replace_js_function · Filesystem MCP: Risk & Policy

WHAT IT DOES

What replace_js_function does on FilesystemMCP

AI agents use replace_js_function to create or update resources in FilesystemMCP — usually the action step of a workflow, after the agent has gathered context. Every call changes real data in your FilesystemMCP environment.

WHY IT NEEDS A POLICY

Why replace_js_function needs a policy

This tool falls into the Write category because it creates or modifies code reversibly—a developer could revert the change by replacing the function again with the original content. While it modifies files, replacement is not destructive or irreversible in the manner of deletion.

From the tool's definition The tool 'replace_js_function' modifies JavaScript files by replacing function definitions. The description states it 'Replace[s] a named function or class in a JavaScript file' and requires 'newContent must include the full function definition', indicating…

Attacks that exploit this kind of access

Recommended rule Ready

Verdict

replace_js_function Rate-limited

replace_js_function stays usable, but capped — an agent stuck in a loop can't make hundreds of changes a minute. Everything else on the server is denied unless you say otherwise.

View as policy code

policy.json

{
  "version": "1",
  "default": "deny",
  "tools": {
    "replace_js_function": {
      "limits": [
        {
          "counter": "replace_js_function_rate",
          "window": "minute",
          "max": 30,
          "scope": "grant"
        }
      ]
    }
  }
}

LIMIT THIS TOOL →

Instant setup, no code required.

PolicyLayer is an MCP gateway: every tool call is checked against your rule before it reaches FilesystemMCP, so you can run agents against it safely.

FAQ

Questions about replace_js_function

What does the replace_js_function tool do? +

Replace a named function or class in a JavaScript file by name. Finds the full function body automatically — no need to know line numbers. newContent must include the full function definition including its signature. Only works within allowed directories. It is categorised as a Write tool in the FilesystemMCP MCP Server, which means it can create or modify data. Consider rate limits to prevent runaway writes.

How do I enforce a policy on replace_js_function? +

Register the Filesystem MCP server in PolicyLayer and add a rule for replace_js_function: allow, deny, rate-limit, or require approval. Point your MCP client at the PolicyLayer proxy URL and the rule is enforced on every call, before it reaches FilesystemMCP. Nothing to install.

What risk level is replace_js_function? +

replace_js_function is a Write tool with medium risk. Write tools should be rate-limited to prevent accidental bulk modifications.

Can I rate-limit replace_js_function? +

Yes. Add a rate_limit block to the replace_js_function rule in your PolicyLayer policy. For example, setting max: 10 and window: 60 limits the tool to 10 calls per minute. Rate limits are tracked per agent session and reset automatically.

How do I block replace_js_function completely? +

Set action: deny in the PolicyLayer policy for replace_js_function. The AI agent will receive a policy violation error and cannot call the tool. You can also include a reason field to explain why the tool is blocked.

What MCP server provides replace_js_function? +

replace_js_function is provided by the Filesystem MCP server (rijadalisic/filesystemmcp). PolicyLayer sits as a proxy in front of this server to enforce policies before tool calls reach the server.