从ERP系统导出贷款合同明细Excel文件。必须先调用 brand_select 获取 brandId，再调用 branch_select 获取 branchId 和 cityCode。确认城市公司（必填，支持多选）、确认时间维度（选填，默认报单日期）、确认时间范围（选填，不指定则默认本月含今天；单次最长365天，超出时提示用户缩短范围或分批导出）。确认贷款类型（选填，多选，可选值: 1=商业贷款, 2=公积金贷款, 4=组合贷款，不传则不按贷款类型筛选）。
AI agents call loan_contract to retrieve information from Yjzf without modifying anything — typically the context-gathering step in research, monitoring, and reporting workflows, before the agent takes action elsewhere.
| Parameter | Type | Required | Description |
|---|---|---|---|
endTm | number | — | 结束时间(毫秒时间戳)。用户有指定日期时，必须先调用 get_current_time 获取当前时间作为参考，再用 date_to_timestamp(endOfDay=true) 转换，严禁自行估算。不传默认今天结束。时间范围最长不超过365天,超出时提示用户缩短范围或分批导出 |
brandId | string | Yes | 品牌ID，必须通过 brand_select 工具获取，禁止自行编造 |
startTm | number | — | 开始时间(毫秒时间戳)。用户有指定日期时，必须先调用 get_current_time 获取当前时间作为参考，再用 date_to_timestamp 转换，严禁自行估算。不传默认本月第一天。时间范围最长不超过365天,超出时提示用户缩短范围或分批导出 |
branchId | string | Yes | 城市公司ID(即organId)，必须通过 branch_select 工具获取，禁止自行编造 |
cityCode | string | Yes | 城市编码，必须通过 branch_select 工具获取，禁止自行编造 |
timeType | number | — | 时间维度（单选），选填。可选值: 1=报单日期, 2=面签日期（银行）, 7=面签日期（公积金）, 3=上报日期, 4=审批日期（银行）, 8=审批日期（公积金）, 5=抵押日期, 6=放款日期（银行）, 9=放款日期（公积金）。不传默认1（报单日期） |
branchName | string | Yes | 城市公司名称（用于文件命名），必须通过 branch_select 工具获取，禁止自行编造 |
loanTypeList | array | — | 贷款类型（多选），选填。可选值: 1=商业贷款, 2=公积金贷款, 4=组合贷款。可多选，工具内部会将选中值求和后传给ERP。不传则不按贷款类型筛选 |
Parameters from the server's own tool schema.
The tool exports/reads loan contract data from an ERP system into an Excel file. It retrieves existing records based on filters (city, time range, loan type) without modifying any data. However, severity is medium because loan contract data is sensitive financial information that could be misused if exposed inappropriately.
From the tool's definition 从ERP系统导出贷款合同明细Excel文件 (exports loan contract details Excel file from ERP system)
Attacks that exploit this kind of access
从ERP系统导出贷款合同明细Excel文件。必须先调用 brand_select 获取 brandId，再调用 branch_select 获取 branchId 和 cityCode。确认城市公司（必填，支持多选）、确认时间维度（选填，默认报单日期）、确认时间范围（选填，不指定则默认本月含今天；单次最长365天，超出时提示用户缩短范围或分批导出）。确认贷款类型（选填，多选，可选值: 1=商业贷款, 2=公积金贷款, 4=组合贷款，不传则不按贷款类型筛选）。. It is categorised as a Read tool in the Yjzf MCP Server, which means it retrieves data without modifying state.
loan_contract accepts 8 parameters: endTm, brandId, startTm, branchId, cityCode, timeType, branchName, loanTypeList. Required: brandId, branchId, cityCode, branchName. The full parameter table on this page comes from the server's own tool schema.
Register the Yjzf MCP server in PolicyLayer and add a rule for loan_contract: allow, deny, rate-limit, or require approval. Point your MCP client at the PolicyLayer proxy URL and the rule is enforced on every call, before it reaches Yjzf. Nothing to install.
loan_contract is a Read tool with low risk. Read-only tools are generally safe to allow by default.
Yes. Add a rate_limit block to the loan_contract rule in your PolicyLayer policy. For example, setting max: 10 and window: 60 limits the tool to 10 calls per minute. Rate limits are tracked per agent session and reset automatically.
Set action: deny in the PolicyLayer policy for loan_contract. The AI agent will receive a policy violation error and cannot call the tool. You can also include a reason field to explain why the tool is blocked.
loan_contract is provided by the Yjzf MCP server (@yjzf/mcp-server-yjzf). PolicyLayer sits as a proxy in front of this server to enforce policies before tool calls reach the server.
loan_contract is one line of Yjzf's registry record.
The record carries the whole server: verified identity, auth posture, risk grade, every tool classified, recommended policy — re-checked continuously.
Teams ship this data inside their own products. See what a licence covers →