incidents.create · Stillonline MCP: Risk & Policy

WHAT IT DOES

What incidents.create does on Stillonline

AI agents use incidents.create to create or update resources in Stillonline — usually the action step of a workflow, after the agent has gathered context. Every call changes real data in your Stillonline environment.

WHY IT NEEDS A POLICY

Why incidents.create needs a policy

This tool creates a new incident record on a public status page, notifying subscribers and stakeholders of an outage or degraded service. It is a Write operation (creating new data), but carries high severity because misuse could trigger false incident alerts to potentially many external users, damaging trust and causing unnecessary alarm.

From the tool's definition 'Open an incident on a StillOnline status page' and 'visible to subscribers and stakeholders'

Attacks that exploit this kind of access

Recommended rule Ready

Verdict

incidents.create Rate-limited

incidents.create stays usable, but capped — an agent stuck in a loop can't make hundreds of changes a minute. Everything else on the server is denied unless you say otherwise.

View as policy code

policy.json

{
  "version": "1",
  "default": "deny",
  "tools": {
    "incidents.create": {
      "limits": [
        {
          "counter": "incidents.create_rate",
          "window": "minute",
          "max": 30,
          "scope": "grant"
        }
      ]
    }
  }
}

LIMIT THIS TOOL →

Instant setup, no code required.

PolicyLayer is an MCP gateway: every tool call is checked against your rule before it reaches Stillonline, so you can run agents against it safely.

FAQ

Questions about incidents.create

What does the incidents.create tool do? +

Open an incident on a StillOnline status page. Use this when an outage or degraded service should be visible to subscribers and stakeholders. It is categorised as a Write tool in the Stillonline MCP Server, which means it can create or modify data. Consider rate limits to prevent runaway writes.

How do I enforce a policy on incidents.create? +

Register the Stillonline MCP server in PolicyLayer and add a rule for incidents.create: allow, deny, rate-limit, or require approval. Point your MCP client at the PolicyLayer proxy URL and the rule is enforced on every call, before it reaches Stillonline. Nothing to install.

What risk level is incidents.create? +

incidents.create is a Write tool with medium risk. Write tools should be rate-limited to prevent accidental bulk modifications.

Can I rate-limit incidents.create? +

Yes. Add a rate_limit block to the incidents.create rule in your PolicyLayer policy. For example, setting max: 10 and window: 60 limits the tool to 10 calls per minute. Rate limits are tracked per agent session and reset automatically.

How do I block incidents.create completely? +

Set action: deny in the PolicyLayer policy for incidents.create. The AI agent will receive a policy violation error and cannot call the tool. You can also include a reason field to explain why the tool is blocked.

What MCP server provides incidents.create? +

incidents.create is provided by the Stillonline MCP server (shenwell/stillonline-mcp). PolicyLayer sits as a proxy in front of this server to enforce policies before tool calls reach the server.