// SCAN REPORT

Agent Jail

35 tools. 21 can modify or destroy data without limits.

2 destructive tools with no built-in limits. Policy required.

Last updated: 7 Aug 2026

21 can modify or destroy data

14 read-only

35 tools total

Community server · catalogue entry checked 07/08/2026

How to control Agent Jail ↓

TOOL MAP

What Agent Jail exposes to your agents

Read (14) Write / Execute (10) Destructive / Financial (2)

Running more than one server? Check your whole stack →

MOST DANGEROUS TOOLS

Critical Risk

The most dangerous Agent Jail tools

Destructive · High cleanup_expired_sandboxes Destroy expired sandboxes. Destructive · High destroy_sandbox Force destroy a sandbox container. Execute · High run_query Query execution is inherently Execute-category: it runs code (SQL or equivalent) against a data backend. Execute · High schedule_task The name 'schedule_task' strongly suggests this tool schedules or triggers execution of tasks, placing it in the Execute category.

21 of Agent Jail's 35 tools can modify, destroy, or commit something on every call — and an agent calls them with no built-in limits.

POLICY

How to control Agent Jail

PolicyLayer is an MCP gateway — it sits between your AI agents and Agent Jail, and nothing reaches the server without passing your rules. These are the rules we recommend:

Deny destructive operations

{
  "cleanup_expired_sandboxes": {
    "deny_if": [
      {
        "conditions": [],
        "on_deny": "Blocked by default. Requires approval."
      }
    ]
  }
}

Destructive tools should never be available to autonomous agents without human approval.

Rate limit write operations

{
  "add_expense": {
    "limits": [
      {
        "counter": "add_expense_per_hour",
        "window": "hour",
        "max": 30,
        "scope": "grant"
      }
    ]
  }
}

Prevents bulk unintended modifications from agents caught in loops.

Cap read operations

{
  "check_worker_status": {
    "limits": [
      {
        "counter": "check_worker_status_per_minute",
        "window": "minute",
        "max": 60,
        "scope": "grant"
      }
    ]
  }
}

Controls API costs and prevents retry loops from exhausting upstream rate limits.

Create a free account and register Agent Jail — nothing to install.
Add these rules — paste them, or build them visually. Tune the limits to your setup.
Point your MCP client (Claude, Cursor, anything) at your gateway URL.

ENFORCE POLICY ON AGENT JAIL →

Instant setup, no code required.

FULL CATALOGUE

All 35 Agent Jail tools

DESTRUCTIVE 2 tools

Destructive cleanup_expired_sandboxes Destroy expired sandboxes. Destructive destroy_sandbox Force destroy a sandbox container.

EXECUTE 3 tools

Execute run_in_sandbox Run a shell command inside the sandbox container. timeout=0 uses default timeout. Execute run_query run_query Execute schedule_task schedule_task

WRITE 7 tools

Write add_expense add_expense Write create_sandbox Create a disposable Docker sandbox for AI agents. Returns sandbox_id. Write save save Write save_contact save_contact Write store_data store_data Write store_files Store uploaded files. Receives file objects with name, size, type, data (base64). Write submit_form Validate and process form submission.

READ 14 tools

Read check_worker_status check_worker_status Read docker_health Check if Docker daemon is reachable. Read echo_tool Echo the input text Read get_auth_type get_auth_type Read get_client_ip get_client_ip Read get_info Provides a simple info. Read get_my_emails get_my_emails Read get_user_id get_user_id Read greeting greeting Read introspect introspect Read list_files List all uploaded files with metadata. Read list_sandboxes List all agent-jail sandbox containers. Read long_running_task long_running_task Read read_file Read an uploaded file's contents by name.

OTHER 9 tools

Other add add Other async_tool async_tool Other custom_name custom_name Other greet greet Other log_progress log_progress Other multiply multiply Other my_task my_task Other my_tool my_tool Other tool_with_context tool_with_context

EXPLORE

Related servers

Other MCP servers with similar tools — same risk classification, starter policies for each.

FAQ

Questions about Agent Jail

Can an AI agent delete data through the Agent Jail MCP server? +

Yes. The Agent Jail server exposes 2 destructive tools including cleanup_expired_sandboxes, destroy_sandbox. These permanently remove resources with no undo. PolicyLayer blocks destructive tools by default so they never reach the upstream server.

How do I prevent bulk modifications through Agent Jail? +

The Agent Jail server has 7 write tools including add_expense, create_sandbox, save. Set a rate limit in your policy -- for example, 10 calls per hour prevents an agent from making more than 10 modifications per hour. PolicyLayer enforces this at the gateway, before calls reach Agent Jail.

How many tools does the Agent Jail MCP server expose? +

35 tools across 4 categories: Destructive, Execute, Read, Write. 14 are read-only. 21 can modify, create, or delete data.

How do I enforce a policy on Agent Jail? +

Register the Agent Jail MCP server in PolicyLayer, apply the suggested rules above (adjust the limits to your use case), and point your AI client at the PolicyLayer proxy URL instead of the server directly. Your agents keep the same tools; PolicyLayer evaluates every call against policy before it executes. Nothing to install, live in minutes.

Enforce policy on every Agent Jail tool call.

Deterministic rules across all 35 Agent Jail tools. Per-identity grants. Full audit log. Live in minutes. Nothing to install.

ENFORCE POLICY ON AGENT JAIL →

Instant setup, no code required.

35 Agent Jail tools catalogued and risk-classified — across an index of 46,500+ MCP servers.

// WHERE THIS COMES FROM

These policies come from Agent Jail's registry record.

The record behind this page: verified identity, auth posture, risk grade, every tool classified, recommended policy — re-checked continuously.

Teams ship this data inside their own products. See what a licence covers →