Purpose: Create a new RawTree API key for the configured database. NOT for: User login or creating databases. Use RawTree auth/CLI or the dashboard for those workflows. Returns: The new API key value. The API key is only shown once, so you MUST display it to the user. Auth: Uses POST /v1/keys and...
AI agents use create-api-key to create or update resources in RawTree MCP Server — usually the action step of a workflow, after the agent has gathered context. Every call changes real data in your RawTree MCP Server environment.
Creating API keys is a reversible write operation (keys can be deleted via delete-api-key), but with high severity because a leaked or misused API key could grant unauthorized access to the RawTree database.
From the tool's definition Tool creates a new API key ('Create a new RawTree API key') and returns the key value ('The new API key value'). This is a credential generation action that modifies the security state of the system by adding new authentication material.
Risk signalsAdmin/system-level operation
Attacks that exploit this kind of access
Purpose: Create a new RawTree API key for the configured database. NOT for: User login or creating databases. Use RawTree auth/CLI or the dashboard for those workflows. Returns: The new API key value. The API key is only shown once, so you MUST display it to the user. Auth: Uses POST /v1/keys and requires admin permission for database API key auth. When to use: - User needs a key for CI, an agent, a connector, or a script - User wants a read-only, write-only, read-write, or admin credential - User asks to rotate credentials by creating a replacement before revoking the old key. It is categorised as a Write tool in the RawTree MCP Server MCP Server, which means it can create or modify data. Consider rate limits to prevent runaway writes.
Register the RawTree MCP Server MCP server in PolicyLayer and add a rule for create-api-key: allow, deny, rate-limit, or require approval. Point your MCP client at the PolicyLayer proxy URL and the rule is enforced on every call, before it reaches RawTree MCP Server. Nothing to install.
create-api-key is a Write tool with medium risk. Write tools should be rate-limited to prevent accidental bulk modifications.
Yes. Add a rate_limit block to the create-api-key rule in your PolicyLayer policy. For example, setting max: 10 and window: 60 limits the tool to 10 calls per minute. Rate limits are tracked per agent session and reset automatically.
Set action: deny in the PolicyLayer policy for create-api-key. The AI agent will receive a policy violation error and cannot call the tool. You can also include a reason field to explain why the tool is blocked.
create-api-key is provided by the RawTree MCP Server MCP server (rawtreedb/rawtree-mcp). PolicyLayer sits as a proxy in front of this server to enforce policies before tool calls reach the server.
Every MCP server has a record like this.
Type a name, get the same breakdown: verified identity, auth posture, risk grade, capabilities, recommended policy.
Teams ship this data inside their own products. See what a licence covers →