update_user

What update_user does on Linode MCP Server

AI agents use update_user to create or update resources in Linode MCP Server, usually the action step of a workflow, after the agent has gathered context. Every call changes real data in your Linode MCP Server environment.

Why update_user is rated Medium

This tool modifies user data (account settings, permissions, profile information) but does not irreversibly delete data or move financial resources. The impact is reversible and scoped to user account updates. Severity is high because unauthorized user updates (especially permission or authentication changes) could compromise account security or enable privilege escalation.

From the tool's definition Tool name 'update_user' and description 'Update a user' indicate modification of user account data. As a sibling to account management tools like 'answer_security_questions' and 'allocate_ip', this operates on reversible user configuration changes within…

The rule that runs update_user safely

PolicyLayer is an MCP gateway: it sits between your AI agents and Linode MCP Server, and checks every tool call against a rule you set before the call runs. Nothing changes on the server itself. For update_user, this is the rule to start with:

{
  "version": "1",
  "default": "deny",
  "tools": {
    "update_user": {
      "limits": [
        {
          "counter": "update_user_rate",
          "window": "minute",
          "max": 30,
          "scope": "grant"
        }
      ]
    }
  }
}

Questions about update_user