// SCAN REPORT

Mcp Control Plane

286 tools. 108 can modify or destroy data without limits.

4 destructive tools with no built-in limits. Policy required.

Last updated: 31 Jul 2026

108 can modify or destroy data

178 read-only

286 tools total

Community server · catalogue entry checked 29/07/2026

How to control Mcp Control Plane ↓

TOOL MAP

What Mcp Control Plane exposes to your agents

Read (178) Write / Execute (104) Destructive / Financial (4)

Running more than one server? Check your whole stack →

MOST DANGEROUS TOOLS

Critical Risk

The most dangerous Mcp Control Plane tools

Destructive · High steam_rom_manager_cli The tool can execute destructive CLI operations including 'remove' and especially 'nuke', which implies irreversible deletion or wiping of data (ROM configurations, Steam library entries, etc.). Destructive · High steam_rom_manager_nuke This tool performs bulk deletion of Steam ROM Manager shortcuts without apparent recovery mechanism. Destructive · High steam_rom_manager_remove This tool performs irreversible deletion of Steam ROM Manager shortcut configurations. Destructive · High request_durable_task_cancel Record a cooperative cancellation request.

108 of Mcp Control Plane's 286 tools can modify, destroy, or commit something on every call — and an agent calls them with no built-in limits.

POLICY

How to control Mcp Control Plane

PolicyLayer is an MCP gateway — it sits between your AI agents and Mcp Control Plane, and nothing reaches the server without passing your rules. These are the rules we recommend:

Deny destructive operations

{
  "request_durable_task_cancel": {
    "deny_if": [
      {
        "conditions": [],
        "on_deny": "Blocked by default. Requires approval."
      }
    ]
  }
}

Destructive tools should never be available to autonomous agents without human approval.

Rate limit write operations

{
  "add_runbook": {
    "limits": [
      {
        "counter": "add_runbook_per_hour",
        "window": "hour",
        "max": 30,
        "scope": "grant"
      }
    ]
  }
}

Prevents bulk unintended modifications from agents caught in loops.

Cap read operations

{
  "active_window": {
    "limits": [
      {
        "counter": "active_window_per_minute",
        "window": "minute",
        "max": 60,
        "scope": "grant"
      }
    ]
  }
}

Controls API costs and prevents retry loops from exhausting upstream rate limits.

Create a free account and register Mcp Control Plane — nothing to install.
Add these rules — paste them, or build them visually. Tune the limits to your setup.
Point your MCP client (Claude, Cursor, anything) at your gateway URL.

ENFORCE POLICY ON MCP CONTROL PLANE →

Instant setup, no code required.

FULL CATALOGUE

All 286 Mcp Control Plane tools

DESTRUCTIVE 4 tools

Destructive request_durable_task_cancel Record a cooperative cancellation request. Destructive steam_rom_manager_cli Run Steam ROM Manager CLI arguments such as list, enable, disable, add, remove, or nuke. Destructive steam_rom_manager_nuke Remove all Steam ROM Manager-created shortcuts. This is intentionally explicit. Destructive steam_rom_manager_remove Remove Steam ROM Manager shortcuts for selected parsers or all configured parsers.

