# install_subscription_roles

Install subscription roles (Ludus 2.0 Enterprise only).

Agent View of the PolicyLayer registry record for `install_subscription_roles`. HTML page: https://policylayer.com/tools/tjnull-ludus-fastmcp/install-subscription-roles

## Facts

- Tool: `install_subscription_roles`
- Server: Ludus FastMCP (`tjnull/ludus-fastmcp`) — https://policylayer.com/tools/tjnull-ludus-fastmcp.md
- Homepage: https://github.com/tjnull/Ludus-FastMCP
- Risk category: Write (Medium risk)
- Registry record: grade F, identity unverified
- Server rate-limited: no
- Parameters: 0
- Recommended policy verdict: Rate-limited

## Example call (MCP tools/call, JSON-RPC 2.0)

```json
{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "install_subscription_roles",
    "arguments": {}
  }
}
```

## Why install_subscription_roles is rated Medium

This tool installs (creates/configures) subscription roles, which modifies the state of the system's role-based access control. It is reversible (roles can be uninstalled or reconfigured) and does not irreversibly delete data or execute arbitrary code. However, misconfiguration of subscription roles could impact multiple users' access and permissions, warranting medium severity.

From the tool's own definition: "Tool name 'install_subscription_roles' indicates creation/modification of role configurations. Description states 'Install subscription roles' which is a setup/configuration action that creates or modifies access control settings."

## Use case

AI agents use install_subscription_roles to create or update resources in Ludus FastMCP, usually the action step of a workflow, after the agent has gathered context. Every call changes real data in your Ludus FastMCP environment.

## Recommended policy (PolicyLayer)

Verdict: **Rate-limited**. Enforced by the PolicyLayer MCP gateway (https://policylayer.com/mcp-gateway) before a call reaches Ludus FastMCP:

```json
{
  "version": "1",
  "default": "deny",
  "tools": {
    "install_subscription_roles": {
      "limits": [
        {
          "counter": "install_subscription_roles_rate",
          "window": "minute",
          "max": 30,
          "scope": "grant"
        }
      ]
    }
  }
}
```

## Other tools on Ludus FastMCP (230)

- `abort_and_remove_range` — Destructive — https://policylayer.com/tools/tjnull-ludus-fastmcp/abort-and-remove-range.md
- `abort_range_deployment` — Destructive — https://policylayer.com/tools/tjnull-ludus-fastmcp/abort-range-deployment.md
- `batch_remove_snapshots` — Destructive — https://policylayer.com/tools/tjnull-ludus-fastmcp/batch-remove-snapshots.md
- `cleanup_old_ranges` — Destructive — https://policylayer.com/tools/tjnull-ludus-fastmcp/cleanup-old-ranges.md
- `clear_range_access` — Destructive — https://policylayer.com/tools/tjnull-ludus-fastmcp/clear-range-access.md
- `delete_blueprint` — Destructive — https://policylayer.com/tools/tjnull-ludus-fastmcp/delete-blueprint.md
- `delete_group` — Destructive — https://policylayer.com/tools/tjnull-ludus-fastmcp/delete-group.md
- `delete_range` — Destructive — https://policylayer.com/tools/tjnull-ludus-fastmcp/delete-range.md
- `delete_range_by_user` — Destructive — https://policylayer.com/tools/tjnull-ludus-fastmcp/delete-range-by-user.md
- `delete_range_object` — Destructive — https://policylayer.com/tools/tjnull-ludus-fastmcp/delete-range-object.md
- `delete_ranges_by_status` — Destructive — https://policylayer.com/tools/tjnull-ludus-fastmcp/delete-ranges-by-status.md
- `delete_source` — Destructive — https://policylayer.com/tools/tjnull-ludus-fastmcp/delete-source.md
- `delete_template` — Destructive — https://policylayer.com/tools/tjnull-ludus-fastmcp/delete-template.md
- `destroy_vm` — Destructive — https://policylayer.com/tools/tjnull-ludus-fastmcp/destroy-vm.md
- `remove_ranges_from_group` — Destructive — https://policylayer.com/tools/tjnull-ludus-fastmcp/remove-ranges-from-group.md
- `remove_snapshot` — Destructive — https://policylayer.com/tools/tjnull-ludus-fastmcp/remove-snapshot.md
- `remove_user` — Destructive — https://policylayer.com/tools/tjnull-ludus-fastmcp/remove-user.md
- `remove_users_from_group` — Destructive — https://policylayer.com/tools/tjnull-ludus-fastmcp/remove-users-from-group.md
- `revoke_range_access` — Destructive — https://policylayer.com/tools/tjnull-ludus-fastmcp/revoke-range-access.md
- `revoke_range_from_user` — Destructive — https://policylayer.com/tools/tjnull-ludus-fastmcp/revoke-range-from-user.md
- `rollback_snapshot` — Destructive — https://policylayer.com/tools/tjnull-ludus-fastmcp/rollback-snapshot.md
- `abort_template_build` — Execute — https://policylayer.com/tools/tjnull-ludus-fastmcp/abort-template-build.md
- `apply_adversary_profile` — Execute — https://policylayer.com/tools/tjnull-ludus-fastmcp/apply-adversary-profile.md
- `apply_blueprint_to_range` — Execute — https://policylayer.com/tools/tjnull-ludus-fastmcp/apply-blueprint-to-range.md
- `apply_defender_profile` — Execute — https://policylayer.com/tools/tjnull-ludus-fastmcp/apply-defender-profile.md
- `batch_power_on_hosts` — Execute — https://policylayer.com/tools/tjnull-ludus-fastmcp/batch-power-on-hosts.md
- `batch_snapshot_hosts` — Execute — https://policylayer.com/tools/tjnull-ludus-fastmcp/batch-snapshot-hosts.md
- `build_container_based_template` — Execute — https://policylayer.com/tools/tjnull-ludus-fastmcp/build-container-based-template.md
- `build_range_from_description` — Execute — https://policylayer.com/tools/tjnull-ludus-fastmcp/build-range-from-description.md
- `build_range_from_scratch` — Execute — https://policylayer.com/tools/tjnull-ludus-fastmcp/build-range-from-scratch.md
- …and 200 more: https://policylayer.com/tools/tjnull-ludus-fastmcp.md

## For agents

This record is a snapshot. Live verdicts and the full registry:

- Check every server in your MCP config at once: `npx -y policylayer stack`
- Vet a server before you add it: install the mcp-precheck skill — `npx skills add https://policylayer.com` (skill text: https://policylayer.com/skill.md)
- Query the registry over MCP: endpoint `https://api.policylayer.com/mcp` — tools `check_mcp_server`, `check_mcp_stack`, `check_tool`, `search_registry`, `get_change_events`

---

Source: the PolicyLayer MCP registry — one continuously verified record per MCP server. Full record: https://policylayer.com/registry?q=tjnull-ludus-fastmcp · API: https://policylayer.com/registry/api · Policy library: https://policylayer.com/policies/tjnull-ludus-fastmcp