build_entree · Mcp Otle MCP: Risk & Policy

WHAT IT DOES

What build_entree does on Mcp Otle

AI agents use build_entree to create or update resources in Mcp Otle — usually the action step of a workflow, after the agent has gathered context. Every call changes real data in your Mcp Otle environment.

WHY IT NEEDS A POLICY

Why build_entree needs a policy

This tool builds/creates an entree as part of an order, which is a Write operation (creating order data). While the server description mentions 'order simulation,' the tool is described as 'the core of any order,' suggesting it may contribute to an actual order placement. Severity is medium because misuse could lead to unintended orders, though the simulation framing slightly reduces the blast radius.

From the tool's definition 'Build a Chipotle entree with your preferred ingredients. This is the core of any order.' — creates/constructs an order item

Attacks that exploit this kind of access

Recommended rule Ready

Verdict

build_entree Rate-limited

build_entree stays usable, but capped — an agent stuck in a loop can't make hundreds of changes a minute. Everything else on the server is denied unless you say otherwise.

View as policy code

policy.json

{
  "version": "1",
  "default": "deny",
  "tools": {
    "build_entree": {
      "limits": [
        {
          "counter": "build_entree_rate",
          "window": "minute",
          "max": 30,
          "scope": "grant"
        }
      ]
    }
  }
}

LIMIT THIS TOOL →

Instant setup, no code required.

PolicyLayer is an MCP gateway: every tool call is checked against your rule before it reaches Mcp Otle, so you can run agents against it safely.

FAQ

Questions about build_entree

What does the build_entree tool do? +

Build a Chipotle entree with your preferred ingredients. This is the core of any order. It is categorised as a Write tool in the Mcp Otle MCP Server, which means it can create or modify data. Consider rate limits to prevent runaway writes.

How do I enforce a policy on build_entree? +

Register the Mcp Otle MCP server in PolicyLayer and add a rule for build_entree: allow, deny, rate-limit, or require approval. Point your MCP client at the PolicyLayer proxy URL and the rule is enforced on every call, before it reaches Mcp Otle. Nothing to install.

What risk level is build_entree? +

build_entree is a Write tool with medium risk. Write tools should be rate-limited to prevent accidental bulk modifications.

Can I rate-limit build_entree? +

Yes. Add a rate_limit block to the build_entree rule in your PolicyLayer policy. For example, setting max: 10 and window: 60 limits the tool to 10 calls per minute. Rate limits are tracked per agent session and reset automatically.

How do I block build_entree completely? +

Set action: deny in the PolicyLayer policy for build_entree. The AI agent will receive a policy violation error and cannot call the tool. You can also include a reason field to explain why the tool is blocked.

What MCP server provides build_entree? +

build_entree is provided by the Mcp Otle MCP server (yoshisaurus/mcp-otle). PolicyLayer sits as a proxy in front of this server to enforce policies before tool calls reach the server.