batch_comment_columns_sql · Dm MCP: Risk & Policy

WHAT IT DOES

What batch_comment_columns_sql does on Dm

AI agents use batch_comment_columns_sql to create or update resources in Dm — usually the action step of a workflow, after the agent has gathered context. Every call changes real data in your Dm environment.

WHY IT NEEDS A POLICY

Why batch_comment_columns_sql needs a policy

COMMENT ON COLUMN is a DDL statement that modifies table/column metadata in the database. This is reversible (comments can be updated or removed), creates no financial impact, and does not delete or execute arbitrary code. It fits the Write category.

From the tool's definition Tool executes 'COMMENT ON COLUMN' statements to batch-update column comments/metadata. The description restricts execution to COMMENT statements (非-destructive, non-financial). The verb '批量执行' (batch execute) confirms write operations on database metadata.

Risk signalsBulk/mass operation — affects multiple targets

Attacks that exploit this kind of access

Recommended rule Ready

Verdict

batch_comment_columns_sql Rate-limited

batch_comment_columns_sql stays usable, but capped — an agent stuck in a loop can't make hundreds of changes a minute. Everything else on the server is denied unless you say otherwise.

View as policy code

policy.json

{
  "version": "1",
  "default": "deny",
  "tools": {
    "batch_comment_columns_sql": {
      "limits": [
        {
          "counter": "batch_comment_columns_sql_rate",
          "window": "minute",
          "max": 30,
          "scope": "grant"
        }
      ]
    }
  }
}

LIMIT THIS TOOL →

Instant setup, no code required.

PolicyLayer is an MCP gateway: every tool call is checked against your rule before it reaches Dm, so you can run agents against it safely.

FAQ

Questions about batch_comment_columns_sql

What does the batch_comment_columns_sql tool do? +

批量执行字段注释 SQL，仅允许 COMMENT ON COLUMN 语句. It is categorised as a Write tool in the Dm MCP Server, which means it can create or modify data. Consider rate limits to prevent runaway writes.

How do I enforce a policy on batch_comment_columns_sql? +

Register the Dm MCP server in PolicyLayer and add a rule for batch_comment_columns_sql: allow, deny, rate-limit, or require approval. Point your MCP client at the PolicyLayer proxy URL and the rule is enforced on every call, before it reaches Dm. Nothing to install.

What risk level is batch_comment_columns_sql? +

batch_comment_columns_sql is a Write tool with medium risk. Write tools should be rate-limited to prevent accidental bulk modifications.

Can I rate-limit batch_comment_columns_sql? +

Yes. Add a rate_limit block to the batch_comment_columns_sql rule in your PolicyLayer policy. For example, setting max: 10 and window: 60 limits the tool to 10 calls per minute. Rate limits are tracked per agent session and reset automatically.

How do I block batch_comment_columns_sql completely? +

Set action: deny in the PolicyLayer policy for batch_comment_columns_sql. The AI agent will receive a policy violation error and cannot call the tool. You can also include a reason field to explain why the tool is blocked.

What MCP server provides batch_comment_columns_sql? +

batch_comment_columns_sql is provided by the Dm MCP server (tgich/dm_mcp_server). PolicyLayer sits as a proxy in front of this server to enforce policies before tool calls reach the server.