projects.create · Stillonline MCP: Risk & Policy

WHAT IT DOES

What projects.create does on Stillonline

AI agents use projects.create to create or update resources in Stillonline — usually the action step of a workflow, after the agent has gathered context. Every call changes real data in your Stillonline environment.

WHY IT NEEDS A POLICY

Why projects.create needs a policy

The tool creates new data structures (projects and status pages) and associated monitoring checks, which is reversible (projects can be deleted via the sibling projects.delete tool). This is a Write operation rather than Execute or Destructive.

From the tool's definition Tool name 'projects.create' and description states 'Create a StillOnline project' — this is a create operation that generates new monitoring projects and status pages.

Attacks that exploit this kind of access

Recommended rule Ready

Verdict

projects.create Rate-limited

projects.create stays usable, but capped — an agent stuck in a loop can't make hundreds of changes a minute. Everything else on the server is denied unless you say otherwise.

View as policy code

policy.json

{
  "version": "1",
  "default": "deny",
  "tools": {
    "projects.create": {
      "limits": [
        {
          "counter": "projects.create_rate",
          "window": "minute",
          "max": 30,
          "scope": "grant"
        }
      ]
    }
  }
}

LIMIT THIS TOOL →

Instant setup, no code required.

PolicyLayer is an MCP gateway: every tool call is checked against your rule before it reaches Stillonline, so you can run agents against it safely.

FAQ

Questions about projects.create

What does the projects.create tool do? +

Create a StillOnline project with an automatic status page and initial HTTP URL check. Call this after deploying a new SaaS app, API, MCP backend, or AI agent health endpoint that needs uptime monitoring. It is categorised as a Write tool in the Stillonline MCP Server, which means it can create or modify data. Consider rate limits to prevent runaway writes.

How do I enforce a policy on projects.create? +

Register the Stillonline MCP server in PolicyLayer and add a rule for projects.create: allow, deny, rate-limit, or require approval. Point your MCP client at the PolicyLayer proxy URL and the rule is enforced on every call, before it reaches Stillonline. Nothing to install.

What risk level is projects.create? +

projects.create is a Write tool with medium risk. Write tools should be rate-limited to prevent accidental bulk modifications.

Can I rate-limit projects.create? +

Yes. Add a rate_limit block to the projects.create rule in your PolicyLayer policy. For example, setting max: 10 and window: 60 limits the tool to 10 calls per minute. Rate limits are tracked per agent session and reset automatically.

How do I block projects.create completely? +

Set action: deny in the PolicyLayer policy for projects.create. The AI agent will receive a policy violation error and cannot call the tool. You can also include a reason field to explain why the tool is blocked.

What MCP server provides projects.create? +

projects.create is provided by the Stillonline MCP server (shenwell/stillonline-mcp). PolicyLayer sits as a proxy in front of this server to enforce policies before tool calls reach the server.