group_sync · OpenCodeHub MCP Server MCP: Risk & Policy

WHAT IT DOES

What group_sync does on OpenCodeHub MCP Server

AI agents use group_sync to create or update resources in OpenCodeHub MCP Server — usually the action step of a workflow, after the agent has gathered context. Every call changes real data in your OpenCodeHub MCP Server environment.

WHY IT NEEDS A POLICY

Why group_sync needs a policy

The tool scans repositories, runs extractors, and writes results to the system. This is a Write operation as it modifies the knowledge graph with new/updated contract data. It does not delete data irreversibly, execute arbitrary user-supplied code, or involve financial transactions.

From the tool's definition 'walk every repo in a named group, run HTTP / gRPC / topic contract extractors, and write' — the tool writes extracted contract data back to the knowledge graph

Risk signalsBulk/mass operation — affects multiple targets

Attacks that exploit this kind of access

Recommended rule Ready

Verdict

group_sync Rate-limited

group_sync stays usable, but capped — an agent stuck in a loop can't make hundreds of changes a minute. Everything else on the server is denied unless you say otherwise.

View as policy code

policy.json

{
  "version": "1",
  "default": "deny",
  "tools": {
    "group_sync": {
      "limits": [
        {
          "counter": "group_sync_rate",
          "window": "minute",
          "max": 30,
          "scope": "grant"
        }
      ]
    }
  }
}

LIMIT THIS TOOL →

Instant setup, no code required.

PolicyLayer is an MCP gateway: every tool call is checked against your rule before it reaches OpenCodeHub MCP Server, so you can run agents against it safely.

FAQ

Questions about group_sync

What does the group_sync tool do? +

Walk every repo in a named group, run HTTP / gRPC / topic contract extractors, and write. It is categorised as a Write tool in the OpenCodeHub MCP Server MCP Server, which means it can create or modify data. Consider rate limits to prevent runaway writes.

How do I enforce a policy on group_sync? +

Register the OpenCodeHub MCP Server MCP server in PolicyLayer and add a rule for group_sync: allow, deny, rate-limit, or require approval. Point your MCP client at the PolicyLayer proxy URL and the rule is enforced on every call, before it reaches OpenCodeHub MCP Server. Nothing to install.

What risk level is group_sync? +

group_sync is a Write tool with medium risk. Write tools should be rate-limited to prevent accidental bulk modifications.

Can I rate-limit group_sync? +

Yes. Add a rate_limit block to the group_sync rule in your PolicyLayer policy. For example, setting max: 10 and window: 60 limits the tool to 10 calls per minute. Rate limits are tracked per agent session and reset automatically.

How do I block group_sync completely? +

Set action: deny in the PolicyLayer policy for group_sync. The AI agent will receive a policy violation error and cannot call the tool. You can also include a reason field to explain why the tool is blocked.

What MCP server provides group_sync? +

group_sync is provided by the OpenCodeHub MCP Server MCP server (theagenticguy/opencodehub). PolicyLayer sits as a proxy in front of this server to enforce policies before tool calls reach the server.