fill_input · Brave Browser MCP Server MCP: Risk & Policy

WHAT IT DOES

What fill_input does on Brave Browser MCP Server

AI agents invoke fill_input to trigger actions in Brave Browser MCP Server. What it does depends on the arguments the agent supplies, and its effects often reach beyond the immediate call — builds kicked off, notifications sent, workflows started.

WHY IT NEEDS A POLICY

Why fill_input needs a policy

This tool performs a browser interaction (filling an input field), which is an Execute-category action. It also destructively clears existing content before filling, but since this is a UI field operation (not permanent data deletion), Execute is the most appropriate category. Misuse could lead to submitting unintended data into forms, potentially causing harm depending on what form is being filled.

From the tool's definition 'Fills an input field instantly with the given text (clears existing content first)' — triggers a browser action that modifies UI state and clears existing content

Attacks that exploit this kind of access

Recommended rule Ready

Verdict

fill_input Rate-limited

fill_input stays usable, but rate-capped — a runaway agent can't fire it dozens of times a minute. Everything else on the server is denied unless you say otherwise.

View as policy code

policy.json

{
  "version": "1",
  "default": "deny",
  "tools": {
    "fill_input": {
      "limits": [
        {
          "counter": "fill_input_rate",
          "window": "minute",
          "max": 10,
          "scope": "grant"
        }
      ]
    }
  }
}

RATE-LIMIT THIS TOOL →

Instant setup, no code required.

PolicyLayer is an MCP gateway: every tool call is checked against your rule before it reaches Brave Browser MCP Server, so you can run agents against it safely.

FAQ

Questions about fill_input

What does the fill_input tool do? +

Fills an input field instantly with the given text (clears existing content first). It is categorised as a Execute tool in the Brave Browser MCP Server MCP Server, which means it can trigger actions or run processes. Use rate limits and argument validation.

How do I enforce a policy on fill_input? +

Register the Brave Browser MCP Server MCP server in PolicyLayer and add a rule for fill_input: allow, deny, rate-limit, or require approval. Point your MCP client at the PolicyLayer proxy URL and the rule is enforced on every call, before it reaches Brave Browser MCP Server. Nothing to install.

What risk level is fill_input? +

fill_input is a Execute tool with high risk. Execute tools should be rate-limited and have argument validation enabled.

Can I rate-limit fill_input? +

Yes. Add a rate_limit block to the fill_input rule in your PolicyLayer policy. For example, setting max: 10 and window: 60 limits the tool to 10 calls per minute. Rate limits are tracked per agent session and reset automatically.

How do I block fill_input completely? +

Set action: deny in the PolicyLayer policy for fill_input. The AI agent will receive a policy violation error and cannot call the tool. You can also include a reason field to explain why the tool is blocked.

What MCP server provides fill_input? +

fill_input is provided by the Brave Browser MCP Server MCP server (slaveofgod1/brave-browser-mcp). PolicyLayer sits as a proxy in front of this server to enforce policies before tool calls reach the server.