hwpx_edit_text · Hwpx MCP: Risk & Policy

WHAT IT DOES

What hwpx_edit_text does on Hwpx

AI agents use hwpx_edit_text to create or update resources in Hwpx — usually the action step of a workflow, after the agent has gathered context. Every call changes real data in your Hwpx environment.

WHY IT NEEDS A POLICY

Why hwpx_edit_text needs a policy

This tool modifies document content through find-and-replace operations. While the changes are theoretically reversible (if a backup exists), the tool directly alters file content and can overwrite the source file. This is Write-category behavior: creates or modifies data reversibly. It does not execute arbitrary code, delete data permanently, or move money.

From the tool's definition Tool description explicitly states 'Find and replace text in a .hwpx file' with parameters for old_text and new_text replacement. The optional output_path parameter can overwrite the source file if omitted, demonstrating irreversible modification capability.

Attacks that exploit this kind of access

Recommended rule Ready

Verdict

hwpx_edit_text Rate-limited

hwpx_edit_text stays usable, but capped — an agent stuck in a loop can't make hundreds of changes a minute. Everything else on the server is denied unless you say otherwise.

View as policy code

policy.json

{
  "version": "1",
  "default": "deny",
  "tools": {
    "hwpx_edit_text": {
      "limits": [
        {
          "counter": "hwpx_edit_text_rate",
          "window": "minute",
          "max": 30,
          "scope": "grant"
        }
      ]
    }
  }
}

LIMIT THIS TOOL →

Instant setup, no code required.

PolicyLayer is an MCP gateway: every tool call is checked against your rule before it reaches Hwpx, so you can run agents against it safely.

FAQ

Questions about hwpx_edit_text

What does the hwpx_edit_text tool do? +

Find and replace text in a .hwpx file. Args: - file_path (string): Absolute path to the source .hwpx file - old_text (string): Text to find (exact match) - new_text (string): Replacement text - output_path (string, optional): Save path; overwrites source if omitted Returns: {. It is categorised as a Write tool in the Hwpx MCP Server, which means it can create or modify data. Consider rate limits to prevent runaway writes.

How do I enforce a policy on hwpx_edit_text? +

Register the Hwpx MCP server in PolicyLayer and add a rule for hwpx_edit_text: allow, deny, rate-limit, or require approval. Point your MCP client at the PolicyLayer proxy URL and the rule is enforced on every call, before it reaches Hwpx. Nothing to install.

What risk level is hwpx_edit_text? +

hwpx_edit_text is a Write tool with medium risk. Write tools should be rate-limited to prevent accidental bulk modifications.

Can I rate-limit hwpx_edit_text? +

Yes. Add a rate_limit block to the hwpx_edit_text rule in your PolicyLayer policy. For example, setting max: 10 and window: 60 limits the tool to 10 calls per minute. Rate limits are tracked per agent session and reset automatically.

How do I block hwpx_edit_text completely? +

Set action: deny in the PolicyLayer policy for hwpx_edit_text. The AI agent will receive a policy violation error and cannot call the tool. You can also include a reason field to explain why the tool is blocked.

What MCP server provides hwpx_edit_text? +

hwpx_edit_text is provided by the Hwpx MCP server (rgbcap/hwpx-mcp-server). PolicyLayer sits as a proxy in front of this server to enforce policies before tool calls reach the server.