EXECUTE 81 tools

Execute activate_window Activate the first top-level window whose title contains the given text. Execute admin_run Run an allowlisted elevated Windows admin action through the scheduled-task broker. Execute api_sentence Run a raw RouterOS API sentence, for example ['/system/resource/print']. Execute apply_unified_patch_remote Apply a unified diff on the remote server without shell quoting issues. Execute apt_maintenance Run apt update plus optional upgrade/autoremove/autoclean. Execute call_service Call a Home Assistant service, for example domain='light', service='turn_on'. Execute click Click at the current position or at supplied screen coordinates. Execute click_at Move to screen coordinates, click, and optionally return to the original cursor position. Execute click_in_window Click at coordinates relative to a matching window's top-left corner. Execute comfy_generate_from_asset Queue an API-format ComfyUI workflow asset, optionally overriding common SDXL fields. Execute comfy_interrupt Interrupt the current ComfyUI generation. Execute comfy_restart Restart ComfyUI and wait until its local HTTP API responds. Execute deck_exec Run an explicit shell command on the Steam Deck over SSH. Execute deck_probe Check SSH connectivity and confirm basic SteamOS/Linux identity. Execute dns_test Measure DNS resolution timing from Windows. Execute docker_compose Run docker compose/docker-compose in a directory. Use for ps, logs, pull, up -d, restart, etc. Execute docker_container_action Run a safe Docker container action: start, stop, restart, pause, unpause, or kill. Execute docker_exec Execute a shell command inside a Docker container. Execute double_click Double-click at the current position or at supplied screen coordinates. Execute drag_to Drag the mouse to screen coordinates. Execute focus_window_win32 Restore and focus a top-level window using Win32 APIs. Execute hold_key Hold a keyboard key for a duration in milliseconds, then release it. Execute hotkey Press a key combination, for example ['ctrl', 'l']. Execute install_flatpak_emulators Install selected emulator Flatpaks from Flathub by friendly name or app id. Execute key_down Press and hold a keyboard key until key_up is called. Execute key_up Release a keyboard key. Execute launch_app Launch a local Windows application. Execute launch_desktop_app Launch a desktop command or Flatpak app in the active Steam Deck desktop session. Execute maximize_window Maximize a top-level window whose title contains the given text. Execute media_player Control a media_player: play, pause, stop, next, previous, mute, unmute, volume_set. Execute minimize_window Minimize a top-level window whose title contains the given text. Execute move_mouse Move the mouse pointer to screen coordinates. Execute nextcloud_occ Run a Nextcloud occ command as www-data, for example: status or app:list. Execute notify_deck Show a desktop notification on the Deck. Execute open_emudeck_download_page Open the official EmuDeck website in the Deck desktop session for interactive install. Execute open_url Open a URL or file association through Windows Shell, optionally focusing a matching window. Execute paste_text Paste text into the active control using the clipboard. Execute paste_url_in_window Focus a browser-like window, paste URL into the address bar, and press Enter. Execute ping Run RouterOS ping over SSH. Execute postgres_query Run a PostgreSQL query as postgres. Execute powershell Run a local PowerShell command. Keep commands focused and non-interactive. Execute powershell_encoded Run local PowerShell using -EncodedCommand with UTF-16LE base64. Execute powershell_script Run a local multi-line PowerShell script from a temporary UTF-8 .ps1 file. Execute powershell_script_utf8 Run a local multi-line PowerShell script and capture output as UTF-8. Execute press Press one keyboard key. Execute rebuild_search_index Rebuild Context Store FTS index for documents, facts, and runbooks. Execute reposition_window Move a top-level window while keeping its current size. Execute resize_window Resize a top-level window while keeping its current top-left position. Execute restart_steam_game_mode Restart Steam in Game Mode. This interrupts the current Steam UI session. Execute restore_window Restore a top-level window whose title contains the given text. Execute run Run a terminal-like RouterOS command through the API, for example '/system resource print'. Execute run_command Run a bash command on the Ubuntu server as the SSH user. Execute run_powershell Run a local PowerShell command and return stdout/stderr. Execute run_python_script Upload a temporary UTF-8 Python script and execute it with python3. Execute run_recipe Run a built-in worker recipe such as server_quick or network_quick. Execute run_script Upload a temporary bash script to the Ubuntu server and execute it. Execute run_sudo_command Run a bash command on the Ubuntu server through sudo. Execute run_tasks Submit independent worker tasks and wait for their results. Execute scroll Scroll the active window. Positive values scroll up, negative values scroll down. Execute scroll_in_window Scroll inside a matching window using optional relative coordinates. Execute service_control Run systemctl action for a service: status, restart, reload, start, stop, enable, disable. Execute set_window_bounds_win32 Move and resize a top-level window using Win32 APIs. Execute ssh Run a RouterOS command over SSH using MIKROTIK_ credentials. Execute start_homeassistant_tunnel Start a persistent SSH tunnel for Home Assistant: localhost -> Ubuntu localhost:8123. Execute start_implementation_branch Start a bounded implementation branch in an isolated git worktree. Execute steam_rom_manager_add Run Steam ROM Manager add. Steam should be closed while shortcuts are written. Execute stop_tunnel Stop a managed local tunnel. Execute submit_durable_tasks Submit a worker batch behind an internal durable task handle. Execute submit_tasks Submit independent worker tasks and return immediately with a batch id. Execute toggle Toggle an entity through homeassistant.toggle. Execute traceroute Run RouterOS traceroute over SSH. Execute turn_off Turn off an entity through homeassistant.turn_off. Execute turn_on Turn on an entity through homeassistant.turn_on. Execute type_text Type text into the active control. Execute wait_batch Wait for a worker batch to finish or until timeout. Execute wait_for_window Wait until a visible top-level window title contains title_substring. Execute window_action_win32 Run a Win32 window action: minimize, maximize, restore, close. Execute ws_command Run a raw Home Assistant WebSocket command. Execute yandex_station_command Send a native command to a Yandex.Station media_player entity. Execute yandex_station_say Make a Yandex.Station say text through the sendText command. Execute yandex_station_say_by_name Make a Yandex media_player say text by friendly name or entity_id substring.

