# create_or_update_review

Create a new review, edit an existing one, or post a shop reply. Omit \

Agent View of the PolicyLayer registry record for `create_or_update_review`. HTML page: https://policylayer.com/tools/webcake-storefront/create-or-update-review

## Facts

- Tool: `create_or_update_review`
- Server: Webcake Storefront (`webcake-storefront-mcp`) — https://policylayer.com/tools/webcake-storefront.md
- Install: `npx -y webcake-storefront-mcp`
- Homepage: git+https://github.com/vuluu2k/webcake-storefront-mcp.git
- Risk category: Write (Medium risk)
- Registry record: grade F, identity unverified
- Server rate-limited: no
- Parameters: 0
- Recommended policy verdict: Rate-limited

## Example call (MCP tools/call, JSON-RPC 2.0)

```json
{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "create_or_update_review",
    "arguments": {}
  }
}
```

## Why create_or_update_review is rated Medium

This tool creates or modifies review content and shop replies reversibly. While it affects customer-facing data that influences purchasing decisions, it does not delete data irreversibly, move money, or execute arbitrary code. The severity is medium because misuse could damage reputation or manipulate customer perception, but changes can be undone.

From the tool's own definition: "Tool description states 'Create a new review, edit an existing one, or post a shop reply' — explicit create and edit operations on review data."

## Use case

AI agents use create_or_update_review to create or update resources in Webcake Storefront, usually the action step of a workflow, after the agent has gathered context. Every call changes real data in your Webcake Storefront environment.

## Recommended policy (PolicyLayer)

Verdict: **Rate-limited**. Enforced by the PolicyLayer MCP gateway (https://policylayer.com/mcp-gateway) before a call reaches Webcake Storefront:

```json
{
  "version": "1",
  "default": "deny",
  "tools": {
    "create_or_update_review": {
      "limits": [
        {
          "counter": "create_or_update_review_rate",
          "window": "minute",
          "max": 30,
          "scope": "grant"
        }
      ]
    }
  }
}
```

## Other tools on Webcake Storefront (286)

- `clear_page_draft` — Destructive — https://policylayer.com/tools/webcake-storefront/clear-page-draft.md
- `delete_affiliate_accounts` — Destructive — https://policylayer.com/tools/webcake-storefront/delete-affiliate-accounts.md
- `delete_affiliate_products` — Destructive — https://policylayer.com/tools/webcake-storefront/delete-affiliate-products.md
- `delete_appointment_addresses` — Destructive — https://policylayer.com/tools/webcake-storefront/delete-appointment-addresses.md
- `delete_appointment_calendars` — Destructive — https://policylayer.com/tools/webcake-storefront/delete-appointment-calendars.md
- `delete_appointment_classifies` — Destructive — https://policylayer.com/tools/webcake-storefront/delete-appointment-classifies.md
- `delete_appointment_employees` — Destructive — https://policylayer.com/tools/webcake-storefront/delete-appointment-employees.md
- `delete_article` — Destructive — https://policylayer.com/tools/webcake-storefront/delete-article.md
- `delete_automation` — Destructive — https://policylayer.com/tools/webcake-storefront/delete-automation.md
- `delete_collection` — Destructive — https://policylayer.com/tools/webcake-storefront/delete-collection.md
- `delete_contacts` — Destructive — https://policylayer.com/tools/webcake-storefront/delete-contacts.md
- `delete_course` — Destructive — https://policylayer.com/tools/webcake-storefront/delete-course.md
- `delete_courses` — Destructive — https://policylayer.com/tools/webcake-storefront/delete-courses.md
- `delete_domain` — Destructive — https://policylayer.com/tools/webcake-storefront/delete-domain.md
- `delete_employees` — Destructive — https://policylayer.com/tools/webcake-storefront/delete-employees.md
- `delete_global_section` — Destructive — https://policylayer.com/tools/webcake-storefront/delete-global-section.md
- `delete_global_source` — Destructive — https://policylayer.com/tools/webcake-storefront/delete-global-source.md
- `delete_page` — Destructive — https://policylayer.com/tools/webcake-storefront/delete-page.md
- `delete_partner_feeds` — Destructive — https://policylayer.com/tools/webcake-storefront/delete-partner-feeds.md
- `delete_product` — Destructive — https://policylayer.com/tools/webcake-storefront/delete-product.md
- `delete_product_category` — Destructive — https://policylayer.com/tools/webcake-storefront/delete-product-category.md
- `delete_redirect_urls` — Destructive — https://policylayer.com/tools/webcake-storefront/delete-redirect-urls.md
- `delete_saved_filter` — Destructive — https://policylayer.com/tools/webcake-storefront/delete-saved-filter.md
- `delete_site_utms` — Destructive — https://policylayer.com/tools/webcake-storefront/delete-site-utms.md
- `delete_subscribers` — Destructive — https://policylayer.com/tools/webcake-storefront/delete-subscribers.md
- `empty_media_trash` — Destructive — https://policylayer.com/tools/webcake-storefront/empty-media-trash.md
- `remove_font` — Destructive — https://policylayer.com/tools/webcake-storefront/remove-font.md
- `remove_font_group` — Destructive — https://policylayer.com/tools/webcake-storefront/remove-font-group.md
- `remove_reviews` — Destructive — https://policylayer.com/tools/webcake-storefront/remove-reviews.md
- `unblock_all_phone_customers` — Destructive — https://policylayer.com/tools/webcake-storefront/unblock-all-phone-customers.md
- …and 256 more: https://policylayer.com/tools/webcake-storefront.md

## For agents

This record is a snapshot. Live verdicts and the full registry:

- Check every server in your MCP config at once: `npx -y policylayer stack`
- Vet a server before you add it: install the mcp-precheck skill — `npx skills add https://policylayer.com` (skill text: https://policylayer.com/skill.md)
- Query the registry over MCP: endpoint `https://api.policylayer.com/mcp` — tools `check_mcp_server`, `check_mcp_stack`, `check_tool`, `search_registry`, `get_change_events`

---

Source: the PolicyLayer MCP registry — one continuously verified record per MCP server. Full record: https://policylayer.com/registry?q=webcake-storefront · API: https://policylayer.com/registry/api · Policy library: https://policylayer.com/policies/webcake-storefront