hwpx_create · Hwpx MCP: Risk & Policy

WHAT IT DOES

What hwpx_create does on Hwpx

AI agents use hwpx_create to create or update resources in Hwpx — usually the action step of a workflow, after the agent has gathered context. Every call changes real data in your Hwpx environment.

WHY IT NEEDS A POLICY

Why hwpx_create needs a policy

hwpx_create generates a new .hwpx file on the filesystem based on provided arguments. This is a Write operation—it creates data reversibly (the file can be deleted or modified later). Severity is medium rather than low because an agent could create files at arbitrary paths specified by output_path, potentially filling disk space or overwriting files in critical locations depending on permissions and path resolution.

From the tool's definition Tool description states 'Create a new minimal .hwpx file' with parameters for output_path, title, and content. This creates new data in the form of a document file.

Attacks that exploit this kind of access

Recommended rule Ready

Verdict

hwpx_create Rate-limited

hwpx_create stays usable, but capped — an agent stuck in a loop can't make hundreds of changes a minute. Everything else on the server is denied unless you say otherwise.

View as policy code

policy.json

{
  "version": "1",
  "default": "deny",
  "tools": {
    "hwpx_create": {
      "limits": [
        {
          "counter": "hwpx_create_rate",
          "window": "minute",
          "max": 30,
          "scope": "grant"
        }
      ]
    }
  }
}

LIMIT THIS TOOL →

Instant setup, no code required.

PolicyLayer is an MCP gateway: every tool call is checked against your rule before it reaches Hwpx, so you can run agents against it safely.

FAQ

Questions about hwpx_create

What does the hwpx_create tool do? +

Create a new minimal .hwpx file with optional title and body text. Args: - output_path (string): Absolute path to save the new .hwpx file - title (string, optional): Document title metadata - content (string, optional): Initial body text Returns: {. It is categorised as a Write tool in the Hwpx MCP Server, which means it can create or modify data. Consider rate limits to prevent runaway writes.

How do I enforce a policy on hwpx_create? +

Register the Hwpx MCP server in PolicyLayer and add a rule for hwpx_create: allow, deny, rate-limit, or require approval. Point your MCP client at the PolicyLayer proxy URL and the rule is enforced on every call, before it reaches Hwpx. Nothing to install.

What risk level is hwpx_create? +

hwpx_create is a Write tool with medium risk. Write tools should be rate-limited to prevent accidental bulk modifications.

Can I rate-limit hwpx_create? +

Yes. Add a rate_limit block to the hwpx_create rule in your PolicyLayer policy. For example, setting max: 10 and window: 60 limits the tool to 10 calls per minute. Rate limits are tracked per agent session and reset automatically.

How do I block hwpx_create completely? +

Set action: deny in the PolicyLayer policy for hwpx_create. The AI agent will receive a policy violation error and cannot call the tool. You can also include a reason field to explain why the tool is blocked.

What MCP server provides hwpx_create? +

hwpx_create is provided by the Hwpx MCP server (rgbcap/hwpx-mcp-server). PolicyLayer sits as a proxy in front of this server to enforce policies before tool calls reach the server.