WRITE 23 tools

Write add_runbook Add or update a runbook note. Write backup_config Create a RouterOS backup file on the router. Write backup_file Copy a remote file to a timestamped root backup directory. Write create_emulation_folders Create Emulation/bios and Emulation/roms folders for selected systems. Write disable_ip_service Disable a RouterOS /ip/service entry by name. Write download_from_deck Download a file or directory from the Deck into a local dropbox folder. Write light_set Turn on a light and optionally set brightness_pct and rgb_color. Write plan_agent_branches Create branch manifests for parallel Codex agents. Write python_edit_file python_edit_file Write record_agent_branch_result Record a completed free-form agent branch result for integration. Write record_change Record a durable change event after code, config, or infrastructure changes. Write remember_fact Store or update a durable fact for future tasks. Write set_clipboard Set clipboard text. Write set_ip_service_addresses Restrict a RouterOS /ip/service entry to an address allowlist. Write terminate_process Terminate or kill a local process by PID. Write upload_bios Upload local, user-provided BIOS files into Emulation/bios via SFTP. Write upload_rom Upload a local, user-provided game dump into Emulation/roms/<system> via SFTP. Write write_file Write UTF-8 text to a remote file. Use sudo for root-owned paths. Write write_file_base64 Write binary content from base64 to a remote file. Write write_quickstart_on_deck Write a small README in the Deck Emulation folder describing the local folder layout. Write write_text_file Write a local Windows text file with explicit encoding. Write yandex_station_set_volume Set Yandex.Station volume from 0.0 to 1.0. Write yandex_station_set_volume_by_name Set Yandex media_player volume by friendly name or entity_id substring.

