Limits & Troubleshooting
What the assistant can’t do
The assistant only edits the workspace diagram. It cannot plan, apply, destroy, detect drift, or import resources — those stay in the Paxper dashboard.
- No plan, apply, destroy, drift detection, or import from the assistant — diagram edits only.
- 30 edit calls per minute per connection. If you hit the limit, the assistant gets a “Too many edits” error — wait a minute and retry. A call refused by the field checks before anything is written (e.g. trying to set a connection field, a subnet value the resource can’t use, or a redacted secret) doesn’t count toward this limit. A call rejected by the diagram validation (e.g. a missing required connection or an invalid value) does count.
- Edits are refused while a plan or apply is already running on the workspace.
- Locked resources on the canvas can’t be edited.
- Container resources with children can’t be removed (e.g. a VPC that still has subnets or instances in it).
- An RDS/DB instance’s subnets are chosen automatically from its connected VPC’s database subnets and can’t be set through MCP.
- An ECS container’s image and secrets come from its connected ECR repository / Secrets Manager, the same as in the dashboard — they’re not set as plain field values.
- If you add a VPC and then need to set a subnet choice (type or availability zone) on a resource inside it in the same
apply_changescall, that choice has to be set in a follow-up call, once the VPC’s subnets exist.
Resource types the assistant can’t add directly
These types are configured through other resources’ fields rather than added as standalone resources, so add_resource won’t create them. Add them in the dashboard instead:
- Subnets
- Elastic IPs
- NAT gateways
- Internet gateways
- Route tables and route table associations
- Oracle RDS
- ECS services on EC2
- ECS auto-scaling groups
- CloudFront origin access identities
- ECS launch templates
Resources with required connections
Some resource types need at least one connection to be usable:
- EC2 instance → VPC + security group
- RDS instance → VPC + security group
- ALB → VPC + security group
- ECS service → cluster + ECR repository + security group
Add these together with their required connections in one change — this is what apply_changes (or add_resource with connectTo) is for. A resource added without its required connections will be incomplete.
If a name you use is ambiguous (e.g. more than one security group matches “prod”), the assistant should ask you which one you mean rather than guess.
Renaming existing resources
Renaming a resource that already exists in your cloud account can force it to be replaced on the next apply, since the name is often part of the resource’s identity. Always review the plan before applying after a rename.
Where field values come from
get_resource_schema reports a source for every field the assistant may set:
static
A fixed set of options, returned directly by get_resource_schema or list_field_options — no lookup needed.
cloud — looked up from AWS for your workspace’s region
Fields like AMIs, instance types, and database engine versions/classes/families should be looked up with list_field_options rather than guessed — the valid values depend on the workspace’s region. This is Paxper’s own cached metadata for that region, not a lookup against your AWS account.
list_field_options reports that values are still being fetched, wait about a minute and retry.workspace — must be resources in the same workspace
Key pairs and IAM instance profiles are also looked up with list_field_options, but the values it returns must be resources that already exist in the same workspace — you can’t reference a key pair or instance profile that isn’t modeled there.
subnet-choice
Subnet type (public/private/database) and availability zone are values picked from list_field_options for the connected VPC, not free text and not a connection. They’re validated against the diagram again after the change.
connection — filled by connecting resources, not set directly
Some fields aren’t set with a value at all — they’re filled in by connecting the resource to another one. Security groups, a subnet’s VPC, an ECS service’s cluster, IAM role ARNs, and target/listener ARNs all work this way: connect the resources (with connect_resources, add_resource’s connectTo, or apply_changes) instead of trying to set the field directly, including nested fields — a write to a connection field is refused.
free
Free text, with one exception: IAM policy documents and S3 bucket policies are checked against the policy generators when the assistant saves them, so build them with the policy tools (see Tools Reference) rather than writing them by hand.
Common errors
| Error | What it means |
|---|---|
401 Unauthorized | Your session expired or was revoked — reconnect the connector. |
| ”Workspace not found in this organization” | The workspace doesn’t exist, or belongs to an organization other than the one this connection is bound to. |
| ”Your role … Viewer” | Your role only has read access — ask an admin to change your role if you need write access. |
| ”subscription is read-only” | Your organization’s subscription is expired or past due — write access is suspended until it’s resolved. |
| Validation errors listing specific fields | One or more field values didn’t pass the resource’s schema — check get_resource_schema for the field’s rules. |
Tips for good prompts
- Name the workspace when you have more than one: “In the
platformworkspace, add…” - Be specific about connections you want made: “add an EC2 instance connected to the
prod-vpcVPC andweb-sgsecurity group.” - For lookups, ask the assistant to check valid values first: “what instance types are available in this workspace’s region?”
- If a rename might affect a live resource, ask the assistant to explain what will happen on the next plan before applying.