vguard_init_project · Vibe Guard MCP: Risk & Policy

WHAT IT DOES

What vguard_init_project does on Vibe Guard

AI agents use vguard_init_project to create or update resources in Vibe Guard — usually the action step of a workflow, after the agent has gathered context. Every call changes real data in your Vibe Guard environment.

WHY IT NEEDS A POLICY

Why vguard_init_project needs a policy

This tool creates a new governance directory structure in a project. It is a Write operation as it creates files/directories that did not previously exist. While this is a first-time setup action, it is reversible (the directory can be deleted).

From the tool's definition 初始化 .vibe-guard/ 治理目录 (initializes .vibe-guard/ governance directory in the target project)

Attacks that exploit this kind of access

Recommended rule Ready

Verdict

vguard_init_project Rate-limited

vguard_init_project stays usable, but capped — an agent stuck in a loop can't make hundreds of changes a minute. Everything else on the server is denied unless you say otherwise.

View as policy code

policy.json

{
  "version": "1",
  "default": "deny",
  "tools": {
    "vguard_init_project": {
      "limits": [
        {
          "counter": "vguard_init_project_rate",
          "window": "minute",
          "max": 30,
          "scope": "grant"
        }
      ]
    }
  }
}

LIMIT THIS TOOL →

Instant setup, no code required.

PolicyLayer is an MCP gateway: every tool call is checked against your rule before it reaches Vibe Guard, so you can run agents against it safely.

FAQ

Questions about vguard_init_project

What does the vguard_init_project tool do? +

在目标项目中初始化 .vibe-guard/ 治理目录。如果项目尚未初始化，先调用此工具再进行开发。. It is categorised as a Write tool in the Vibe Guard MCP Server, which means it can create or modify data. Consider rate limits to prevent runaway writes.

How do I enforce a policy on vguard_init_project? +

Register the Vibe Guard MCP server in PolicyLayer and add a rule for vguard_init_project: allow, deny, rate-limit, or require approval. Point your MCP client at the PolicyLayer proxy URL and the rule is enforced on every call, before it reaches Vibe Guard. Nothing to install.

What risk level is vguard_init_project? +

vguard_init_project is a Write tool with medium risk. Write tools should be rate-limited to prevent accidental bulk modifications.

Can I rate-limit vguard_init_project? +

Yes. Add a rate_limit block to the vguard_init_project rule in your PolicyLayer policy. For example, setting max: 10 and window: 60 limits the tool to 10 calls per minute. Rate limits are tracked per agent session and reset automatically.

How do I block vguard_init_project completely? +

Set action: deny in the PolicyLayer policy for vguard_init_project. The AI agent will receive a policy violation error and cannot call the tool. You can also include a reason field to explain why the tool is blocked.

What MCP server provides vguard_init_project? +

vguard_init_project is provided by the Vibe Guard MCP server (sikuai2333/vibe-guard). PolicyLayer sits as a proxy in front of this server to enforce policies before tool calls reach the server.