Critical-risk tools in Mcp Api
41 of the 314 tools in Mcp Api are classified as critical risk. This page profiles those tools specifically, with recommended policy actions and the attack patterns that target them.
Every operation listed below is an action PolicyLayer recommends controlling at the transport layer. Open any tool to see the full profile, risk score, and YAML policy snippet.
Tools at critical risk
-
cancelActionWithIdDestructiveCancels the user action.
-
changePasswordWithIdDestructiveChanges a user's password using the change password Id. This usually occurs after an email has been sent to the user and they clicked on a link to reset their password. As of v...
-
deleteAPIKeyWithIdDestructiveDeletes the API key for the given Id.
-
deleteApplicationRoleWithIdDestructiveHard deletes an application role. This is a dangerous operation and should not be used in most circumstances. This permanently removes the given role from all users that had it.
-
deleteApplicationWithIdDestructiveHard deletes an application. This is a dangerous operation and should not be used in most circumstances. This will delete the application, any registrations for that application...
-
deleteConnectorWithIdDestructiveDeletes the connector for the given Id.
-
deleteConsentWithIdDestructiveDeletes the consent for the given Id.
-
deleteEmailTemplateWithIdDestructiveDeletes the email template for the given Id.
-
deleteEntityGrantWithIdDestructiveDeletes an Entity Grant for the given User or Entity.
-
deleteEntityTypePermissionWithIdDestructiveHard deletes a permission. This is a dangerous operation and should not be used in most circumstances. This permanently removes the given permission from all grants that had it.
-
deleteEntityTypeWithIdDestructiveDeletes the Entity Type for the given Id.
-
deleteEntityWithIdDestructiveDeletes the Entity for the given Id.
-
deleteFormFieldWithIdDestructiveDeletes the form field for the given Id.
-
deleteFormWithIdDestructiveDeletes the form for the given Id.
-
deleteGroupMembersWithIdDestructiveRemoves users as members of a group.
-
deleteGroupWithIdDestructiveDeletes the group for the given Id.
-
deleteIdentityProviderWithIdDestructiveDeletes the identity provider for the given Id.
-
deleteIPAccessControlListWithIdDestructiveDeletes the IP Access Control List for the given Id.
-
deleteJwtRefreshDestructiveRevokes refresh tokens using the information in the JSON body. The handling for this method is the same as the revokeRefreshToken method and is based on the information you prov...
-
deleteKeyWithIdDestructiveDeletes the key for the given Id.
-
deleteLambdaWithIdDestructiveDeletes the lambda for the given Id.
-
deleteMessageTemplateWithIdDestructiveDeletes the message template for the given Id.
-
deleteMessengerWithIdDestructiveDeletes the messenger for the given Id.
-
deleteOAuthScopeWithIdDestructiveHard deletes a custom OAuth scope. OAuth workflows that are still requesting the deleted OAuth scope may fail depending on the application's unknown scope policy.
-
deleteTenantWithIdDestructiveDeletes the tenant based on the given request (sent to the API as JSON). This permanently deletes all information, metrics, reports and data associated with the tenant and every...
-
deleteThemeWithIdDestructiveDeletes the theme for the given Id.
-
deleteUserActionReasonWithIdDestructiveDeletes the user action reason for the given Id.
-
deleteUserActionWithIdDestructiveDeletes the user action for the given Id. This permanently deletes the user action and also any history and logs of the action being applied to any users. OR Deactivates the use...
-
deleteUserBulkDestructiveDeletes the users with the given Ids, or users matching the provided JSON query or queryString. The order of preference is Ids, query and then queryString, it is recommended to ...
-
deleteUserLinkWithIdDestructiveRemove an existing link that has been made from a 3rd party identity provider to a FusionAuth user.
-
deleteUserRegistrationWithIdDestructiveDeletes the user registration for the given user and application along with the given JSON body that contains the event information. OR Deletes the user registration for the giv...
-
deleteUserTwoFactorWithIdDestructiveDisable two-factor authentication for a user using a JSON body rather than URL parameters. OR Disable two-factor authentication for a user.
-
deleteUserWithIdDestructiveDeletes the user based on the given request (sent to the API as JSON). This permanently deletes all information, metrics, reports and data associated with the user. OR Deletes t...
-
deleteWebAuthnCredentialsForUserWithIdDestructiveDeletes all of the WebAuthn credentials for the given User Id.
-
deleteWebAuthnCredentialWithIdDestructiveDeletes the WebAuthn credential for the given Id.
-
deleteWebhookWithIdDestructiveDeletes the webhook for the given Id.
-
forgotPasswordWithIdDestructiveBegins the forgot password sequence, which kicks off an email to the user so that they can reset their password.
-
reindexWithIdDestructiveRequests Elasticsearch to delete and rebuild the index for FusionAuth users or entities. Be very careful when running this request as it will increase the CPU and I/O load on y...
-
removeUserFromFamilyWithIdDestructiveRemoves a user from the family with the given Id.
-
revokeRefreshTokenByIdWithIdDestructiveRevokes a single refresh token by the unique Id. The unique Id is not sensitive as it cannot be used to obtain another JWT.
-
revokeUserConsentWithIdDestructiveRevokes a single User consent by Id.
Attacks that target this class
Critical-risk tools in any server share these documented attack patterns. Each links to the full case and the defensive policy.