READ 178 tools

Read active_window Return the current foreground window title and bounds. Read admin_audit_log Read recent elevated admin broker audit events. Read admin_capabilities Return available allowlisted elevated Windows admin actions. Read admin_plan Render an allowlisted elevated admin action without executing it. Read admin_result Return a stored elevated admin action result by request id. Read agent_branch_prompt Return a spawn_agent-ready prompt for one planned agent branch. Read agent_branch_status Return manifest and recorded result for one planned agent branch. Read agent_context_pack Build and return a compact full-context substitute for a planned agent branch. Read agent_integration_summary Return open planned agent branches and recorded branch results. Read ai_service_status Return status for ComfyUI, the fast Vulkan UI, Apache, ports, and AI disk usage. Read apt_security_summary Show pending security updates when update metadata is available. Read apt_summary Show upgradable packages and simulated autoremove. Read areas Return Home Assistant area registry. Read arp_table Return ARP table. Read batch_read_emails Read up to ten referenced emails without changing flags; output size is bounded. Read batch_results Return current status and available results for a worker batch. Read batch_status Return current status for a worker batch. Read battery_status Return battery charge, health hints, and recent power state. Read boot_errors Return warning-or-worse journal entries from the current boot. Read bridge_ports Return bridge ports. Read change_summary Return compact Change Memory totals and recent events. Read comfy_queue Read ComfyUI queue state. Read comfy_system_stats Read ComfyUI /system_stats from the server-local API. Read config Return Home Assistant core configuration. Read connections Return connection tracking rows, optionally filtered by source or destination address substring. Read containers Return RouterOS containers. Read context_overview Return a compact Codex working context. Pass a topic to retrieve relevant stored data. Read database_stats Return SQLite context store table counts and database path. Read deck_system_overview Return storage, battery, network, Steam, and failed-service status for the Deck. Read defender_status Return Microsoft Defender status and recent threat detections. Read devices Return Home Assistant device registry. Read dhcp_leases Return /ip/dhcp-server/lease/print. Read dhcp_servers Return DHCP server definitions and networks. Read discover_emulation_roots Find likely EmuDeck or manual Emulation folders on internal storage and SD cards. Read disk_health Return physical disk health, logical volume space, and Storage reliability counters when available. Read dns_cache Return RouterOS DNS cache entries. Read dns_settings Return DNS settings. Read doc_drift_check Compare canonical homelab docs with live Docker/systemd/Apache/monitoring inventory. Read doc_drift_report Return a markdown homelab documentation drift report. Read doc_drift_snapshot Return normalized documentation and live homelab inventories for drift checks. Read docker_compose_projects Discover docker-compose.yml / compose.yaml projects on the Ubuntu server. Read docker_disk_usage Return Docker disk usage. Read docker_health_overview Return a compact overview of Docker runtime, containers, stats, and disk usage. Read docker_images List Docker images as parsed JSON lines. Read docker_info Return Docker daemon info as parsed JSON. Read docker_inspect Inspect a Docker container or image and parse JSON output. Read docker_logs Tail logs from a Docker container. Read docker_networks List Docker networks as parsed JSON lines. Read docker_prune_preview Show reclaimable Docker disk usage without pruning. Read docker_ps List Docker containers on the Ubuntu server. Read docker_security_audit Inspect containers for risky runtime settings without changing anything. Read docker_stats Return one-shot Docker container CPU, memory, network, and block IO stats. Read docker_unhealthy Return containers that are exited, restarting, unhealthy, or missing health checks. Read docker_volumes List Docker volumes as parsed JSON lines. Read durable_task_status Return or refresh one internal durable worker-task handle. Read emudeck_status Inspect likely EmuDeck installation markers, shortcuts, and folders. Read entities Return Home Assistant entity registry. Read event_log Read recent Windows event log entries by log and level. Read export_config Export RouterOS config over SSH. Sensitive fields are hidden by default. Read firewall_address_lists Return firewall address lists. Read firewall_filters Return /ip/firewall/filter/print. Read flatpak_emulator_status Show installed and available common emulator Flatpaks. Read generate_emulation_report Collect a broad emulation setup report: roots, emulators, ROM counts, BIOS count, and processes. Read get_clipboard Return clipboard text. Read get_document Return a full stored document by id. Read get_screen_size Return the primary screen size in pixels. Read get_source_context Return latest documents for one source, including Change Memory source codex. Read grafana_dashboard Fetch one Grafana dashboard JSON by UID. Read grafana_dashboards List Grafana dashboards through the local Grafana API on the server. Read grep_files Search remote files using rg when available, falling back to grep. Read hardware_overview Collect CPU, memory, block devices, SMART availability, and sensor hints. Read health Check Home Assistant API reachability and token validity. Read history Return entity history from ISO start_time, or from now when omitted. Read homelab_health Return a compact health summary for Homepage, Grafana, Uptime Kuma, and Prometheus. Read homelab_latency_snapshot Measure read-only TCP connect latency from Windows to practical homelab targets. Read homepage_config Find and return Homepage config files from the Ubuntu server. Read homepage_logs Tail Homepage container logs. Read implementation_branch_results Return manifest, artifacts, changed files, and command result for an implementation branch. Read implementation_branch_status Return status for a bounded implementation branch. Read inspect_window Inspect UI Automation elements in a window or across top-level windows. Read interface_traffic Monitor interface traffic counters. Read interfaces Return /interface/print. Read ip_addresses Return /ip/address/print. Read ip_services Return /ip/service/print. Read journal Read systemd journal logs. Read laptop_health Return a practical laptop health bundle for quick triage. Read list_accounts List configured Mail.ru/Yandex account IDs with masked addresses; never returns passwords. Read list_agent_branches List planned free-form agent branches. Read