Critical-risk tools in cPanel MCP Server

Critical severity cPanel MCP Server MCP Server 28 of 164 tools

28 of the 164 tools in cPanel MCP Server are classified as critical risk. This page profiles those tools specifically, with recommended policy actions and the attack patterns that target them.

Every operation listed below is an action PolicyLayer recommends controlling at the transport layer. Open any tool to see the full profile, risk score, and YAML policy snippet.

Tools at critical risk

clear_spam_box Destructive

Clear all messages from the SpamAssassin spam box
deauthorize_ssh_key Destructive

Deauthorize an SSH key (revoke login access)
delete_addon_domain Destructive

Delete an addon domain
delete_autoresponder Destructive

Delete an email autoresponder
delete_cron_job Destructive

Delete a cron job
delete_dns_record Destructive

Delete a DNS zone record by line number
delete_email_account Destructive

Delete an email account
delete_email_filter Destructive

Delete an email filter
delete_email_forwarder Destructive

Delete an email forwarder
delete_file Destructive

Delete a file or directory
delete_ftp_account Destructive

Delete an FTP account
delete_git_repo Destructive

Delete a Git repository from cPanel
delete_mysql_database Destructive

Delete a MySQL database
delete_mysql_user Destructive

Delete a MySQL database user
delete_parked_domain Destructive

Remove a parked/aliased domain
delete_postgresql_database Destructive

Delete a PostgreSQL database
delete_postgresql_user Destructive

Delete a PostgreSQL user
delete_redirect Destructive

Delete a URL redirect
delete_ssh_key Destructive

Delete an SSH key
delete_ssl_certificate Destructive

Delete/uninstall an SSL certificate from a domain
delete_subdomain Destructive

Delete a subdomain
remove_2fa Destructive

Remove/disable two-factor authentication from the account
revoke_api_token Destructive

Revoke/delete an API token
revoke_mysql_privileges Destructive

Revoke all privileges for a MySQL user on a database
revoke_postgresql_privileges Destructive

Revoke a PostgreSQL user
unregister_passenger_app Destructive

Unregister/remove a Node.js, Python, or Ruby application
disinfect_files Destructive

Quarantine/disinfect files detected as infected
kill_ftp_session Destructive

Terminate an active FTP session

Attacks that target this class

Critical-risk tools in any server share these documented attack patterns. Each links to the full case and the defensive policy.

Destructive Action Autonomy
Privilege escalation via admin-only tools
Data exfiltration via tool chaining
Runaway Tool Loops

Critical-risk tools in cPanel MCP Server

Tools at critical risk

Attacks that target this class

More on cPanel MCP Server

Enforce policy on every cPanel MCP Server tool call.