get_team_years · Statbotics MCP: Risk & Policy

WHAT IT DOES

What get_team_years does on Statbotics

AI agents call get_team_years to retrieve information from Statbotics without modifying anything — typically the context-gathering step in research, monitoring, and reporting workflows, before the agent takes action elsewhere.

PARAMETERS

Parameter	Type	Required	Description
`team`	integer	—	Team number (no prefix), e.g. 86
`year`	integer	—	Four-digit year (2002 onwards)
`limit`	integer	—	Maximum number of results to return (1-1000). Default is 1000.
`state`	string	—	Capitalized two-letter state code, e.g. NC.
`metric`	string	—	How to sort the returned values. Any column in the table is valid.
`offset`	integer	—	Offset from the first result to return.
`country`	string	—	Capitalized country name, e.g. USA or Canada.
`district`	string	—	District abbreviation. One of: ca, fch, fim, fin, fit, fma, fnc, fsc, isr, ne, ont, pch, pnw, win.
`ascending`	boolean	—	Whether to sort in ascending order. Default is ascending.

Parameters from the server's own tool schema.

WHY IT NEEDS A POLICY

Why get_team_years needs a policy

This tool retrieves and queries historical FRC team statistics across seasons and filters. It has no side effects and cannot modify, create, or delete data. The filtering and sorting capabilities are standard read operations for data retrieval. The blast radius of misuse is minimal - an agent could only access statistical data that is presumably public competition information.

From the tool's definition Tool description states it "List per-season FIRST Robotics Competition (FRC) team statistics" and "Returns an array of team-year records".

Attacks that exploit this kind of access

Questions about get_team_years

What does the get_team_years tool do? +

List per-season FIRST Robotics Competition (FRC) team statistics with flexible filters - useful for cross-team or cross-year analysis. Returns an array of team-year records (each row is one team's stats for one season: EPA, record, ranks, awards, district points). Filter by team (a single team across many seasons), year (all teams in one season), country, state, and district. Combine filters - e.g. team+year is equivalent to get_team_year. Sort with metric/ascending and paginate with limit/offset. Use this to answer "show team 254 in every season", "rank all teams by EPA in 2023", or "find the strongest teams in the New England district in 2024". It is categorised as a Read tool in the Statbotics MCP Server, which means it retrieves data without modifying state.

What parameters does get_team_years accept? +

get_team_years accepts 9 parameters: team, year, limit, state, metric, offset, country, district, ascending. The full parameter table on this page comes from the server's own tool schema.

How do I enforce a policy on get_team_years? +

Register the Statbotics MCP server in PolicyLayer and add a rule for get_team_years: allow, deny, rate-limit, or require approval. Point your MCP client at the PolicyLayer proxy URL and the rule is enforced on every call, before it reaches Statbotics. Nothing to install.

What risk level is get_team_years? +

get_team_years is a Read tool with low risk. Read-only tools are generally safe to allow by default.

Can I rate-limit get_team_years? +

Yes. Add a rate_limit block to the get_team_years rule in your PolicyLayer policy. For example, setting max: 10 and window: 60 limits the tool to 10 calls per minute. Rate limits are tracked per agent session and reset automatically.

How do I block get_team_years completely? +

Set action: deny in the PolicyLayer policy for get_team_years. The AI agent will receive a policy violation error and cannot call the tool. You can also include a reason field to explain why the tool is blocked.

What MCP server provides get_team_years? +

get_team_years is provided by the Statbotics MCP server (@withinfocus/statbotics-mcp-server). PolicyLayer sits as a proxy in front of this server to enforce policies before tool calls reach the server.