pendo_track_event · Yocoolab MCP: Risk & Policy

WHAT IT DOES

What pendo_track_event does on Yocoolab

AI agents use pendo_track_event to create or update resources in Yocoolab — usually the action step of a workflow, after the agent has gathered context. Every call changes real data in your Yocoolab environment.

WHY IT NEEDS A POLICY

Why pendo_track_event needs a policy

This tool creates analytics records in Pendo, a third-party service, which is a form of data creation/modification. While not destructive (records can typically be archived or filtered), and not involving financial transactions, it does write external tracking data.

From the tool's definition 'Send a custom track event to Pendo' — the tool writes tracking data to an external analytics service. Actions tracked include 'feedback resolved' and 'PR created', indicating it records state changes and user actions.

Attacks that exploit this kind of access

Recommended rule Ready

Verdict

pendo_track_event Rate-limited

pendo_track_event stays usable, but capped — an agent stuck in a loop can't make hundreds of changes a minute. Everything else on the server is denied unless you say otherwise.

View as policy code

policy.json

{
  "version": "1",
  "default": "deny",
  "tools": {
    "pendo_track_event": {
      "limits": [
        {
          "counter": "pendo_track_event_rate",
          "window": "minute",
          "max": 30,
          "scope": "grant"
        }
      ]
    }
  }
}

LIMIT THIS TOOL →

Instant setup, no code required.

PolicyLayer is an MCP gateway: every tool call is checked against your rule before it reaches Yocoolab, so you can run agents against it safely.

FAQ

Questions about pendo_track_event

What does the pendo_track_event tool do? +

Send a custom track event to Pendo. Use this to track actions like feedback resolved, PR created from feedback, or guide suggestions. It is categorised as a Write tool in the Yocoolab MCP Server, which means it can create or modify data. Consider rate limits to prevent runaway writes.

How do I enforce a policy on pendo_track_event? +

Register the Yocoolab MCP server in PolicyLayer and add a rule for pendo_track_event: allow, deny, rate-limit, or require approval. Point your MCP client at the PolicyLayer proxy URL and the rule is enforced on every call, before it reaches Yocoolab. Nothing to install.

What risk level is pendo_track_event? +

pendo_track_event is a Write tool with medium risk. Write tools should be rate-limited to prevent accidental bulk modifications.

Can I rate-limit pendo_track_event? +

Yes. Add a rate_limit block to the pendo_track_event rule in your PolicyLayer policy. For example, setting max: 10 and window: 60 limits the tool to 10 calls per minute. Rate limits are tracked per agent session and reset automatically.

How do I block pendo_track_event completely? +

Set action: deny in the PolicyLayer policy for pendo_track_event. The AI agent will receive a policy violation error and cannot call the tool. You can also include a reason field to explain why the tool is blocked.

What MCP server provides pendo_track_event? +

pendo_track_event is provided by the Yocoolab MCP server (yocoolab/mcp-server). PolicyLayer sits as a proxy in front of this server to enforce policies before tool calls reach the server.