vora_register · Vora MCP: Risk & Policy

WHAT IT DOES

What vora_register does on Vora

AI agents use vora_register to create or update resources in Vora — usually the action step of a workflow, after the agent has gathered context. Every call changes real data in your Vora environment.

WHY IT NEEDS A POLICY

Why vora_register needs a policy

This tool creates new account records and modifies user profile data (business info, products, customers, objectives). While it does not delete, execute arbitrary code, or move money, it does irreversibly create persistent records and configuration state. This is a Write operation—data creation with side effects—rather than a Read operation.

From the tool's definition Tool 'creates' or 'registers' a Vora account and 'builds a rich profile' through conversational onboarding. The description explicitly states it produces account setup and profile data modifications.

Attacks that exploit this kind of access

Recommended rule Ready

Verdict

vora_register Rate-limited

vora_register stays usable, but capped — an agent stuck in a loop can't make hundreds of changes a minute. Everything else on the server is denied unless you say otherwise.

View as policy code

policy.json

{
  "version": "1",
  "default": "deny",
  "tools": {
    "vora_register": {
      "limits": [
        {
          "counter": "vora_register_rate",
          "window": "minute",
          "max": 30,
          "scope": "grant"
        }
      ]
    }
  }
}

LIMIT THIS TOOL →

Instant setup, no code required.

PolicyLayer is an MCP gateway: every tool call is checked against your rule before it reaches Vora, so you can run agents against it safely.

FAQ

Questions about vora_register

What does the vora_register tool do? +

Create your Vora account through conversational onboarding. Vora asks you questions about your business, products, target customers, and objectives to build a rich profile. This produces dramatically better voice agents than one-shot configuration. Multi-turn: call this tool, answer the returned questions, call again with your answers. Repeat until status is. It is categorised as a Write tool in the Vora MCP Server, which means it can create or modify data. Consider rate limits to prevent runaway writes.

How do I enforce a policy on vora_register? +

Register the Vora MCP server in PolicyLayer and add a rule for vora_register: allow, deny, rate-limit, or require approval. Point your MCP client at the PolicyLayer proxy URL and the rule is enforced on every call, before it reaches Vora. Nothing to install.

What risk level is vora_register? +

vora_register is a Write tool with medium risk. Write tools should be rate-limited to prevent accidental bulk modifications.

Can I rate-limit vora_register? +

Yes. Add a rate_limit block to the vora_register rule in your PolicyLayer policy. For example, setting max: 10 and window: 60 limits the tool to 10 calls per minute. Rate limits are tracked per agent session and reset automatically.

How do I block vora_register completely? +

Set action: deny in the PolicyLayer policy for vora_register. The AI agent will receive a policy violation error and cannot call the tool. You can also include a reason field to explain why the tool is blocked.

What MCP server provides vora_register? +

vora_register is provided by the Vora MCP server (stefanstojanovicstefa-creator/vora-voice-mcp). PolicyLayer sits as a proxy in front of this server to enforce policies before tool calls reach the server.