get_teams · Statbotics MCP: Risk & Policy

WHAT IT DOES

What get_teams does on Statbotics

AI agents call get_teams to retrieve information from Statbotics without modifying anything — typically the context-gathering step in research, monitoring, and reporting workflows, before the agent takes action elsewhere.

PARAMETERS

Parameter	Type	Required	Description
`limit`	integer	—	Maximum number of results to return (1-1000). Default is 1000.
`state`	string	—	Capitalized two-letter state code, e.g. NC.
`active`	boolean	—	Whether the team has played in the last year.
`metric`	string	—	How to sort the returned values. Any column in the table is valid.
`offset`	integer	—	Offset from the first result to return.
`country`	string	—	Capitalized country name, e.g. USA or Canada.
`district`	string	—	District abbreviation. One of: ca, fch, fim, fin, fit, fma, fnc, fsc, isr, ne, ont, pch, pnw, win.
`ascending`	boolean	—	Whether to sort in ascending order. Default is ascending.

Parameters from the server's own tool schema.

WHY IT NEEDS A POLICY

Why get_teams needs a policy

This tool purely retrieves and queries data from the Statbotics database with no side effects. It supports filtering, sorting, and pagination of team information—all read-only operations. The presence of filter and sort parameters does not change its fundamental nature as a data retrieval operation.

From the tool's definition Tool description explicitly states it 'List[s] FIRST Robotics Competition (FRC) teams' and 'Returns an array of team profiles' with optional filtering and sorting parameters. No modification, deletion, or execution capabilities are mentioned.

Attacks that exploit this kind of access

Questions about get_teams

What does the get_teams tool do? +

List FIRST Robotics Competition (FRC) teams from the Statbotics database with optional filters. Returns an array of team profiles (number, name, location, rookie year, active flag, career EPA stats, career win rate). Filter by country (e.g. "USA", "Canada"), state (two-letter code, e.g. "NC", "CA"), district (one of ca, fch, fim, fin, fit, fma, fnc, fsc, isr, ne, ont, pch, pnw, win), and active (true to limit to teams that competed in the last year). Sort with metric/ascending (e.g. metric="norm_epa", ascending=false to find the strongest active teams) and paginate with limit/offset. Use this to answer "which teams in Texas are most successful?", "list all teams in the FIM district", or "find the top 50 teams by normalized EPA". It is categorised as a Read tool in the Statbotics MCP Server, which means it retrieves data without modifying state.

What parameters does get_teams accept? +

get_teams accepts 8 parameters: limit, state, active, metric, offset, country, district, ascending. The full parameter table on this page comes from the server's own tool schema.

How do I enforce a policy on get_teams? +

Register the Statbotics MCP server in PolicyLayer and add a rule for get_teams: allow, deny, rate-limit, or require approval. Point your MCP client at the PolicyLayer proxy URL and the rule is enforced on every call, before it reaches Statbotics. Nothing to install.

What risk level is get_teams? +

get_teams is a Read tool with low risk. Read-only tools are generally safe to allow by default.

Can I rate-limit get_teams? +

Yes. Add a rate_limit block to the get_teams rule in your PolicyLayer policy. For example, setting max: 10 and window: 60 limits the tool to 10 calls per minute. Rate limits are tracked per agent session and reset automatically.

How do I block get_teams completely? +

Set action: deny in the PolicyLayer policy for get_teams. The AI agent will receive a policy violation error and cannot call the tool. You can also include a reason field to explain why the tool is blocked.

What MCP server provides get_teams? +

get_teams is provided by the Statbotics MCP server (@withinfocus/statbotics-mcp-server). PolicyLayer sits as a proxy in front of this server to enforce policies before tool calls reach the server.