session_end · Verifiedstate MCP: Risk & Policy

WHAT IT DOES

What session_end does on Verifiedstate

AI agents use session_end to create or update resources in Verifiedstate — usually the action step of a workflow, after the agent has gathered context. Every call changes real data in your Verifiedstate environment.

WHY IT NEEDS A POLICY

Why session_end needs a policy

This tool finalizes a session and generates a summary, which is a write/modification action (creating a summary record, updating session state). It is not destructive since sessions auto-persist without it, meaning calling this doesn't delete anything irreversibly. The severity is low because it is optional and the session data is preserved regardless.

From the tool's definition End the current session with an auto-generated summary. Optional — sessions auto-persist without this.

Attacks that exploit this kind of access

Recommended rule Ready

Verdict

session_end Rate-limited

session_end stays usable, but capped — an agent stuck in a loop can't make hundreds of changes a minute. Everything else on the server is denied unless you say otherwise.

View as policy code

policy.json

{
  "version": "1",
  "default": "deny",
  "tools": {
    "session_end": {
      "limits": [
        {
          "counter": "session_end_rate",
          "window": "minute",
          "max": 30,
          "scope": "grant"
        }
      ]
    }
  }
}

LIMIT THIS TOOL →

Instant setup, no code required.

PolicyLayer is an MCP gateway: every tool call is checked against your rule before it reaches Verifiedstate, so you can run agents against it safely.

FAQ

Questions about session_end

What does the session_end tool do? +

End the current session with an auto-generated summary. Optional — sessions auto-persist without this. It is categorised as a Write tool in the Verifiedstate MCP Server, which means it can create or modify data. Consider rate limits to prevent runaway writes.

How do I enforce a policy on session_end? +

Register the Verifiedstate MCP server in PolicyLayer and add a rule for session_end: allow, deny, rate-limit, or require approval. Point your MCP client at the PolicyLayer proxy URL and the rule is enforced on every call, before it reaches Verifiedstate. Nothing to install.

What risk level is session_end? +

session_end is a Write tool with medium risk. Write tools should be rate-limited to prevent accidental bulk modifications.

Can I rate-limit session_end? +

Yes. Add a rate_limit block to the session_end rule in your PolicyLayer policy. For example, setting max: 10 and window: 60 limits the tool to 10 calls per minute. Rate limits are tracked per agent session and reset automatically.

How do I block session_end completely? +

Set action: deny in the PolicyLayer policy for session_end. The AI agent will receive a policy violation error and cannot call the tool. You can also include a reason field to explain why the tool is blocked.

What MCP server provides session_end? +

session_end is provided by the Verifiedstate MCP server (verifiedstate/verifiedstate-mcp). PolicyLayer sits as a proxy in front of this server to enforce policies before tool calls reach the server.