# rotate_mailbox_app_password

Replace an app password with a new secret under the same name. The old secret stops working at once and the mail apps using it are signed out until the user enters the new one. Returns the new row (new data.id) with data.password once, plus replaced_id. ${ONE_TIME_SECRET_HANDLING} Use this when the user lost the password or wants a fresh one; to stop a device for good, use revoke_mailbox_app_password. Fails with conflict if the app password was already revoked.

Agent View of the PolicyLayer registry record for `rotate_mailbox_app_password`. HTML page: https://policylayer.com/tools/trekmail-mcp-server/rotate-mailbox-app-password

## Facts

- Tool: `rotate_mailbox_app_password`
- Server: TrekMail MCP Server (`trekmail/mcp-server`) — https://policylayer.com/tools/trekmail-mcp-server.md
- Homepage: https://github.com/trekmail/mcp-server
- Risk category: Write (Medium risk)
- Registry record: grade F, identity unverified
- Server rate-limited: no
- Parameters: 0
- Recommended policy verdict: Rate-limited

## Example call (MCP tools/call, JSON-RPC 2.0)

```json
{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "rotate_mailbox_app_password",
    "arguments": {}
  }
}
```

## Why rotate_mailbox_app_password is rated Medium

Modifies mailbox credentials reversibly; high blast radius due to account access disruption and credential exposure.

From the tool's own definition: "Replace app password with new secret, old secret stops working, mail apps signed out"

## Use case

AI agents use rotate_mailbox_app_password to create or update resources in TrekMail MCP Server, usually the action step of a workflow, after the agent has gathered context. Every call changes real data in your TrekMail MCP Server environment.

## Recommended policy (PolicyLayer)

Verdict: **Rate-limited**. Enforced by the PolicyLayer MCP gateway (https://policylayer.com/mcp-gateway) before a call reaches TrekMail MCP Server:

```json
{
  "version": "1",
  "default": "deny",
  "tools": {
    "rotate_mailbox_app_password": {
      "limits": [
        {
          "counter": "rotate_mailbox_app_password_rate",
          "window": "minute",
          "max": 30,
          "scope": "grant"
        }
      ]
    }
  }
}
```

## Other tools on TrekMail MCP Server (284)

- `bulk_action` — Destructive — https://policylayer.com/tools/trekmail-mcp-server/bulk-action.md
- `cancel_bulk_migration` — Destructive — https://policylayer.com/tools/trekmail-mcp-server/cancel-bulk-migration.md
- `cancel_migration` — Destructive — https://policylayer.com/tools/trekmail-mcp-server/cancel-migration.md
- `cancel_scheduled` — Destructive — https://policylayer.com/tools/trekmail-mcp-server/cancel-scheduled.md
- `change_mailbox_password` — Destructive — https://policylayer.com/tools/trekmail-mcp-server/change-mailbox-password.md
- `confirm_delete_intent` — Destructive — https://policylayer.com/tools/trekmail-mcp-server/confirm-delete-intent.md
- `consume_private_note_encrypted` — Destructive — https://policylayer.com/tools/trekmail-mcp-server/consume-private-note-encrypted.md
- `convert_mailbox_to_shared` — Destructive — https://policylayer.com/tools/trekmail-mcp-server/convert-mailbox-to-shared.md
- `create_delete_intent` — Destructive — https://policylayer.com/tools/trekmail-mcp-server/create-delete-intent.md
- `delete_alias` — Destructive — https://policylayer.com/tools/trekmail-mcp-server/delete-alias.md
- `delete_bulk_migration` — Destructive — https://policylayer.com/tools/trekmail-mcp-server/delete-bulk-migration.md
- `delete_calendar_event` — Destructive — https://policylayer.com/tools/trekmail-mcp-server/delete-calendar-event.md
- `delete_cloudflare_token` — Destructive — https://policylayer.com/tools/trekmail-mcp-server/delete-cloudflare-token.md
- `delete_contact` — Destructive — https://policylayer.com/tools/trekmail-mcp-server/delete-contact.md
- `delete_contact_group` — Destructive — https://policylayer.com/tools/trekmail-mcp-server/delete-contact-group.md
- `delete_domain` — Destructive — https://policylayer.com/tools/trekmail-mcp-server/delete-domain.md
- `delete_domain_smtp_profile` — Destructive — https://policylayer.com/tools/trekmail-mcp-server/delete-domain-smtp-profile.md
- `delete_external_account` — Destructive — https://policylayer.com/tools/trekmail-mcp-server/delete-external-account.md
- `delete_folder` — Destructive — https://policylayer.com/tools/trekmail-mcp-server/delete-folder.md
- `delete_forwarding_address` — Destructive — https://policylayer.com/tools/trekmail-mcp-server/delete-forwarding-address.md
- `delete_identity` — Destructive — https://policylayer.com/tools/trekmail-mcp-server/delete-identity.md
- `delete_mail_rule` — Destructive — https://policylayer.com/tools/trekmail-mcp-server/delete-mail-rule.md
- `delete_message` — Destructive — https://policylayer.com/tools/trekmail-mcp-server/delete-message.md
- `delete_migration` — Destructive — https://policylayer.com/tools/trekmail-mcp-server/delete-migration.md
- `delete_smtp_connection` — Destructive — https://policylayer.com/tools/trekmail-mcp-server/delete-smtp-connection.md
- `delete_template` — Destructive — https://policylayer.com/tools/trekmail-mcp-server/delete-template.md
- `drive_bulk_purge` — Destructive — https://policylayer.com/tools/trekmail-mcp-server/drive-bulk-purge.md
- `drive_bulk_trash` — Destructive — https://policylayer.com/tools/trekmail-mcp-server/drive-bulk-trash.md
- `drive_device_revoke` — Destructive — https://policylayer.com/tools/trekmail-mcp-server/drive-device-revoke.md
- `drive_file_purge` — Destructive — https://policylayer.com/tools/trekmail-mcp-server/drive-file-purge.md
- …and 254 more: https://policylayer.com/tools/trekmail-mcp-server.md

## For agents

This record is a snapshot. Live verdicts and the full registry:

- Check every server in your MCP config at once: `npx -y policylayer stack`
- Vet a server before you add it: install the mcp-precheck skill — `npx skills add https://policylayer.com` (skill text: https://policylayer.com/skill.md)
- Query the registry over MCP: endpoint `https://api.policylayer.com/mcp` — tools `check_mcp_server`, `check_mcp_stack`, `check_tool`, `search_registry`, `get_change_events`

---

Source: the PolicyLayer MCP registry — one continuously verified record per MCP server. Full record: https://policylayer.com/registry?q=trekmail-mcp-server · API: https://policylayer.com/registry/api · Policy library: https://policylayer.com/policies/trekmail-mcp-server