item_move · ArcGIS MCP: Risk & Policy

WHAT IT DOES

What item_move does on ArcGIS MCP

AI agents use item_move to create or update resources in ArcGIS MCP — usually the action step of a workflow, after the agent has gathered context. Every call changes real data in your ArcGIS MCP environment.

WHY IT NEEDS A POLICY

Why item_move needs a policy

This tool modifies metadata and organizational structure (moving an item to a different folder) but does not delete, execute code, or cause financial impact. The operation is reversible—items can be moved again or restored. The description explicitly labels it as 'OPERACIÓN DE ESCRITURA' (WRITE OPERATION).

From the tool's definition Tool name 'item_move' combined with description 'Mueve un item a una carpeta del portal. OPERACIÓN DE ESCRITURA.' (Moves an item to a portal folder.

Attacks that exploit this kind of access

Recommended rule Ready

Verdict

item_move Rate-limited

item_move stays usable, but capped — an agent stuck in a loop can't make hundreds of changes a minute. Everything else on the server is denied unless you say otherwise.

View as policy code

policy.json

{
  "version": "1",
  "default": "deny",
  "tools": {
    "item_move": {
      "limits": [
        {
          "counter": "item_move_rate",
          "window": "minute",
          "max": 30,
          "scope": "grant"
        }
      ]
    }
  }
}

LIMIT THIS TOOL →

Instant setup, no code required.

PolicyLayer is an MCP gateway: every tool call is checked against your rule before it reaches ArcGIS MCP, so you can run agents against it safely.

FAQ

Questions about item_move

What does the item_move tool do? +

Mueve un item a una carpeta del portal. OPERACIÓN DE ESCRITURA. It is categorised as a Write tool in the ArcGIS MCP MCP Server, which means it can create or modify data. Consider rate limits to prevent runaway writes.

How do I enforce a policy on item_move? +

Register the ArcGIS MCP server in PolicyLayer and add a rule for item_move: allow, deny, rate-limit, or require approval. Point your MCP client at the PolicyLayer proxy URL and the rule is enforced on every call, before it reaches ArcGIS MCP. Nothing to install.

What risk level is item_move? +

item_move is a Write tool with medium risk. Write tools should be rate-limited to prevent accidental bulk modifications.

Can I rate-limit item_move? +

Yes. Add a rate_limit block to the item_move rule in your PolicyLayer policy. For example, setting max: 10 and window: 60 limits the tool to 10 calls per minute. Rate limits are tracked per agent session and reset automatically.

How do I block item_move completely? +

Set action: deny in the PolicyLayer policy for item_move. The AI agent will receive a policy violation error and cannot call the tool. You can also include a reason field to explain why the tool is blocked.

What MCP server provides item_move? +

item_move is provided by the ArcGIS MCP server (renemorenow/arcgis-mcp). PolicyLayer sits as a proxy in front of this server to enforce policies before tool calls reach the server.