ism_coverage_upsert · Ism MCP: Risk & Policy

WHAT IT DOES

What ism_coverage_upsert does on Ism

AI agents use ism_coverage_upsert to create or update resources in Ism — usually the action step of a workflow, after the agent has gathered context. Every call changes real data in your Ism environment.

WHY IT NEEDS A POLICY

Why ism_coverage_upsert needs a policy

The 'upsert' operation is reversible (data can be corrected or deleted in subsequent operations), making it Write rather than Destructive. However, the empty description prevents full certainty about what data is being modified and whether controls or sensitive ISM mappings could be corrupted.

From the tool's definition Tool name 'ism_coverage_upsert' contains 'upsert', a standard database operation meaning insert-or-update. This modifies coverage tracking data in the ISM query layer.

Attacks that exploit this kind of access

Recommended rule Ready

Verdict

ism_coverage_upsert Rate-limited

ism_coverage_upsert stays usable, but capped — an agent stuck in a loop can't make hundreds of changes a minute. Everything else on the server is denied unless you say otherwise.

View as policy code

policy.json

{
  "version": "1",
  "default": "deny",
  "tools": {
    "ism_coverage_upsert": {
      "limits": [
        {
          "counter": "ism_coverage_upsert_rate",
          "window": "minute",
          "max": 30,
          "scope": "grant"
        }
      ]
    }
  }
}

LIMIT THIS TOOL →

Instant setup, no code required.

PolicyLayer is an MCP gateway: every tool call is checked against your rule before it reaches Ism, so you can run agents against it safely.

FAQ

Questions about ism_coverage_upsert

What does the ism_coverage_upsert tool do? +

ism_coverage_upsert. It is categorised as a Write tool in the Ism MCP Server, which means it can create or modify data. Consider rate limits to prevent runaway writes.

How do I enforce a policy on ism_coverage_upsert? +

Register the Ism MCP server in PolicyLayer and add a rule for ism_coverage_upsert: allow, deny, rate-limit, or require approval. Point your MCP client at the PolicyLayer proxy URL and the rule is enforced on every call, before it reaches Ism. Nothing to install.

What risk level is ism_coverage_upsert? +

ism_coverage_upsert is a Write tool with medium risk. Write tools should be rate-limited to prevent accidental bulk modifications.

Can I rate-limit ism_coverage_upsert? +

Yes. Add a rate_limit block to the ism_coverage_upsert rule in your PolicyLayer policy. For example, setting max: 10 and window: 60 limits the tool to 10 calls per minute. Rate limits are tracked per agent session and reset automatically.

How do I block ism_coverage_upsert completely? +

Set action: deny in the PolicyLayer policy for ism_coverage_upsert. The AI agent will receive a policy violation error and cannot call the tool. You can also include a reason field to explain why the tool is blocked.

What MCP server provides ism_coverage_upsert? +

ism_coverage_upsert is provided by the Ism MCP server (samueldudley/ism-mcp). PolicyLayer sits as a proxy in front of this server to enforce policies before tool calls reach the server.