer proxy URL and the rule is enforced on every call, before it reaches ERPNext MCP Server. Nothing to install.
call_method is a Execute tool with high risk. Execute tools should be rate-limited and have argument validation enabled.
Yes. Add a rate_limit block to the call_method rule in your PolicyLayer policy. For example, setting max: 10 and window: 60 limits the tool to 10 calls per minute. Rate limits are tracked per agent session and reset automatically.
Set action: deny in the PolicyLayer policy for call_method. The AI agent will receive a policy violation error and cannot call the tool. You can also include a reason field to explain why the tool is blocked.
call_method is provided by the ERPNext MCP Server MCP server (rakeshgangwar/erpnext-mcp-server). PolicyLayer sits as a proxy in front of this server to enforce policies before tool calls reach the server.
Deterministic rules across all 11 ERPNext MCP Server tools. Per-identity grants. Full audit log. Live in minutes. Nothing to install.
Free to start. No card required.
11 ERPNext MCP Server tools catalogued and risk-classified — across an index of 42,500+ MCP servers.