migrate_file_code

THE RISK

Medium Risk

Why migrate_file_code needs a policy

The tool transforms and updates source code (reversible modifications). It is not purely Read (no analysis-only operation), not Execute (does not run code or trigger external operations), and not Destructive (changes can be undone via version control or manual restoration).

From the tool's definition Tool description states it "Applies heuristic transformations to convert HeroUI v2 code to v3 patterns." This modifies code files through automated rewrites, making it a Write operation that creates or modifies data reversibly.

Documented attack patterns abuse exactly the kind of access migrate_file_code gives an agent:

POLICY

How to control migrate_file_code

PolicyLayer is an MCP gateway — it sits between your AI agents and HeroUI Migration MCP, and nothing reaches the server without passing your rules. This is the rule we recommend for migrate_file_code:

policy.json

{
  "version": "1",
  "default": "deny",
  "tools": {
    "migrate_file_code": {
      "limits": [
        {
          "counter": "migrate_file_code_rate",
          "window": "minute",
          "max": 30,
          "scope": "grant"
        }
      ]
    }
  }
}

migrate_file_code stays usable, but capped — an agent stuck in a loop can't make hundreds of changes a minute. Everything else on the server is denied unless you say otherwise.

Create a free account and register HeroUI Migration MCP — nothing to install.
Add this policy — paste it, or build it visually.
Point your MCP client (Claude, Cursor, anything) at your gateway URL.

LIMIT THIS TOOL →

Free to start. No card required.

EXPLORE

Related tools and policies

More HeroUI Migration MCP tools

Write rewrite_file Apply heuristic migrations to code and return the rewritten source plus diagnostics. Read analyze_file Analyze code and return detailed findings about legacy imports, components, props, hooks a Read analyze_legacy_imports Quick heuristic scanner for HeroUI/NextUI v2 imports and symbols. Read analyze_tailwind_config Checks tailwind.config.js for legacy HeroUI plugins and content paths. Read audit_tailwind Analyze a Tailwind configuration file for legacy HeroUI patterns. Read check_v3_compatibility Checks if a file content follows HeroUI v3 patterns (no NextUI, uses compound API). Read compare_component Show presence/status of a component between v2 and v3, with alias lookup. Read corpus_status Checks the presence and metadata of generated documentation artifacts.

All 18 HeroUI Migration MCP tools →

Write tools on other servers

M-Team MCP Server download_torrent YouTube MCP Server generate_video_title Android Forensics ADB MCP Server combine_reports 0xarchive web3_signup

Go deeper

The MCP Attack Database → Documented attack patterns against MCP deployments — and the policies that stop them.
Argument validation → Checking tool call arguments against schema and policy before they run.
Scoped token → Per-person credentials that grant a defined subset of servers and tools.
Rate Limiting MCP Tool Calls: A Practical Guide →
MCP Security: Why Prompt Guardrails Aren't Enough →

FAQ

Questions about migrate_file_code

What does the migrate_file_code tool do? +

Applies heuristic transformations to convert HeroUI v2 code to v3 patterns. It is categorised as a Write tool in the HeroUI Migration MCP MCP Server, which means it can create or modify data. Consider rate limits to prevent runaway writes.

How do I enforce a policy on migrate_file_code? +

Register the HeroUI Migration MCP server in PolicyLayer and add a rule for migrate_file_code: allow, deny, rate-limit, or require approval. Point your MCP client at the PolicyLayer proxy URL and the rule is enforced on every call, before it reaches HeroUI Migration MCP. Nothing to install.

What risk level is migrate_file_code? +

migrate_file_code is a Write tool with medium risk. Write tools should be rate-limited to prevent accidental bulk modifications.

Can I rate-limit migrate_file_code? +

Yes. Add a rate_limit block to the migrate_file_code rule in your PolicyLayer policy. For example, setting max: 10 and window: 60 limits the tool to 10 calls per minute. Rate limits are tracked per agent session and reset automatically.

How do I block migrate_file_code completely? +

Set action: deny in the PolicyLayer policy for migrate_file_code. The AI agent will receive a policy violation error and cannot call the tool. You can also include a reason field to explain why the tool is blocked.

What MCP server provides migrate_file_code? +

migrate_file_code is provided by the HeroUI Migration MCP server (sctg-development/heroui-migration-mcp). PolicyLayer sits as a proxy in front of this server to enforce policies before tool calls reach the server.

Enforce policy on every HeroUI Migration MCP tool call.

Start from HeroUI Migration MCP, add the rest of your stack, and see everything your agents can call. Then put policy on all of it.

CHECK YOUR STACK →