run_promql · MCP Prometheus MCP: Risk & Policy

WHAT IT DOES

What run_promql does on MCP Prometheus

AI agents invoke run_promql to trigger actions in MCP Prometheus. What it does depends on the arguments the agent supplies, and its effects often reach beyond the immediate call — builds kicked off, notifications sent, workflows started.

WHY IT NEEDS A POLICY

Why run_promql needs a policy

This tool executes custom code (PromQL queries) whose effects depend on user-supplied arguments. While read-only in terms of the monitored systems themselves, it represents Execute rather than Read because: (1) PromQL execution can be computationally expensive and resource-intensive on the Prometheus server, (2) it allows arbitrary query logic that could be exploited for reconnaissance or denial-of-service attacks…

From the tool's definition Tool name 'run_promql' with description 'Run custom PromQL' enables execution of arbitrary Prometheus Query Language queries against monitoring systems.

Attacks that exploit this kind of access

Recommended rule Ready

Verdict

run_promql Rate-limited

run_promql stays usable, but rate-capped — a runaway agent can't fire it dozens of times a minute. Everything else on the server is denied unless you say otherwise.

View as policy code

policy.json

{
  "version": "1",
  "default": "deny",
  "tools": {
    "run_promql": {
      "limits": [
        {
          "counter": "run_promql_rate",
          "window": "minute",
          "max": 10,
          "scope": "grant"
        }
      ]
    }
  }
}

RATE-LIMIT THIS TOOL →

Instant setup, no code required.

PolicyLayer is an MCP gateway: every tool call is checked against your rule before it reaches MCP Prometheus, so you can run agents against it safely.

FAQ

Questions about run_promql

What does the run_promql tool do? +

Run custom PromQL. It is categorised as a Execute tool in the MCP Prometheus MCP Server, which means it can trigger actions or run processes. Use rate limits and argument validation.

How do I enforce a policy on run_promql? +

Register the MCP Prometheus MCP server in PolicyLayer and add a rule for run_promql: allow, deny, rate-limit, or require approval. Point your MCP client at the PolicyLayer proxy URL and the rule is enforced on every call, before it reaches MCP Prometheus. Nothing to install.

What risk level is run_promql? +

run_promql is a Execute tool with high risk. Execute tools should be rate-limited and have argument validation enabled.

Can I rate-limit run_promql? +

Yes. Add a rate_limit block to the run_promql rule in your PolicyLayer policy. For example, setting max: 10 and window: 60 limits the tool to 10 calls per minute. Rate limits are tracked per agent session and reset automatically.

How do I block run_promql completely? +

Set action: deny in the PolicyLayer policy for run_promql. The AI agent will receive a policy violation error and cannot call the tool. You can also include a reason field to explain why the tool is blocked.

What MCP server provides run_promql? +

run_promql is provided by the MCP Prometheus MCP server (yeonkyu-git/mcp-prometheus-loki). PolicyLayer sits as a proxy in front of this server to enforce policies before tool calls reach the server.