Critical-risk tools in 0nmcp
13 of the 218 tools in 0nmcp are classified as critical risk. This page profiles those tools specifically, with recommended policy actions and the attack patterns that target them.
Every operation listed below is an action PolicyLayer recommends controlling at the transport layer. Open any tool to see the full profile, risk score, and YAML policy snippet.
Tools at critical risk
-
crm_marketplace_delete_chargeDestructiveDelete/cancel a specific marketplace charge.
-
crm_marketplace_uninstallDestructiveUninstall a marketplace app from a location.
-
crm_media_bulk_deleteDestructiveBulk delete or trash multiple files and folders.
-
crm_media_deleteDestructiveDelete a file or folder from the CRM media library.
-
patent_watchlistDestructiveRead the patent watchlist, or add a term to it. Adding is a WRITE. Removal is intentionally not available here — the watchlist is what makes scans find anything, and pruning it...
-
shadcn_themeDestructiveReturn a brand-themed @theme inline CSS block for shadcn/ui + Tailwind v4. Defaults to the 0n brand theme (dark, accent #6EE05A green-teal-purple gradient). Drop into globals.cs...
-
vault_container_revokeDestructiveRevoke a vault container transfer ID. Once revoked, the transfer ID cannot be used again. Example: vault_container_revoke({ transferId:
-
ai_benchFinancialBenchmark a prompt across local Llama AND cloud models side by side. Compare speed, quality, and cost. Cloud calls use real API keys (cost money). Example: ai_bench({ prompt:
-
crm_create_payment_configFinancialConfigure payment processing (Stripe) for a CRM location. This wires Stripe into the location so it can accept payments natively.
-
crm_marketplace_chargeFinancialCharge a location for an add-on or service through the CRM marketplace billing. The CRM handles payment collection from the sub-account owner.
-
crm_report_billingFinancialReport a payment to the CRM billing webhook. Activates or deactivates a marketplace app for a location based on payment status. Required for external billing (SaaS subscriptions...
-
crm_saas_generate_payment_linkFinancialGenerate a payment link for a sub-account to pay for their SaaS subscription.
-
vault_container_transferFinancialRegister a vault container transfer and get a transfer ID. Transfer IDs are unique and cannot be reused (replay prevention). Example: vault_container_transfer({ file:
Attacks that target this class
Critical-risk tools in any server share these documented attack patterns. Each links to the full case and the defensive policy.