Acknowledge channel messages up to a seq (inclusive) as consumed. Call this after channel_read with the highest seq you actually processed (read oldest-first via since_seq and repeat until drained — do not ack past messages you have not seen). Advances your durable read cursor, clears your unread...
AI agents use channel_ack to create or update resources in Wmux — usually the action step of a workflow, after the agent has gathered context. Every call changes real data in your Wmux environment.
This tool modifies state by advancing a read cursor and clearing unread counts, which is a reversible write operation (advance-only cursor update). It does not execute code, delete data, or move money. The blast radius is low since misuse only affects message acknowledgment state.
From the tool's definition Acknowledge channel messages up to a seq (inclusive) as consumed... Advances your durable read cursor, clears your unread count, and stops re-nudges.
Attacks that exploit this kind of access
Acknowledge channel messages up to a seq (inclusive) as consumed. Call this after channel_read with the highest seq you actually processed (read oldest-first via since_seq and repeat until drained — do not ack past messages you have not seen). Advances your durable read cursor, clears your unread count, and stops re-nudges. Advance-only (acking an older seq never rewinds) and clamped to the channel head. Requires member_id to move a cursor; an unknown member_id is an error, and omitting it records read receipts only. It is categorised as a Write tool in the Wmux MCP Server, which means it can create or modify data. Consider rate limits to prevent runaway writes.
Register the Wmux MCP server in PolicyLayer and add a rule for channel_ack: allow, deny, rate-limit, or require approval. Point your MCP client at the PolicyLayer proxy URL and the rule is enforced on every call, before it reaches Wmux. Nothing to install.
channel_ack is a Write tool with medium risk. Write tools should be rate-limited to prevent accidental bulk modifications.
Yes. Add a rate_limit block to the channel_ack rule in your PolicyLayer policy. For example, setting max: 10 and window: 60 limits the tool to 10 calls per minute. Rate limits are tracked per agent session and reset automatically.
Set action: deny in the PolicyLayer policy for channel_ack. The AI agent will receive a policy violation error and cannot call the tool. You can also include a reason field to explain why the tool is blocked.
channel_ack is provided by the Wmux MCP server (openwong2kim/wmux). PolicyLayer sits as a proxy in front of this server to enforce policies before tool calls reach the server.
channel_ack is one line of Wmux's registry record.
The record carries the whole server: verified identity, auth posture, risk grade, every tool classified, recommended policy — re-checked continuously.
Teams ship this data inside their own products. See what a licence covers →