High-risk tools in Claude C2

High severity Claude C2 MCP Server 35 of 94 tools

35 of the 94 tools in Claude C2 are classified as high risk. This page profiles those tools specifically, with recommended policy actions and the attack patterns that target them.

Every operation listed below is an action PolicyLayer recommends controlling at the transport layer. Open any tool to see the full profile, risk score, and YAML policy snippet.

Tools at high risk

amsi_bypass Execute

Bypass AMSI. Auto-selects client.
bypassuac Execute

UAC bypass. Auto-selects client.
defender_exclude Execute

Add Defender exclusion. Auto-selects client.
etw_patch Execute

Patch ETW logging. Auto-selects client.
execute_assembly Execute

Load and execute .NET assembly in memory. Auto-selects client if only one connected.
firewall_rule Execute

Manage firewall rule. Auto-selects client.
generate_payload Execute

Generate customized payload with specific options
get_payload Execute

Get agent payload/implant for a specific platform
getsystem Execute

Get SYSTEM privileges. Auto-selects client.
inject Execute

Inject shellcode. Auto-selects client.
keylog_start Execute

Start keylogger. Auto-selects client.
keylog_stop Execute

Stop keylogger. Auto-selects client.
mcp_add_tool Execute

Add a new MCP tool dynamically (adds to tools list and handler)
mcp_append_code Execute

Append code to MCP server file
mcp_restart Execute

Restart the MCP server to apply code changes
mimikatz Execute

Run Mimikatz command. Auto-selects client.
persist_registry Execute

Registry run key persistence. Auto-selects client.
persist_schtask Execute

Scheduled task persistence. Auto-selects client.
persist_service Execute

Install as Windows service. Auto-selects client.
persist_startup Execute

Add to startup folder. Auto-selects client.
persist_wmi Execute

WMI event subscription persistence. Auto-selects client.
portscan Execute

Port scan target. Auto-selects client.
powershell Execute

Execute PowerShell command on Windows client. Auto-selects client if only one connected.
privesc_check Execute

Check privesc vectors. Auto-selects client.
psexec Execute

PsExec remote execution. Auto-selects client.
runas Execute

Run as different user. Auto-selects client.
send_remote_command Execute

Send a command to a remote client
server_shell Execute

Execute any shell command on C2 server (bash, no sandbox, full permissions). Use sudo for privileged ops.
shell Execute

Execute shell command on remote client (cmd.exe on Windows, /bin/sh on Linux). If only one client connected, client_id is auto-selected.
spawn Execute

Spawn process. Auto-selects client.
ssh_exec Execute

SSH remote execution. Auto-selects client.
webcam Execute

Capture webcam photo. Auto-selects client.
winrm Execute

WinRM remote execution. Auto-selects client.
wmiexec Execute

WMI remote execution. Auto-selects client.
zip Execute

Compress to zip. Auto-selects client.

Attacks that target this class

High-risk tools in any server share these documented attack patterns. Each links to the full case and the defensive policy.

Destructive Action Autonomy
Runaway Tool Loops
Prompt Injection via Tool Results

High-risk tools in Claude C2

Tools at high risk

Attacks that target this class

More on Claude C2

Enforce policy on every Claude C2 tool call.