# stateset_create_user Creates a new user account. Requires email, name, role, and password. Roles: admin, manager, operator, viewer. Agent View of the PolicyLayer registry record for `stateset_create_user`. HTML page: https://policylayer.com/tools/stateset-mcp-server/stateset-create-user ## Facts - Tool: `stateset_create_user` - Server: Stateset (`stateset/stateset-mcp-server`) — https://policylayer.com/tools/stateset-mcp-server.md - Homepage: https://github.com/stateset/stateset-mcp-server - Risk category: Write (Medium risk) - Registry record: grade F, identity unverified - Server rate-limited: no - Parameters: 0 - Recommended policy verdict: Rate-limited ## Example call (MCP tools/call, JSON-RPC 2.0) ```json { "jsonrpc": "2.0", "id": 1, "method": "tools/call", "params": { "name": "stateset_create_user", "arguments": {} } } ``` ## Why stateset_create_user is rated Medium This tool creates new data (user account) reversibly, fitting the Write category. Severity is high because user creation with role assignment can grant significant system access (including admin roles), and misuse could create unauthorized privileged accounts for persistence or lateral movement. However, it is not Destructive (reversible via account deletion) nor Financial. From the tool's own definition: "Tool description states 'Creates a new user account' with required parameters including role assignment (admin, manager, operator, viewer), which modifies system state by adding a new user with specific permissions." Risk signals: Admin/system-level operation ## Use case AI agents use stateset_create_user to create or update resources in Stateset, usually the action step of a workflow, after the agent has gathered context. Every call changes real data in your Stateset environment. ## Recommended policy (PolicyLayer) Verdict: **Rate-limited**. Enforced by the PolicyLayer MCP gateway (https://policylayer.com/mcp-gateway) before a call reaches Stateset: ```json { "version": "1", "default": "deny", "tools": { "stateset_create_user": { "limits": [ { "counter": "stateset_create_user_rate", "window": "minute", "max": 30, "scope": "grant" } ] } } } ``` ## Other tools on Stateset (237) - `stateset_cancel_asn` — Destructive — https://policylayer.com/tools/stateset-mcp-server/stateset-cancel-asn.md - `stateset_cancel_order` — Destructive — https://policylayer.com/tools/stateset-mcp-server/stateset-cancel-order.md - `stateset_cancel_purchase_order` — Destructive — https://policylayer.com/tools/stateset-mcp-server/stateset-cancel-purchase-order.md - `stateset_cancel_work_order` — Destructive — https://policylayer.com/tools/stateset-mcp-server/stateset-cancel-work-order.md - `stateset_clear_cache` — Destructive — https://policylayer.com/tools/stateset-mcp-server/stateset-clear-cache.md - `stateset_clear_cart` — Destructive — https://policylayer.com/tools/stateset-mcp-server/stateset-clear-cart.md - `stateset_delete_asn` — Destructive — https://policylayer.com/tools/stateset-mcp-server/stateset-delete-asn.md - `stateset_delete_bill_of_materials` — Destructive — https://policylayer.com/tools/stateset-mcp-server/stateset-delete-bill-of-materials.md - `stateset_delete_cart` — Destructive — https://policylayer.com/tools/stateset-mcp-server/stateset-delete-cart.md - `stateset_delete_cash_sale` — Destructive — https://policylayer.com/tools/stateset-mcp-server/stateset-delete-cash-sale.md - `stateset_delete_customer` — Destructive — https://policylayer.com/tools/stateset-mcp-server/stateset-delete-customer.md - `stateset_delete_fulfillment_order` — Destructive — https://policylayer.com/tools/stateset-mcp-server/stateset-delete-fulfillment-order.md - `stateset_delete_inventory` — Destructive — https://policylayer.com/tools/stateset-mcp-server/stateset-delete-inventory.md - `stateset_delete_invoice` — Destructive — https://policylayer.com/tools/stateset-mcp-server/stateset-delete-invoice.md - `stateset_delete_item_receipt` — Destructive — https://policylayer.com/tools/stateset-mcp-server/stateset-delete-item-receipt.md - `stateset_delete_manufacturer_order` — Destructive — https://policylayer.com/tools/stateset-mcp-server/stateset-delete-manufacturer-order.md - `stateset_delete_notification` — Destructive — https://policylayer.com/tools/stateset-mcp-server/stateset-delete-notification.md - `stateset_delete_order` — Destructive — https://policylayer.com/tools/stateset-mcp-server/stateset-delete-order.md - `stateset_delete_payment` — Destructive — https://policylayer.com/tools/stateset-mcp-server/stateset-delete-payment.md - `stateset_delete_product` — Destructive — https://policylayer.com/tools/stateset-mcp-server/stateset-delete-product.md - `stateset_delete_product_variant` — Destructive — https://policylayer.com/tools/stateset-mcp-server/stateset-delete-product-variant.md - `stateset_delete_purchase_order` — Destructive — https://policylayer.com/tools/stateset-mcp-server/stateset-delete-purchase-order.md - `stateset_delete_rma` — Destructive — https://policylayer.com/tools/stateset-mcp-server/stateset-delete-rma.md - `stateset_delete_robot_serial` — Destructive — https://policylayer.com/tools/stateset-mcp-server/stateset-delete-robot-serial.md - `stateset_delete_sales_order` — Destructive — https://policylayer.com/tools/stateset-mcp-server/stateset-delete-sales-order.md - `stateset_delete_shipment` — Destructive — https://policylayer.com/tools/stateset-mcp-server/stateset-delete-shipment.md - `stateset_delete_supplier` — Destructive — https://policylayer.com/tools/stateset-mcp-server/stateset-delete-supplier.md - `stateset_delete_user` — Destructive — https://policylayer.com/tools/stateset-mcp-server/stateset-delete-user.md - `stateset_delete_warranty` — Destructive — https://policylayer.com/tools/stateset-mcp-server/stateset-delete-warranty.md - `stateset_delete_work_order` — Destructive — https://policylayer.com/tools/stateset-mcp-server/stateset-delete-work-order.md - …and 207 more: https://policylayer.com/tools/stateset-mcp-server.md ## For agents This record is a snapshot. Live verdicts and the full registry: - Check every server in your MCP config at once: `npx -y policylayer stack` - Vet a server before you add it: install the mcp-precheck skill — `npx skills add https://policylayer.com` (skill text: https://policylayer.com/skill.md) - Query the registry over MCP: endpoint `https://api.policylayer.com/mcp` — tools `check_mcp_server`, `check_mcp_stack`, `check_tool`, `search_registry`, `get_change_events` --- Source: the PolicyLayer MCP registry — one continuously verified record per MCP server. Full record: https://policylayer.com/registry?q=stateset-mcp-server · API: https://policylayer.com/registry/api · Policy library: https://policylayer.com/policies/stateset-mcp-server