clevertap_upload_device_token · Clevertap MCP: Risk & Policy

WHAT IT DOES

What clevertap_upload_device_token does on Clevertap

AI agents use clevertap_upload_device_token to create or update resources in Clevertap — usually the action step of a workflow, after the agent has gathered context. Every call changes real data in your Clevertap environment.

WHY IT NEEDS A POLICY

Why clevertap_upload_device_token needs a policy

This tool modifies user profile data by associating a device token, which is a Write operation. The blast radius is medium because misuse could add unauthorized push tokens to user accounts, enabling spam or malicious notifications, but the operation is reversible (tokens can be disassociated). It does not irreversibly delete data (Destructive), move money (Financial), or execute arbitrary code (Execute).

From the tool's definition Upload a push notification device token and associate it with a user profile. The tool creates or modifies data (device token association) that can be reversed by disassociation. The action is reversible and does not destroy data or execute arbitrary code.

Attacks that exploit this kind of access

Recommended rule Ready

Verdict

clevertap_upload_device_token Rate-limited

clevertap_upload_device_token stays usable, but capped — an agent stuck in a loop can't make hundreds of changes a minute. Everything else on the server is denied unless you say otherwise.

View as policy code

policy.json

{
  "version": "1",
  "default": "deny",
  "tools": {
    "clevertap_upload_device_token": {
      "limits": [
        {
          "counter": "clevertap_upload_device_token_rate",
          "window": "minute",
          "max": 30,
          "scope": "grant"
        }
      ]
    }
  }
}

LIMIT THIS TOOL →

Instant setup, no code required.

PolicyLayer is an MCP gateway: every tool call is checked against your rule before it reaches Clevertap, so you can run agents against it safely.

FAQ

Questions about clevertap_upload_device_token

What does the clevertap_upload_device_token tool do? +

Upload a push notification device token and associate it with a user profile. Identified by objectId (GUID) only — not by identity or email. For Chrome web push tokens, also provide chrome_keys. It is categorised as a Write tool in the Clevertap MCP Server, which means it can create or modify data. Consider rate limits to prevent runaway writes.

How do I enforce a policy on clevertap_upload_device_token? +

Register the Clevertap MCP server in PolicyLayer and add a rule for clevertap_upload_device_token: allow, deny, rate-limit, or require approval. Point your MCP client at the PolicyLayer proxy URL and the rule is enforced on every call, before it reaches Clevertap. Nothing to install.

What risk level is clevertap_upload_device_token? +

clevertap_upload_device_token is a Write tool with medium risk. Write tools should be rate-limited to prevent accidental bulk modifications.

Can I rate-limit clevertap_upload_device_token? +

Yes. Add a rate_limit block to the clevertap_upload_device_token rule in your PolicyLayer policy. For example, setting max: 10 and window: 60 limits the tool to 10 calls per minute. Rate limits are tracked per agent session and reset automatically.

How do I block clevertap_upload_device_token completely? +

Set action: deny in the PolicyLayer policy for clevertap_upload_device_token. The AI agent will receive a policy violation error and cannot call the tool. You can also include a reason field to explain why the tool is blocked.

What MCP server provides clevertap_upload_device_token? +

clevertap_upload_device_token is provided by the Clevertap MCP server (ralphcorleone/clevertap-mcp). PolicyLayer sits as a proxy in front of this server to enforce policies before tool calls reach the server.