Critical-risk tools in Technitium MCP Secure
7 of the 39 tools in Technitium MCP Secure are classified as critical risk. This page profiles those tools specifically, with recommended policy actions and the attack patterns that target them.
Every operation listed below is an action PolicyLayer recommends controlling at the transport layer. Open any tool to see the full profile, risk score, and YAML policy snippet.
Tools at critical risk
-
dns_delete_cachedDestructiveDelete a specific domain from the DNS cache. Unlike flush, this only removes the specified domain.
-
dns_delete_recordDestructiveDelete a specific DNS record from a zone. Requires confirm=true to execute.
-
dns_delete_zoneDestructiveDelete a DNS zone and all its records. Requires confirm=true to execute.
-
dns_remove_allowedDestructiveRemove a domain from the allow list. The domain will no longer bypass block lists.
-
dns_uninstall_appDestructiveUninstall a DNS app from the server. Requires confirm=true to execute.
-
dns_flush_allowedDestructiveFlush the entire allow list. All allowed domains will be removed. Requires confirm=true to execute.
-
dns_flush_blockedDestructiveFlush the entire custom block list. All manually blocked domains will be removed. Requires confirm=true to execute.
Attacks that target this class
Critical-risk tools in any server share these documented attack patterns. Each links to the full case and the defensive policy.