Critical-risk tools in Omarchy-MCP
43 of the 466 tools in Omarchy-MCP are classified as critical risk. This page profiles those tools specifically, with recommended policy actions and the attack patterns that target them.
Every operation listed below is an action PolicyLayer recommends controlling at the transport layer. Open any tool to see the full profile, risk score, and YAML policy snippet.
Tools at critical risk
-
omarchy_display_text_sizeDestructiveScale text everywhere — omarchy shell, GTK apps, and terminals [group:display] Args: [size|reset]
-
omarchy_hibernation_removeDestructiveRemove hibernation setup including swap and boot resume settings [group:hibernation] [sudo]
-
omarchy_pkg_dropDestructiveRemove all the named packages from the system if they
-
omarchy_pkg_removeDestructiveShow a fuzzy-finder TUI for picking packages installed on the system to be removed. [group:pkg] [sudo]
-
omarchy_plugin_removeDestructiveRemove an installed shell plugin [group:plugin] Args: [id] [--yes]
-
omarchy_refresh_herdrDestructiveOverwrite the user herdr config with the Omarchy default and reload herdr. [group:refresh]
-
omarchy_refresh_hyprlandDestructiveOverwrite all the user Hyprland Lua configs in ~/.config/hypr with the Omarchy defaults. [group:refresh]
-
omarchy_refresh_limineDestructiveOverwrite the user config for the Limine bootloader and rebuild it. [group:refresh] [sudo]
-
omarchy_refresh_shellDestructiveReset shell.json to Omarchy defaults [group:refresh]
-
omarchy_reinstallDestructiveReinstall Omarchy packages and reset default configs [group:reinstall] [sudo]
-
omarchy_reinstall_configsDestructiveReset Omarchy user configs and shipped defaults in $HOME (destructive) [group:reinstall]
-
omarchy_reminderDestructiveSet and show lightweight desktop notification reminders [group:reminder] Args: [-i|--interactive] | <minutes> [message] | show [-j|--json] | clear
-
omarchy_remove_browserDestructiveRemove a supported browser and clean up Omarchy browser defaults [group:remove] Args: <chrome|brave|brave-origin|edge|firefox|zen> [sudo]
-
omarchy_remove_dev_envDestructiveRemove a development environment that was previously installed via omarchy-install-dev-env. [group:remove] Args: <ruby|node|bun|deno|go|php|laravel|symfony|python|elixir|phoenix...
-
omarchy_remove_gaming_battlenetDestructiveRemove Battle.net, its Proton prefix, installed games, and desktop entry. [group:remove]
-
omarchy_remove_gaming_geforce_nowDestructiveRemove the GeForce NOW Flatpak app and its data. [group:remove]
-
omarchy_remove_gaming_heroicDestructiveRemove Heroic Games Launcher and its game libraries, configs, and caches. [group:remove] [sudo]
-
omarchy_remove_gaming_lutrisDestructiveRemove Lutris, Wine, umu-launcher, and all their configs and caches. [group:remove] [sudo]
-
omarchy_remove_gaming_minecraftDestructiveRemove the Minecraft launcher along with its worlds, mods, and caches. [group:remove] [sudo]
-
omarchy_remove_gaming_retroarchDestructiveRemove RetroArch, all libretro cores, and its config/saves. Leaves ~/Games/roms and ~/Games/bios alone. [group:remove] [sudo]
-
omarchy_remove_gaming_steamDestructiveRemove Steam and all of its game libraries, configs, and caches. [group:remove] [sudo]
-
omarchy_remove_gaming_xbox_cloudDestructiveRemove the Xbox Cloud Gaming web app. [group:remove]
-
omarchy_remove_gaming_xbox_controllersDestructiveRemove the xpadneo Xbox controller driver and undo its module/blacklist config. [group:remove] [sudo]
-
omarchy_remove_preinstallsDestructiveRemove preinstalled Omarchy applications (web apps, TUIs, and selected packages). [group:remove]
-
omarchy_remove_security_fido2DestructiveRemove FIDO2 authentication from sudo and polkit [group:remove] [sudo]
-
omarchy_remove_security_fingerprintDestructiveRemove fingerprint authentication from sudo, polkit, and lock screen [group:remove] [sudo]
-
omarchy_remove_security_sshdDestructiveDisable the OpenSSH server, close the firewall port, and optionally remove authorized keys [group:remove] [sudo]
-
omarchy_remove_security_sudoless_dockerDestructiveDisable sudoless Docker by removing your user from the docker group [group:remove] [sudo]
-
omarchy_remove_service_1passwordDestructiveRemove 1Password and its Chromium extension. [group:remove] [sudo]
-
omarchy_remove_service_dropboxDestructiveRemove Dropbox and its bar plugin. [group:remove] [sudo]
-
omarchy_remove_service_sunshineDestructiveRemove Sunshine and close Omarchy-managed Moonlight streaming ports. [group:remove] [sudo]
-
omarchy_remove_service_tailscaleDestructiveRemove Tailscale and its bar plugin. [group:remove] [sudo]
-
omarchy_setup_factory_resetDestructiveFactory-reset this machine back to its freshly-installed state [group:setup] [sudo]
-
omarchy_theme_removeDestructiveRemove a user-installed theme [group:theme] Args: [theme-name]
-
omarchy_tui_removeDestructiveRemove a terminal UI desktop launcher [group:tui] Args: [name]
-
omarchy_tui_remove_allDestructiveRemove all TUIs installed via omarchy-tui-install. [group:tui]
-
omarchy_update_orphan_pkgsDestructiveReview and optionally remove orphaned system packages after updates [group:update] [sudo]
-
omarchy_update_pkg_pruneDestructivePrune superseded versions from the pacman package cache [group:update] [sudo]
-
omarchy_voxtype_removeDestructiveRemove Voxtype dictation and its configuration [group:voxtype] [sudo]
-
omarchy_webapp_removeDestructiveRemove a web app desktop launcher [group:webapp] Args: [name]
-
omarchy_webapp_remove_allDestructiveRemove all web apps installed via omarchy-webapp-install. [group:webapp]
-
refresh_configDestructiveReset one known Omarchy configuration target to packaged defaults. Omarchy creates its normal backup. Requires enableDangerous.
-
reminder_clearDestructiveClear all pending reminders and verify the store is empty.
Attacks that target this class
Critical-risk tools in any server share these documented attack patterns. Each links to the full case and the defensive policy.