Critical-risk tools in Aapanel

Critical severity Aapanel MCP Server 26 of 282 tools

26 of the 282 tools in Aapanel are classified as critical risk. This page profiles those tools specifically, with recommended policy actions and the attack patterns that target them.

Every operation listed below is an action PolicyLayer recommends controlling at the transport layer. Open any tool to see the full profile, risk score, and YAML policy snippet.

Tools at critical risk

backup_delete Destructive

Delete a backup.
crontab_delete Destructive

Delete a cron job.
cve_set_vuln_ignore Destructive

Ignore a specific vulnerability permanently.
database_delete Destructive

Delete a database.
database_delete_backup Destructive

Delete a database backup.
docker_image_delete Destructive

Delete a Docker image.
file_delete Destructive

Delete a file or directory on the server.
firewall_delete_ip Destructive

Remove an IP rule from the firewall.
firewall_delete_port Destructive

Close a port in the firewall.
ftp_delete Destructive

Delete an FTP user.
harden_clear_temp_login Destructive

Clear all temporary login sessions for security.
plugin_uninstall Destructive

Uninstall a software/plugin.
project_delete Destructive

Delete a project.
site_delete Destructive

Delete a website.
site_delete_domain Destructive

Remove a domain from a site.
soft_uninstall Destructive

Uninstall a software component.
ssl_delete_cert Destructive

Delete an SSL certificate from the panel.
system_clear_all_cache Destructive

Clear all system garbage: mail logs, temp files, install cache, wwwlogs.
system_clear_all_logs Destructive

Close/clear all website logs on the server.
system_clear_cache Destructive

Clear system cache to free up memory.
system_clear_old_sessions Destructive

Delete old panel sessions to free up resources.
system_clear_panel_logs Destructive

Clear aaPanel error logs.
system_clear_site_logs Destructive

Clear access/error logs for a specific site.
tamper_remove_file_deny Destructive

Remove tamper protection from a file/directory.
task_remove Destructive

Remove/cancel a background task.
waf_delete_rule Destructive

Delete a WAF rule by ID.

Attacks that target this class

Critical-risk tools in any server share these documented attack patterns. Each links to the full case and the defensive policy.

Destructive Action Autonomy
Privilege escalation via admin-only tools
Data exfiltration via tool chaining
Runaway Tool Loops

Critical-risk tools in Aapanel

Tools at critical risk

Attacks that target this class

More on Aapanel

Enforce policy on every Aapanel tool call.