High-risk tools in Aapanel

High severity Aapanel MCP Server 28 of 282 tools

28 of the 282 tools in Aapanel are classified as high risk. This page profiles those tools specifically, with recommended policy actions and the attack patterns that target them.

Every operation listed below is an action PolicyLayer recommends controlling at the transport layer. Open any tool to see the full profile, risk score, and YAML policy snippet.

Tools at high risk

abnormal_check_all Execute

Run all abnormal detection checks at once (MySQL, PHP, CPU, memory, disk).
crontab_start Execute

Execute a cron job immediately.
deployment_install Execute

Install a deployment package to a site.
docker_container_restart Execute

Restart a Docker container.
docker_container_start Execute

Start a Docker container.
docker_container_stop Execute

Stop a Docker container.
harden_disable_ssh_password Execute

Disable SSH password authentication (enforce key-only auth for hardening).
harden_set_ssh_key_auth Execute

Set up SSH key-based authentication for hardening.
network_scan_ports Execute

Scan ports on a target host from the aaPanel server.
panel_sync_time Execute

Sync server time with NTP.
panel_update Execute

Update aaPanel to the latest version.
plugin_install Execute

Install a software/plugin.
project_start Execute

Start a project.
project_stop Execute

Stop a project.
security_baseline_repair Execute

Repair a specific security baseline issue.
security_baseline_scan Execute

Run security baseline scan (SSH, system config, permissions audit).
site_start Execute

Start a website.
site_stop Execute

Stop a website.
soft_install Execute

Install a software component (nginx, apache, mysql, php, redis, etc.).
system_release_memory Execute

Release/flush system memory (RAM cleanup). Runs sync and memory release script.
system_restart_panel Execute

Restart the aaPanel service.
system_restart_server Execute

Restart the server. Use with caution!
system_service_admin Execute

Start, stop, or restart a service (nginx, apache, mysql, etc.).
terminal_execute_command Execute

terminal_execute_command
terminal_install_bridge Execute

terminal_install_bridge
virus_scan_safe_detect Execute

Run system-level safe detection (file integrity, suspicious files, permission audit).
virus_scan_site Execute

Start a virus/malware scan on a website (checks for web shells, malicious code, trojans).
virus_scan_web Execute

Run web vulnerability scanning on a site (uses panel/scanning module).

Attacks that target this class

High-risk tools in any server share these documented attack patterns. Each links to the full case and the defensive policy.

Destructive Action Autonomy
Runaway Tool Loops
Prompt Injection via Tool Results

High-risk tools in Aapanel

Tools at high risk

Attacks that target this class

More on Aapanel

Enforce policy on every Aapanel tool call.