Critical-risk tools in Threejs Devtools
5 of the 60 tools in Threejs Devtools are classified as critical risk. This page profiles those tools specifically, with recommended policy actions and the attack patterns that target them.
Every operation listed below is an action PolicyLayer recommends controlling at the transport layer. Open any tool to see the full profile, risk score, and YAML policy snippet.
Tools at critical risk
-
bounding_boxesDestructive 4/5Show/hide axis-aligned bounding boxes for scene objects. Runtime only — for debugging frustum culling and object bounds. Debug only — page reload will reset. No code changes ne...
-
highlight_objectDestructive 4/5Highlight an object for debugging (wireframe or visibility toggle). Runtime only — for visual inspection, not persisted. Debug only — page reload will reset. No code changes ne...
-
remove_helperDestructive 4/5Remove a previously added debug helper Debug only — page reload will reset. No code changes needed.
-
toggle_overlayDestructive 4/5Toggle a lightweight scene inspector overlay in the browser. Shows real-time FPS, draw calls, triangles, object count, scene tree, materials, and lights. Click objects in the tr...
-
toggle_wireframeDestructive 4/5Toggle wireframe on all materials or a specific object. Runtime only — for visual debugging. Debug only — page reload will reset. No code changes needed.
Attacks that target this class
Critical-risk tools in any server share these documented attack patterns. Each links to the full case and the defensive policy.
More on Threejs Devtools
Enforce policy on Threejs Devtools
One command generates a policy scaffold for every server in your MCP config.
npx -y @policylayer/intercept init