// SCAN REPORT

ROS MCP

24 tools. 12 can modify or destroy data without limits.

1 destructive tool with no built-in limits. Policy required.

Last updated: 11 Jun 2026

12 can modify or destroy data

12 read-only

24 tools total

Community server · catalogue entry verified 11/06/2026

How to control ROS MCP ↓

TOOL MAP

Read (12) Write / Execute (11) Destructive / Financial (1)

MOST DANGEROUS TOOLS

Critical Risk

Destructive · Critical clean_all_ros2_nodes This tool terminates all running ROS 2 and Gazebo processes simultaneously. Execute · High launch_gazebo This tool executes an external simulator launch—an operation whose effects cannot be easily predicted or reversed without additional commands. Execute · High launch_rqt_graph The tool executes a GUI application (rqt_graph) via WebSocket, which is a form of process execution. Execute · Medium launch_rviz This tool triggers the execution of RViz2, a ROS visualization GUI application, which constitutes an external operation whose effects depend on the runtime environment and subsequent user interactions.

12 of ROS MCP's 24 tools can modify, destroy, or commit something on every call — and an agent calls them with no built-in limits.

HOW TO CONTROL ROS MCP

PolicyLayer is an MCP gateway — it sits between your AI agents and ROS MCP, and nothing reaches the server without passing your rules. These are the rules we recommend:

Deny destructive operations

{
  "clean_all_ros2_nodes": {
    "deny_if": [
      {
        "conditions": [],
        "on_deny": "Blocked by default. Requires approval."
      }
    ]
  }
}

Destructive tools should never be available to autonomous agents without human approval.

Cap read operations

{
  "check_ros2_topic_hz": {
    "limits": [
      {
        "counter": "check_ros2_topic_hz_per_minute",
        "window": "minute",
        "max": 60,
        "scope": "grant"
      }
    ]
  }
}

Controls API costs and prevents retry loops from exhausting upstream rate limits.

Create a free account and register ROS MCP — nothing to install.
Add these rules — paste them, or build them visually. Tune the limits to your setup.
Point your MCP client (Claude, Cursor, anything) at your gateway URL.

ENFORCE POLICY ON ROS →

Free to start. No card required.

ALL 24 ROS MCP TOOLS

DESTRUCTIVE 1 tools

Destructive clean_all_ros2_nodes Kills all currently running ROS 2 and Gazebo related processes to clean the environment.

EXECUTE 11 tools

Execute launch_gazebo Launch Gazebo simulation environment via WebSocket server. Execute launch_rqt_graph Launch rqt_graph GUI tool via WebSocket server. Execute launch_rviz Launch RViz2 GUI tool via WebSocket server. Execute launch_turtlebot3_empty_world Launch TurtleBot3 in empty world in Gazebo via WebSocket server. Execute launch_turtlebot3_world Launch TurtleBot3 world in Gazebo via WebSocket server. Execute launch_turtlesim Launch turtlesim GUI application via WebSocket server. Execute run_ros2_doctor Runs ros2 doctor to check ROS 2 environment setup and issues. Execute run_ros2_executable Runs a ROS 2 executable from a specified package. Execute call_ros2_service call_ros2_service Execute publish_ros2_topic publish_ros2_topic Execute send_ros2_action_goal send_ros2_action_goal

READ 12 tools

Read check_ros2_topic_hz Displays the publishing frequency (Hz) of a given ROS 2 topic. Read check_topic_status Checks whether a specific ROS2 topic is actively publishing messages. Read debug_ros2_environment Debug ROS 2 environment variables and setup. Read echo_ros2_topic Echo messages from a ROS2 topic for a specified number of messages. Read find_ros2_package Searches for available ROS 2 packages that match a given keyword. Read get_ros2_node_info Shows detailed information about a specific ROS 2 node. Read get_topic_info Get detailed information about a specific ROS2 topic. Read list_ros2_actions Lists available ROS 2 actions. Read list_ros2_nodes Lists currently running ROS 2 nodes. Read list_ros2_services Lists available ROS 2 services. Read list_topics Displays a list of currently accessible ROS2 topics. Read show_ros2_interface Shows the interface (definition) for a given ROS 2 message or service type.

RELATED SERVERS

Other MCP servers with similar tools — same risk classification, starter policies for each.

FAQ

Can an AI agent delete data through the ROS MCP server? +

Yes. The ROS MCP server exposes 1 destructive tools including clean_all_ros2_nodes. These permanently remove resources with no undo. PolicyLayer blocks destructive tools by default so they never reach the upstream server.

How many tools does the ROS MCP server expose? +

24 tools across 3 categories: Execute, Read, Write. 12 are read-only. 12 can modify, create, or delete data.

How do I enforce a policy on ROS MCP? +

Register the ROS MCP server in PolicyLayer, apply the suggested rules above (adjust the limits to your use case), and point your AI client at the PolicyLayer proxy URL instead of the server directly. Your agents keep the same tools; PolicyLayer evaluates every call against policy before it executes. Nothing to install, live in minutes.

Enforce policy on every ROS MCP tool call.

Deterministic rules across all 24 ROS MCP tools. Per-identity grants. Full audit log. Live in minutes. Nothing to install.

ENFORCE POLICY ON ROS →

Free to start. No card required.

24 ROS MCP tools catalogued and risk-classified — across an index of 42,500+ MCP servers.

ROS MCP

// TOOL MAP

// MOST DANGEROUS TOOLS

// HOW TO CONTROL ROS MCP

// ALL 24 ROS MCP TOOLS

// RELATED SERVERS

// FAQ