# drive_device_rotate Atomic credential rotation: revoke the old row and mint a new one inheriting label, scopes, and mailbox binding. The new plaintext password is returned in data.password (one-time). The old password stops working immediately. Optional expires_in_days overrides the inherited expiry — omit to keep the original window. Rate-limited 10/hour per account. Use this for scheduled credential rotation, NOT for changing scopes (revoke + create a new one for that). Agent View of the PolicyLayer registry record for `drive_device_rotate`. HTML page: https://policylayer.com/tools/trekmail-mcp-server/drive-device-rotate ## Facts - Tool: `drive_device_rotate` - Server: TrekMail MCP Server (`trekmail/mcp-server`) — https://policylayer.com/tools/trekmail-mcp-server.md - Homepage: https://github.com/trekmail/mcp-server - Risk category: Execute (High risk) - Registry record: grade F, identity unverified - Server rate-limited: no - Parameters: 0 - Recommended policy verdict: Rate-limited ## Example call (MCP tools/call, JSON-RPC 2.0) ```json { "jsonrpc": "2.0", "id": 1, "method": "tools/call", "params": { "name": "drive_device_rotate", "arguments": {} } } ``` ## Why drive_device_rotate is rated High This tool revokes existing credentials and generates new ones atomically. It triggers external operations (credential invalidation and creation) with immediate, partially irreversible effects (old password stops working immediately). From the tool's own definition: "Atomic credential rotation: revoke the old row and mint a new one... The old password stops working immediately." ## Use case AI agents invoke drive_device_rotate to trigger actions in TrekMail MCP Server. What it does depends on the arguments the agent supplies, and its effects often reach beyond the immediate call: builds kicked off, notifications sent, workflows started. ## Recommended policy (PolicyLayer) Verdict: **Rate-limited**. Enforced by the PolicyLayer MCP gateway (https://policylayer.com/mcp-gateway) before a call reaches TrekMail MCP Server: ```json { "version": "1", "default": "deny", "tools": { "drive_device_rotate": { "limits": [ { "counter": "drive_device_rotate_rate", "window": "minute", "max": 10, "scope": "grant" } ] } } } ``` ## Other tools on TrekMail MCP Server (247) - `bulk_action` — Destructive — https://policylayer.com/tools/trekmail-mcp-server/bulk-action.md - `cancel_bulk_migration` — Destructive — https://policylayer.com/tools/trekmail-mcp-server/cancel-bulk-migration.md - `cancel_migration` — Destructive — https://policylayer.com/tools/trekmail-mcp-server/cancel-migration.md - `cancel_scheduled` — Destructive — https://policylayer.com/tools/trekmail-mcp-server/cancel-scheduled.md - `change_mailbox_password` — Destructive — https://policylayer.com/tools/trekmail-mcp-server/change-mailbox-password.md - `confirm_delete_intent` — Destructive — https://policylayer.com/tools/trekmail-mcp-server/confirm-delete-intent.md - `create_delete_intent` — Destructive — https://policylayer.com/tools/trekmail-mcp-server/create-delete-intent.md - `delete_alias` — Destructive — https://policylayer.com/tools/trekmail-mcp-server/delete-alias.md - `delete_bulk_migration` — Destructive — https://policylayer.com/tools/trekmail-mcp-server/delete-bulk-migration.md - `delete_calendar_event` — Destructive — https://policylayer.com/tools/trekmail-mcp-server/delete-calendar-event.md - `delete_cloudflare_token` — Destructive — https://policylayer.com/tools/trekmail-mcp-server/delete-cloudflare-token.md - `delete_contact` — Destructive — https://policylayer.com/tools/trekmail-mcp-server/delete-contact.md - `delete_contact_group` — Destructive — https://policylayer.com/tools/trekmail-mcp-server/delete-contact-group.md - `delete_domain` — Destructive — https://policylayer.com/tools/trekmail-mcp-server/delete-domain.md - `delete_domain_smtp_profile` — Destructive — https://policylayer.com/tools/trekmail-mcp-server/delete-domain-smtp-profile.md - `delete_external_account` — Destructive — https://policylayer.com/tools/trekmail-mcp-server/delete-external-account.md - `delete_folder` — Destructive — https://policylayer.com/tools/trekmail-mcp-server/delete-folder.md - `delete_forwarding_address` — Destructive — https://policylayer.com/tools/trekmail-mcp-server/delete-forwarding-address.md - `delete_identity` — Destructive — https://policylayer.com/tools/trekmail-mcp-server/delete-identity.md - `delete_mail_rule` — Destructive — https://policylayer.com/tools/trekmail-mcp-server/delete-mail-rule.md - `delete_message` — Destructive — https://policylayer.com/tools/trekmail-mcp-server/delete-message.md - `delete_migration` — Destructive — https://policylayer.com/tools/trekmail-mcp-server/delete-migration.md - `delete_smtp_connection` — Destructive — https://policylayer.com/tools/trekmail-mcp-server/delete-smtp-connection.md - `delete_template` — Destructive — https://policylayer.com/tools/trekmail-mcp-server/delete-template.md - `drive_bulk_purge` — Destructive — https://policylayer.com/tools/trekmail-mcp-server/drive-bulk-purge.md - `drive_bulk_trash` — Destructive — https://policylayer.com/tools/trekmail-mcp-server/drive-bulk-trash.md - `drive_device_revoke` — Destructive — https://policylayer.com/tools/trekmail-mcp-server/drive-device-revoke.md - `drive_file_purge` — Destructive — https://policylayer.com/tools/trekmail-mcp-server/drive-file-purge.md - `drive_file_trash` — Destructive — https://policylayer.com/tools/trekmail-mcp-server/drive-file-trash.md - `drive_folder_purge` — Destructive — https://policylayer.com/tools/trekmail-mcp-server/drive-folder-purge.md - …and 217 more: https://policylayer.com/tools/trekmail-mcp-server.md ## For agents This record is a snapshot. Live verdicts and the full registry: - Check every server in your MCP config at once: `npx -y policylayer stack` - Vet a server before you add it: install the mcp-precheck skill — `npx skills add https://policylayer.com` (skill text: https://policylayer.com/skill.md) - Query the registry over MCP: endpoint `https://api.policylayer.com/mcp` — tools `check_mcp_server`, `check_mcp_stack`, `check_tool`, `search_registry`, `get_change_events` --- Source: the PolicyLayer MCP registry — one continuously verified record per MCP server. Full record: https://policylayer.com/registry?q=trekmail-mcp-server · API: https://policylayer.com/registry/api · Policy library: https://policylayer.com/policies/trekmail-mcp-server