Vulnify MCP

Official

Overview Schema Source Related Servers Discussions Admin

Decide action

decide_action

Check proposed tool or connector actions before sending, exporting, deleting, or writing records; returns ALLOW, REVIEW, or BLOCK and records an audit decision in Vulnify.

Instructions

Call this before a consequential action with any tool or connector: sending an email or message, exporting or sharing data, deleting data, writing to production or financial records, payments, or external API writes. ALLOW: proceed. REVIEW: hold the action, tell the user it waits for approval in Vulnify, and check again with get_decision. BLOCK: skip the action and explain the reasons. Records a decision for a proposed action (POST /v1/events). This writes a security event and an audit entry, counts toward the organization quota, and may open a human review. The finalDecision field is the authoritative result. decision is what was stored and does not change when a review is resolved. finalDecision stays REVIEW until a human approves, denies, or the review expires. This tool does not approve the review. A REVIEW or BLOCK finalDecision means the action was not allowed. Optional content is scanned in memory and is not stored. An idempotencyKey makes a retry return the same event.

Input Schema

TableJSON Schema

Name	Required	Description
`agent`	No	Agent name. Omit only when the API key is bound to an agent. Use this or agentId.
`action`	Yes	Event action. Allowed values: READ_DATA, WRITE_DATA, DELETE_DATA, EXPORT_DATA, SEND_EMAIL.
`agentId`	No	Agent id. Use this or agent.
`content`	No	Optional text scanned for sensitive data. Scanned in memory by Vulnify and not stored. This server does not log it.
`resource`	No	Resource name. Use this or resourceId.
`resourceId`	No	Resource id. Use this or resource.
`destination`	No	Where the data goes. Allowed values: INTERNAL, EXTERNAL_EMAIL, EXTERNAL_API.
`idempotencyKey`	No	Retries with the same key return the stored decision for 24 hours instead of recording another event.
`recordsAffected`	No	How many records the action would touch. Optional. 0 to 100000000.

Output Schema

TableJSON Schema

Name	Required	Description	Default
`id`	Yes	Decision id.
`finalDecision`	Yes	Authoritative result. Allowed values: ALLOW, REVIEW, BLOCK.

Schema Changelog

Changes observed during successful MCP inspections.

First observedv0.1.5Oct 17, 2026

TDQS

A4.6/5.0

Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With annotations only covering broad hints, the description carries the load and does so richly: it writes a security event and audit entry, consumes organization quota, may trigger human review, does not itself approve reviews, and content is scanned in memory and not stored. The idempotencyKey explanation (same key returns stored decision for 24h) refines rather than contradicts idempotentHint=false, which describes default behavior.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded with the trigger condition and the outcome-to-action mapping, which is the highest-value content. It is dense and somewhat long, but nearly every sentence (finalDecision vs decision, REVIEW persistence, idempotency) adds decision-relevant information rather than padding.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a consequential gating tool with an output schema present, the description still explains the return semantics (finalDecision is authoritative; decision does not change on resolution; REVIEW/BLOCK mean the action was not allowed). Combined with full schema coverage, nothing an agent needs to call it correctly is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already documents all 9 parameters, including the enum values and idempotencyKey behavior. The description's mentions of content scanning and idempotency largely restate schema text, so this is correctly a baseline 3.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Opens with a specific trigger ('Call this before a consequential action with any tool or connector') and states the resource is a recorded decision for a proposed action (POST /v1/events). An agent can distinguish it from siblings like get_decision and check_action without opening a schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly enumerates when to call it (sending email/messages, exporting/sharing data, deleting, production/financial writes, payments, external API writes) and prescribes per-outcome behavior for ALLOW, REVIEW, and BLOCK, including the follow-up call to get_decision. Nothing is left to inference.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Deploy Server