put_object_bytes · Rustfs MCP: Risk & Policy

WHAT IT DOES

What put_object_bytes does on Rustfs

AI agents use put_object_bytes to create or update resources in Rustfs — usually the action step of a workflow, after the agent has gathered context. Every call changes real data in your Rustfs environment.

WHY IT NEEDS A POLICY

Why put_object_bytes needs a policy

This tool creates or modifies objects in S3-compatible storage, which is reversible via delete_object or overwrite. It does not execute code, delete data irreversibly, or move funds. The 'high' severity reflects the potential blast radius: an AI agent could upload malicious files, overwrite critical objects, or fill storage with unwanted content.

From the tool's definition Tool name 'put_object_bytes' and description 'Upload an object from base64 bytes' indicate creation/modification of S3 objects. The ~10MiB cap and browser file upload context confirm write operations without deletion or code execution.

Attacks that exploit this kind of access

Recommended rule Ready

Verdict

put_object_bytes Rate-limited

put_object_bytes stays usable, but capped — an agent stuck in a loop can't make hundreds of changes a minute. Everything else on the server is denied unless you say otherwise.

View as policy code

policy.json

{
  "version": "1",
  "default": "deny",
  "tools": {
    "put_object_bytes": {
      "limits": [
        {
          "counter": "put_object_bytes_rate",
          "window": "minute",
          "max": 30,
          "scope": "grant"
        }
      ]
    }
  }
}

LIMIT THIS TOOL →

Instant setup, no code required.

PolicyLayer is an MCP gateway: every tool call is checked against your rule before it reaches Rustfs, so you can run agents against it safely.

FAQ

Questions about put_object_bytes

What does the put_object_bytes tool do? +

Upload an object from base64 bytes (browser file upload; ~10MiB cap). Empty. It is categorised as a Write tool in the Rustfs MCP Server, which means it can create or modify data. Consider rate limits to prevent runaway writes.

How do I enforce a policy on put_object_bytes? +

Register the Rustfs MCP server in PolicyLayer and add a rule for put_object_bytes: allow, deny, rate-limit, or require approval. Point your MCP client at the PolicyLayer proxy URL and the rule is enforced on every call, before it reaches Rustfs. Nothing to install.

What risk level is put_object_bytes? +

put_object_bytes is a Write tool with medium risk. Write tools should be rate-limited to prevent accidental bulk modifications.

Can I rate-limit put_object_bytes? +

Yes. Add a rate_limit block to the put_object_bytes rule in your PolicyLayer policy. For example, setting max: 10 and window: 60 limits the tool to 10 calls per minute. Rate limits are tracked per agent session and reset automatically.

How do I block put_object_bytes completely? +

Set action: deny in the PolicyLayer policy for put_object_bytes. The AI agent will receive a policy violation error and cannot call the tool. You can also include a reason field to explain why the tool is blocked.

What MCP server provides put_object_bytes? +

put_object_bytes is provided by the Rustfs MCP server (stackblaze/rustfs-mcp). PolicyLayer sits as a proxy in front of this server to enforce policies before tool calls reach the server.