create_gift · Token of Esteem MCP: Risk & Policy

WHAT IT DOES

What create_gift does on Token of Esteem

AI agents use create_gift to commit financial operations through Token of Esteem — usually the final step of a payment, billing, or trading workflow. A call moves real money.

WHY IT NEEDS A POLICY

Why create_gift needs a policy

This tool directly initiates a purchase and charges a payment method, making it a Financial action. Misuse by an AI agent could result in unauthorized charges for physical print gifts, which are irreversible financial commitments. The blast radius is critical because charges are real-money transactions that may be difficult to reverse (especially once a print job is commissioned).

From the tool's definition 'place the order. Charges the buyer.' — explicitly commits a financial transaction by charging the buyer

Attacks that exploit this kind of access

Recommended rule Ready

Verdict

create_gift Approval-gated

Any call to create_gift is blocked until a human approves it. The rest of the server keeps working.

View as policy code

policy.json

{
  "version": "1",
  "default": "deny",
  "tools": {
    "create_gift": {
      "deny_if": [
        {
          "conditions": [],
          "on_deny": "Requires human approval."
        }
      ]
    }
  }
}

GATE THIS TOOL →

Instant setup, no code required.

PolicyLayer is an MCP gateway: every tool call is checked against your rule before it reaches Token of Esteem, so you can run agents against it safely.

FAQ

Questions about create_gift

What does the create_gift tool do? +

place the order. Charges the buyer. It is categorised as a Financial tool in the Token of Esteem MCP Server, which means it involves financial transactions. Block by default and require explicit approval.

How do I enforce a policy on create_gift? +

Register the Token of Esteem MCP server in PolicyLayer and add a rule for create_gift: allow, deny, rate-limit, or require approval. Point your MCP client at the PolicyLayer proxy URL and the rule is enforced on every call, before it reaches Token of Esteem. Nothing to install.

What risk level is create_gift? +

create_gift is a Financial tool with critical risk. Critical-risk tools should be blocked by default and only enabled with explicit human approval.

Can I rate-limit create_gift? +

Yes. Add a rate_limit block to the create_gift rule in your PolicyLayer policy. For example, setting max: 10 and window: 60 limits the tool to 10 calls per minute. Rate limits are tracked per agent session and reset automatically.

How do I block create_gift completely? +

Set action: deny in the PolicyLayer policy for create_gift. The AI agent will receive a policy violation error and cannot call the tool. You can also include a reason field to explain why the tool is blocked.

What MCP server provides create_gift? +

create_gift is provided by the Token of Esteem MCP server (tokenofesteem/mcp). PolicyLayer sits as a proxy in front of this server to enforce policies before tool calls reach the server.