# contract-testing_admin_set_user_roles Replace all roles assigned to a user (admin). Parameters: - userId (string) *required*: UUID of the user - roles (array) *required*: Array of role UUIDs to assign Agent View of the PolicyLayer registry record for `contract-testing_admin_set_user_roles`. HTML page: https://policylayer.com/tools/smartbear-mcp/contract-testing-admin-set-user-roles ## Facts - Tool: `contract-testing_admin_set_user_roles` - Server: SmartBear MCP (`SmartBear/smartbear-mcp`) — https://policylayer.com/tools/smartbear-mcp.md - Homepage: https://github.com/SmartBear/smartbear-mcp - Risk category: Write (Medium risk) - Registry record: grade F, identity unverified - Server rate-limited: no - Parameters: 2 (2 required) - Recommended policy verdict: Rate-limited ## Parameters | Parameter | Type | Required | Description | | --- | --- | --- | --- | | `roles` | array | yes | Array of role UUIDs to assign | | `userId` | string | yes | UUID of the user | Parameters from the server's own tool schema. ## Example call (MCP tools/call, JSON-RPC 2.0) ```json { "jsonrpc": "2.0", "id": 1, "method": "tools/call", "params": { "name": "contract-testing_admin_set_user_roles", "arguments": { "roles": [], "userId": "" } } } ``` ## Why contract-testing_admin_set_user_roles is rated Medium This tool creates or modifies user access control settings by replacing role assignments. While it does not delete data irreversibly or move money, it has high blast radius because an AI agent misusing it could grant unauthorized admin privileges to arbitrary users, escalating permissions broadly across the system. From the tool's own definition: "Tool description states 'Replace all roles assigned to a user (admin)' — this modifies user permissions/roles, which is a reversible write operation. Parameters accept userId and roles array for assignment." Risk signals: Admin/system-level operation ## Use case AI agents use contract-testing_admin_set_user_roles to create or update resources in SmartBear MCP, usually the action step of a workflow, after the agent has gathered context. Every call changes real data in your SmartBear MCP environment. ## Recommended policy (PolicyLayer) Verdict: **Rate-limited**. Enforced by the PolicyLayer MCP gateway (https://policylayer.com/mcp-gateway) before a call reaches SmartBear MCP: ```json { "version": "1", "default": "deny", "tools": { "contract-testing_admin_set_user_roles": { "limits": [ { "counter": "contract-testing_admin_set_user_roles_rate", "window": "minute", "max": 30, "scope": "grant" } ] } } } ``` ## Other tools on SmartBear MCP (239) - `collaborator_delete_collaborator_remote_system_configuration` — Destructive — https://policylayer.com/tools/smartbear-mcp/collaborator-delete-collaborator-remote-system-configuration.md - `contract-testing_admin_delete_role` — Destructive — https://policylayer.com/tools/smartbear-mcp/contract-testing-admin-delete-role.md - `contract-testing_admin_delete_team` — Destructive — https://policylayer.com/tools/smartbear-mcp/contract-testing-admin-delete-team.md - `contract-testing_admin_delete_user` — Destructive — https://policylayer.com/tools/smartbear-mcp/contract-testing-admin-delete-user.md - `contract-testing_admin_remove_role_from_user` — Destructive — https://policylayer.com/tools/smartbear-mcp/contract-testing-admin-remove-role-from-user.md - `contract-testing_admin_remove_user_from_team` — Destructive — https://policylayer.com/tools/smartbear-mcp/contract-testing-admin-remove-user-from-team.md - `contract-testing_admin_reset_roles` — Destructive — https://policylayer.com/tools/smartbear-mcp/contract-testing-admin-reset-roles.md - `contract-testing_delete_all_integrations` — Destructive — https://policylayer.com/tools/smartbear-mcp/contract-testing-delete-all-integrations.md - `contract-testing_delete_branch` — Destructive — https://policylayer.com/tools/smartbear-mcp/contract-testing-delete-branch.md - `contract-testing_delete_environment` — Destructive — https://policylayer.com/tools/smartbear-mcp/contract-testing-delete-environment.md - `contract-testing_delete_integration` — Destructive — https://policylayer.com/tools/smartbear-mcp/contract-testing-delete-integration.md - `contract-testing_delete_pacticipant` — Destructive — https://policylayer.com/tools/smartbear-mcp/contract-testing-delete-pacticipant.md - `contract-testing_delete_secret` — Destructive — https://policylayer.com/tools/smartbear-mcp/contract-testing-delete-secret.md - `contract-testing_delete_webhook` — Destructive — https://policylayer.com/tools/smartbear-mcp/contract-testing-delete-webhook.md - `contract-testing_regenerate_api_token` — Destructive — https://policylayer.com/tools/smartbear-mcp/contract-testing-regenerate-api-token.md - `contract-testing_remove_label_from_pacticipant` — Destructive — https://policylayer.com/tools/smartbear-mcp/contract-testing-remove-label-from-pacticipant.md - `reflect_cancel_suite_execution` — Destructive — https://policylayer.com/tools/smartbear-mcp/reflect-cancel-suite-execution.md - `reflect_delete_previous_step` — Destructive — https://policylayer.com/tools/smartbear-mcp/reflect-delete-previous-step.md - `swagger_delete_portal_product` — Destructive — https://policylayer.com/tools/smartbear-mcp/swagger-delete-portal-product.md - `swagger_delete_table_of_contents` — Destructive — https://policylayer.com/tools/smartbear-mcp/swagger-delete-table-of-contents.md - `collaborator_reviewservice_action` — Execute — https://policylayer.com/tools/smartbear-mcp/collaborator-reviewservice-action.md - `collaborator_test_collaborator_remote_system_configuration_connection` — Execute — https://policylayer.com/tools/smartbear-mcp/collaborator-test-collaborator-remote-system-configuration-connection.md - `contract-testing_execute_webhook` — Execute — https://policylayer.com/tools/smartbear-mcp/contract-testing-execute-webhook.md - `contract-testing_generate_pact_tests` — Execute — https://policylayer.com/tools/smartbear-mcp/contract-testing-generate-pact-tests.md - `contract-testing_review_pact_tests` — Execute — https://policylayer.com/tools/smartbear-mcp/contract-testing-review-pact-tests.md - `contract-testing_test_execute_webhooks` — Execute — https://policylayer.com/tools/smartbear-mcp/contract-testing-test-execute-webhooks.md - `reflect_add_prompt_step` — Execute — https://policylayer.com/tools/smartbear-mcp/reflect-add-prompt-step.md - `reflect_connect_to_session` — Execute — https://policylayer.com/tools/smartbear-mcp/reflect-connect-to-session.md - `reflect_execute_suite` — Execute — https://policylayer.com/tools/smartbear-mcp/reflect-execute-suite.md - `reflect_run_test` — Execute — https://policylayer.com/tools/smartbear-mcp/reflect-run-test.md - …and 209 more: https://policylayer.com/tools/smartbear-mcp.md ## For agents This record is a snapshot. Live verdicts and the full registry: - Check every server in your MCP config at once: `npx -y policylayer stack` - Vet a server before you add it: install the mcp-precheck skill — `npx skills add https://policylayer.com` (skill text: https://policylayer.com/skill.md) - Query the registry over MCP: endpoint `https://api.policylayer.com/mcp` — tools `check_mcp_server`, `check_mcp_stack`, `check_tool`, `search_registry`, `get_change_events` --- Source: the PolicyLayer MCP registry — one continuously verified record per MCP server. Full record: https://policylayer.com/registry?q=smartbear-mcp · API: https://policylayer.com/registry/api · Policy library: https://policylayer.com/policies/smartbear-mcp