Write or replace freeform notes on a database. Use this to record conventions, valid enum values, data formatting rules, and anything a future session needs to know to use this database correctly. Notes are returned by describe_database.
AI agents use update_database_notes to create or update resources in Instant Db — usually the action step of a workflow, after the agent has gathered context. Every call changes real data in your Instant Db environment.
This tool creates or modifies freeform notes/metadata on a database. It is reversible (notes can be overwritten or updated), has no data deletion capability, and does not execute code or move money. The blast radius is minimal—notes are informational metadata, and any misuse (e.g., writing misleading documentation) would only confuse future sessions without corrupting actual data or triggering destructive operations.
From the tool's definition Tool description states 'Write or replace freeform notes on a database' - explicitly a write operation that modifies metadata associated with a database.
Attacks that exploit this kind of access
Write or replace freeform notes on a database. Use this to record conventions, valid enum values, data formatting rules, and anything a future session needs to know to use this database correctly. Notes are returned by describe_database. It is categorised as a Write tool in the Instant Db MCP Server, which means it can create or modify data. Consider rate limits to prevent runaway writes.
Register the Instant Db MCP server in PolicyLayer and add a rule for update_database_notes: allow, deny, rate-limit, or require approval. Point your MCP client at the PolicyLayer proxy URL and the rule is enforced on every call, before it reaches Instant Db. Nothing to install.
update_database_notes is a Write tool with medium risk. Write tools should be rate-limited to prevent accidental bulk modifications.
Yes. Add a rate_limit block to the update_database_notes rule in your PolicyLayer policy. For example, setting max: 10 and window: 60 limits the tool to 10 calls per minute. Rate limits are tracked per agent session and reset automatically.
Set action: deny in the PolicyLayer policy for update_database_notes. The AI agent will receive a policy violation error and cannot call the tool. You can also include a reason field to explain why the tool is blocked.
update_database_notes is provided by the Instant Db MCP server (urbushey/mcp-db). PolicyLayer sits as a proxy in front of this server to enforce policies before tool calls reach the server.
Every MCP server has a record like this.
Type a name, get the same breakdown: verified identity, auth posture, risk grade, capabilities, recommended policy.
Teams ship this data inside their own products. See what a licence covers →