Critical-risk tools in 1Panel MCP Server
38 of the 286 tools in 1Panel MCP Server are classified as critical risk. This page profiles those tools specifically, with recommended policy actions and the attack patterns that target them.
Every operation listed below is an action PolicyLayer recommends controlling at the transport layer. Open any tool to see the full profile, risk score, and YAML policy snippet.
Tools at critical risk
-
clean_compose_logDestructiveClean compose log
-
clean_container_logDestructiveClean container log
-
clean_monitor_dataDestructiveClean monitor data
-
clear_recycle_binDestructiveClear recycle bin
-
delete_ai_agentDestructiveDelete AI agent (XPack)
-
delete_ai_agent_accountDestructiveDelete AI agent account (XPack)
-
delete_backupDestructiveDelete backup
-
delete_backup_accountDestructiveDelete backup account
-
delete_certificateDestructiveDelete SSL certificate
-
delete_clam_configDestructiveDelete ClamAV config
-
delete_cronjobDestructiveDelete cronjob
-
delete_databaseDestructiveDelete database
-
delete_fileDestructiveDelete file or directory
-
delete_firewall_ruleDestructiveDelete firewall rule
-
delete_ftp_userDestructiveDelete FTP user
-
delete_hostDestructiveDelete host
-
delete_host_groupDestructiveDelete host group
-
delete_host_ssh_keyDestructiveDelete host SSH key
-
delete_mcp_serverDestructiveDelete MCP server (XPack)
-
delete_ollama_modelDestructiveDelete Ollama model (XPack)
-
delete_snapshotDestructiveDelete system snapshot
-
delete_websiteDestructiveDelete website
-
delete_website_domainDestructiveRemove domain from website
-
partition_diskDestructivePartition disk
-
prune_containersDestructivePrune containers
-
recover_snapshotDestructiveRecover from snapshot
-
recreate_snapshotDestructiveRecreate snapshot
-
remove_composeDestructiveRemove compose
-
remove_containerDestructiveRemove container
-
remove_imageDestructiveRemove image
-
remove_networkDestructiveRemove network
-
remove_volumeDestructiveRemove volume
-
reset_ai_agent_tokenDestructiveReset AI agent token (XPack)
-
restore_backupDestructiveRestore backup
-
uninstall_appDestructiveUninstall app
-
uninstall_environmentDestructiveUninstall environment
-
uninstall_php_extensionDestructiveUninstall PHP extension
-
unmount_diskDestructiveUnmount disk
Attacks that target this class
Critical-risk tools in any server share these documented attack patterns. Each links to the full case and the defensive policy.