Apply a previously previewed safe task-management plan after explicit confirmation. Creates a backup and JSONL audit log before writing.
AI agents use apply_plan to create or update resources in Microsoft Todo Safe — usually the action step of a workflow, after the agent has gathered context. Every call changes real data in your Microsoft Todo Safe environment.
While this tool can modify task data (Write category), it includes safeguards: backup creation, audit logging, and explicit confirmation requirement. These mitigations prevent it from being classified as Destructive (which it could be if it irreversibly deletes without safeguards). The tool's purpose is safe task management with reversibility options via backup.
From the tool's definition Tool description states it "Creates a backup and JSONL audit log before writing" — the core action is write-based modification of task-management data.
Attacks that exploit this kind of access
Apply a previously previewed safe task-management plan after explicit confirmation. Creates a backup and JSONL audit log before writing. It is categorised as a Write tool in the Microsoft Todo Safe MCP Server, which means it can create or modify data. Consider rate limits to prevent runaway writes.
Register the Microsoft Todo Safe MCP server in PolicyLayer and add a rule for apply_plan: allow, deny, rate-limit, or require approval. Point your MCP client at the PolicyLayer proxy URL and the rule is enforced on every call, before it reaches Microsoft Todo Safe. Nothing to install.
apply_plan is a Write tool with medium risk. Write tools should be rate-limited to prevent accidental bulk modifications.
Yes. Add a rate_limit block to the apply_plan rule in your PolicyLayer policy. For example, setting max: 10 and window: 60 limits the tool to 10 calls per minute. Rate limits are tracked per agent session and reset automatically.
Set action: deny in the PolicyLayer policy for apply_plan. The AI agent will receive a policy violation error and cannot call the tool. You can also include a reason field to explain why the tool is blocked.
apply_plan is provided by the Microsoft Todo Safe MCP server (saenai/microsoft-todo-safe-mcp). PolicyLayer sits as a proxy in front of this server to enforce policies before tool calls reach the server.
Every MCP server has a record like this.
Type a name, get the same breakdown: verified identity, auth posture, risk grade, capabilities, recommended policy.
Teams ship this data inside their own products. See what a licence covers →