rawCall · Luckin Mcp Proxy MCP: Risk & Policy

WHAT IT DOES

What rawCall does on Luckin Mcp Proxy

AI agents invoke rawCall to trigger actions in Luckin Mcp Proxy. What it does depends on the arguments the agent supplies, and its effects often reach beyond the immediate call — builds kicked off, notifications sent, workflows started.

WHY IT NEEDS A POLICY

Why rawCall needs a policy

This is a debug backdoor that directly proxies calls to raw upstream MCP tools, including cancelOrder and previewOrder. The tool can execute arbitrary upstream operations depending on arguments, spanning Read, Write, and Destructive actions (cancelOrder is irreversible).

From the tool's definition 调试后门：直接透传调用瑞幸原始 MCP 工具（queryShopList/searchProductForMcp/queryProductDetailInfo/previewOrder/cancelOrder/queryOrderDetailInfo/switchProduct）

Attacks that exploit this kind of access

Recommended rule Ready

Verdict

rawCall Rate-limited

rawCall stays usable, but rate-capped — a runaway agent can't fire it dozens of times a minute. Everything else on the server is denied unless you say otherwise.

View as policy code

policy.json

{
  "version": "1",
  "default": "deny",
  "tools": {
    "rawCall": {
      "limits": [
        {
          "counter": "rawcall_rate",
          "window": "minute",
          "max": 10,
          "scope": "grant"
        }
      ]
    }
  }
}

RATE-LIMIT THIS TOOL →

Instant setup, no code required.

PolicyLayer is an MCP gateway: every tool call is checked against your rule before it reaches Luckin Mcp Proxy, so you can run agents against it safely.

FAQ

Questions about rawCall

What does the rawCall tool do? +

调试后门：直接透传调用瑞幸原始 MCP 工具（queryShopList/searchProductForMcp/queryProductDetailInfo/previewOrder/cancelOrder/queryOrderDetailInfo/switchProduct）。不允许 createOrder，下单必须走 quickOrder → confirmOrder。. It is categorised as a Execute tool in the Luckin Mcp Proxy MCP Server, which means it can trigger actions or run processes. Use rate limits and argument validation.

How do I enforce a policy on rawCall? +

Register the Luckin Mcp Proxy MCP server in PolicyLayer and add a rule for rawCall: allow, deny, rate-limit, or require approval. Point your MCP client at the PolicyLayer proxy URL and the rule is enforced on every call, before it reaches Luckin Mcp Proxy. Nothing to install.

What risk level is rawCall? +

rawCall is a Execute tool with high risk. Execute tools should be rate-limited and have argument validation enabled.

Can I rate-limit rawCall? +

Yes. Add a rate_limit block to the rawCall rule in your PolicyLayer policy. For example, setting max: 10 and window: 60 limits the tool to 10 calls per minute. Rate limits are tracked per agent session and reset automatically.

How do I block rawCall completely? +

Set action: deny in the PolicyLayer policy for rawCall. The AI agent will receive a policy violation error and cannot call the tool. You can also include a reason field to explain why the tool is blocked.

What MCP server provides rawCall? +

rawCall is provided by the Luckin Mcp Proxy MCP server (wyhacc/luckin-mcp-proxy). PolicyLayer sits as a proxy in front of this server to enforce policies before tool calls reach the server.