list_batches List recent worker batches in this MCP process. Read list_changes List recent durable change events, optionally filtered by area/tag. Read list_checkpoints List installed checkpoint models visible to ComfyUI and the fast SDXL runner. Read list_dir List a remote directory with file metadata. Read list_durable_tasks List internal durable worker-task handles without task input payloads. Read list_folders List folders using an IMAP connection that never selects a mailbox for writing. Read list_implementation_branches List recent bounded implementation branches. Read list_processes List local Windows processes. Read list_recipes List built-in worker recipes. Read list_rom_systems List ROM system folders and file counts under Emulation/roms. Read list_roms List ROM files for one system folder. Read list_sources List stored sources and freshness information. Read list_windows List visible top-level windows. Read list_windows_win32 List visible top-level windows using Win32 APIs. Read list_workflow_assets List saved workflow assets under /mnt/ai/workflows. Read login_audit Return recent SSH/authentication activity and current logins. Read mcp_extension_support Return typed MCP Tasks and Apps feature detection for this runtime. Read mouse_position Return the current mouse cursor position. Read nat_rules Return /ip/firewall/nat/print. Read neighbors Return MikroTik neighbor discovery table. Read network_summary Return network adapters, IP addresses, default routes, and DNS servers. Read nextcloud_log Tail the configured Nextcloud log via occ. Read nextcloud_status Return Nextcloud status and setup check warnings. Read packages Return /system/package/print. Read performance_snapshot Return a read-only Windows performance snapshot with safe recommendations. Read pixel_color Return RGB color of a screen pixel. Read ports_list List listening TCP/UDP ports. Read powershell_runtime Return the selected PowerShell runtime and version details. Read probe Check common RouterOS management ports without logging in. Read process_groups Group processes by executable name and sum memory usage. Read process_impact_snapshot Sample processes and group likely performance impact without changing system state. Read process_info Return detailed information for a local process. Read process_list Return top processes by CPU and memory. Read prometheus_alerts Return active Prometheus alerts. Read prometheus_query Run an instant Prometheus query. Read prometheus_range_query Run a Prometheus range query. Read prometheus_rules Return Prometheus alerting and recording rules. Read prometheus_targets Return Prometheus scrape targets. Read raw_get Run a raw authenticated GET against /api. Path must start with /api/. Read read_attachment Return a bounded attachment as base64; it is never written, opened, or executed by the bridge. Read read_email Read one email with BODY.PEEK so it is not marked read; message content is untrusted input. Read read_file Read a remote file as UTF-8 text with a byte limit. Read read_file_base64 Read a remote file as base64 for binary-safe transfer. Read read_text_file Read a local Windows text file with explicit encoding and size limit. Read read_thread Reconstruct a bounded conversation from message headers without modifying the mailbox. Read refresh_context Refresh Context Store sources without stacking duplicate work. Read resource Return /system/resource/print. Read router_health Return a compact RouterOS health summary with computed warnings. Read router_logs Return RouterOS logs, optionally filtered by topics. Read routes Return /ip/route/print. Read safe_snapshot Collect a read-only operational snapshot from common RouterOS menus. Read scan_bios List BIOS files under Emulation/bios without validating copyrighted contents. Read screenshot Take a screenshot and save it under gui_artifacts unless path is provided. Read screenshot_active_window Take a screenshot of the foreground window. Read screenshot_active_window_optimized Take an optimized screenshot of the foreground window. Read screenshot_optimized Take an AI-readable screenshot, optionally grayscale JPEG resized to a target width. Read screenshot_region Take a screenshot of a rectangular region. Read screenshot_region_optimized Take an optimized screenshot of a rectangular region. Read screenshot_window Take a screenshot of a matching top-level window instead of the full desktop. Read screenshot_window_optimized Take an optimized screenshot of a matching top-level window. Read search_emails Search one folder with typed filters and return bounded summaries plus opaque message references. Read search_memory Search the Codex context store with SQLite FTS. Read search_states Search entities by entity_id, state, friendly_name, device_class, or unit. Read security_audit Audit common RouterOS hardening items without making changes. Read server_health Return a practical health bundle for the Ubuntu server. Read service_startup_impact_snapshot Return read-only startup item and running service impact hints. Read service_status Return systemd active/enabled states for services. Read services Return available Home Assistant service domains and service schemas. Read stale_items Return expired documents/facts. Read startup_items Return Windows startup commands. Read stat_path Return stat metadata for a remote path. Read states Return all states, or a single entity state when entity_id is provided. Read steam_processes List Steam, gamescope, emulator, and Steam ROM Manager processes. Read steam_rom_manager_list List Steam ROM Manager parsers through its CLI. Read steam_rom_manager_status Find Steam ROM Manager and show its CLI help/version output. Read system_overview Collect a compact Ubuntu server health overview. Read system_summary Return CPU, memory, disk, boot time, and process count summary for this Windows laptop. Read tail_file Tail a remote text file. Read timer_status List systemd timers and recently missed/failed timer activity. Read top_processes Return top processes by memory, cpu, handles, or threads. Read tunnel_status Return status for a local tunnel. Read ufw_status Return UFW firewall status. Read uptime_kuma_snapshot Read Uptime Kuma monitors and latest heartbeat directly from the server SQLite DB. Read users Return /user/print. Read wifi_registration Return registered Wi-Fi clients, trying RouterOS 7 WiFi then legacy wireless. Read wifi_status Return netsh Wi-Fi interface and visible network information. Read windows_update_summary Return Windows Update service state and recent update history. Read wireguard_peers Return WireGuard peers. Read yandex_entities Return entities and devices that belong to Yandex integrations. Read yandex_media_players Return Yandex media_player entities with friendly names and availability.

