save_portfolio · Cn Funds MCP: Risk & Policy

WHAT IT DOES

What save_portfolio does on Cn Funds

AI agents use save_portfolio to create or update resources in Cn Funds — usually the action step of a workflow, after the agent has gathered context. Every call changes real data in your Cn Funds environment.

WHY IT NEEDS A POLICY

Why save_portfolio needs a policy

An AI agent can call save_portfolio faster than any human can review — one bad instruction and it creates or modifies resources in Cn Funds by the hundred, each call as confident as the last.

Attacks that exploit this kind of access

Recommended rule Ready

Verdict

save_portfolio Rate-limited

save_portfolio stays usable, but capped — an agent stuck in a loop can't make hundreds of changes a minute. Everything else on the server is denied unless you say otherwise.

View as policy code

policy.json

{
  "version": "1",
  "default": "deny",
  "tools": {
    "save_portfolio": {
      "limits": [
        {
          "counter": "save_portfolio_rate",
          "window": "minute",
          "max": 30,
          "scope": "grant"
        }
      ]
    }
  }
}

LIMIT THIS TOOL →

Instant setup, no code required.

PolicyLayer is an MCP gateway: every tool call is checked against your rule before it reaches Cn Funds, so you can run agents against it safely.

FAQ

Questions about save_portfolio

What does the save_portfolio tool do? +

保存/更新我的基金持仓记录（基金代码、持有份额、成本净值）。如果基金已存在则更新，不存在则新增。. It is categorised as a Write tool in the Cn Funds MCP Server, which means it can create or modify data. Consider rate limits to prevent runaway writes.

How do I enforce a policy on save_portfolio? +

Register the Cn Funds MCP server in PolicyLayer and add a rule for save_portfolio: allow, deny, rate-limit, or require approval. Point your MCP client at the PolicyLayer proxy URL and the rule is enforced on every call, before it reaches Cn Funds. Nothing to install.

What risk level is save_portfolio? +

save_portfolio is a Write tool with medium risk. Write tools should be rate-limited to prevent accidental bulk modifications.

Can I rate-limit save_portfolio? +

Yes. Add a rate_limit block to the save_portfolio rule in your PolicyLayer policy. For example, setting max: 10 and window: 60 limits the tool to 10 calls per minute. Rate limits are tracked per agent session and reset automatically.

How do I block save_portfolio completely? +

Set action: deny in the PolicyLayer policy for save_portfolio. The AI agent will receive a policy violation error and cannot call the tool. You can also include a reason field to explain why the tool is blocked.

What MCP server provides save_portfolio? +

save_portfolio is provided by the Cn Funds MCP server (smallke/cn-funds-mcp). PolicyLayer sits as a proxy in front of this server to enforce policies before tool calls reach the server.