Critical-risk tools in Vibekit

Critical severity Vibekit MCP Server 6 of 49 tools

6 of the 49 tools in Vibekit are classified as critical risk. This page profiles those tools specifically, with recommended policy actions and the attack patterns that target them.

Every operation listed below is an action PolicyLayer recommends controlling at the transport layer. Open any tool to see the full profile, risk score, and YAML policy snippet.

Tools at critical risk

vibekit_agent_reset Destructive

Reset an app
vibekit_delete_app Destructive

Permanently delete a hosted app and all its data.
vibekit_delete_app_schedule Destructive

Delete a cron schedule from an app.
vibekit_delete_env Destructive

Delete a specific environment variable from a hosted app.
vibekit_delete_schedule Destructive

Delete an account-level recurring schedule.
vibekit_remove_domain Destructive

Remove a custom domain from an app.

Attacks that target this class

Critical-risk tools in any server share these documented attack patterns. Each links to the full case and the defensive policy.

Destructive Action Autonomy
Privilege escalation via admin-only tools
Data exfiltration via tool chaining
Runaway Tool Loops

Critical-risk tools in Vibekit

Tools at critical risk

Attacks that target this class

More on Vibekit

Enforce policy on every Vibekit tool call.