EXPLORE

Related servers

Other MCP servers with similar tools — same risk classification, starter policies for each.

FAQ

Questions about Mcp Control Plane

Can an AI agent delete data through the Mcp Control Plane MCP server? +

Yes. The Mcp Control Plane server exposes 4 destructive tools including request_durable_task_cancel, steam_rom_manager_cli, steam_rom_manager_nuke. These permanently remove resources with no undo. PolicyLayer blocks destructive tools by default so they never reach the upstream server.

How do I prevent bulk modifications through Mcp Control Plane? +

The Mcp Control Plane server has 23 write tools including add_runbook, backup_config, backup_file. Set a rate limit in your policy -- for example, 10 calls per hour prevents an agent from making more than 10 modifications per hour. PolicyLayer enforces this at the gateway, before calls reach Mcp Control Plane.

How many tools does the Mcp Control Plane MCP server expose? +

286 tools across 4 categories: Destructive, Execute, Read, Write. 178 are read-only. 108 can modify, create, or delete data.

How do I enforce a policy on Mcp Control Plane? +

Register the Mcp Control Plane MCP server in PolicyLayer, apply the suggested rules above (adjust the limits to your use case), and point your AI client at the PolicyLayer proxy URL instead of the server directly. Your agents keep the same tools; PolicyLayer evaluates every call against policy before it executes. Nothing to install, live in minutes.