set_secret_safety

What set_secret_safety does on Todos

AI agents use set_secret_safety to create or update resources in Todos, usually the action step of a workflow, after the agent has gathered context. Every call changes real data in your Todos environment.

Why set_secret_safety is rated Medium

This tool creates or modifies redaction safety configurations (regex patterns and object keys) that are stored locally. This is a reversible modification of system configuration, fitting the Write category. Severity is medium because misconfiguration could expose secrets or prevent legitimate redaction, affecting security posture but not directly moving money, deleting data, or executing arbitrary code.

From the tool's definition Tool name "set_secret_safety" with description "Add local secret redaction regex patterns or object key names" indicates creating or modifying redaction configuration. The verb "Add" and action of storing patterns/keys confirms write semantics.

The rule that runs set_secret_safety safely

PolicyLayer is an MCP gateway: it sits between your AI agents and Todos, and checks every tool call against a rule you set before the call runs. Nothing changes on the server itself. For set_secret_safety, this is the rule to start with:

{
  "version": "1",
  "default": "deny",
  "tools": {
    "set_secret_safety": {
      "limits": [
        {
          "counter": "set_secret_safety_rate",
          "window": "minute",
          "max": 30,
          "scope": "grant"
        }
      ]
    }
  }
}

Questions about set_secret_safety