High-risk tools in Appaloft

High severity Appaloft MCP Server 69 of 358 tools

69 of the 358 tools in Appaloft are classified as high risk. This page profiles those tools specifically, with recommended policy actions and the attack patterns that target them.

Every operation listed below is an action PolicyLayer recommends controlling at the transport layer. Open any tool to see the full profile, risk score, and YAML policy snippet.

Tools at high risk

account_profile_change Execute

Run account.profile.change through the Appaloft application operation catalog. Shared with HTTP/API.
audit_events_archives_prune Execute

Run audit-events.archives.prune through the Appaloft application operation catalog. Shared with CLI and HTTP/API.
audit_events_legal_holds_release Execute

Run audit-events.legal-holds.release through the Appaloft application operation catalog. Shared with CLI and HTTP/API.
audit_events_prune Execute

Run audit-events.prune through the Appaloft application operation catalog. Shared with CLI and HTTP/API.
auth_bootstrap_first_admin Execute

Run auth.bootstrap-first-admin through the Appaloft application operation catalog. Shared with CLI and HTTP/API.
certificates_retry Execute

Run certificates.retry through the Appaloft application operation catalog. Shared with CLI and HTTP/API.
connections_capability_accept Execute

Run connections.capability.accept through the Appaloft application operation catalog. Shared with CLI and HTTP/API.
credentials_rotate_ssh Execute

Run credentials.rotate-ssh through the Appaloft application operation catalog. Shared with CLI and HTTP/API.
dependency_resources_provision Execute

Run dependency-resources.provision through the Appaloft application operation catalog. Shared with CLI and HTTP/API.
dependency_resources_provisioning_accept Execute

Run dependency-resources.provisioning.accept through the Appaloft application operation catalog. Shared with CLI and HTTP/API.
dependency_resources_rotate_connection Execute

Run dependency-resources.rotate-connection through the Appaloft application operation catalog. Shared with CLI and HTTP/API.
deploy_tokens_create Execute

Run deploy-tokens.create through the Appaloft application operation catalog. Shared with CLI and HTTP/API.
deploy_tokens_list Execute

Read deploy-tokens.list through the Appaloft application operation catalog. Shared with CLI and HTTP/API.
deploy_tokens_revoke Execute

Run deploy-tokens.revoke through the Appaloft application operation catalog. Shared with CLI and HTTP/API.
deploy_tokens_rotate Execute

Run deploy-tokens.rotate through the Appaloft application operation catalog. Shared with CLI and HTTP/API.
deploy_tokens_show Execute

Read deploy-tokens.show through the Appaloft application operation catalog. Shared with CLI and HTTP/API.
deployments_cleanup_preview Execute

Run deployments.cleanup-preview through the Appaloft application operation catalog. Shared with CLI and HTTP/API.
deployments_prune Execute

Run deployments.prune through the Appaloft application operation catalog. Shared with CLI and HTTP/API.
deployments_reconcile_stale Execute

Run deployments.reconcile-stale through the Appaloft application operation catalog. Shared with CLI and HTTP/API.
deployments_redeploy Execute

Run deployments.redeploy through the Appaloft application operation catalog. Shared with CLI and HTTP/API.
deployments_retry Execute

Run deployments.retry through the Appaloft application operation catalog. Shared with CLI and HTTP/API.
deployments_rollback Execute

Run deployments.rollback through the Appaloft application operation catalog. Shared with CLI and HTTP/API.
domain_bindings_confirm_ownership Execute

Run domain-bindings.confirm-ownership through the Appaloft application operation catalog. Shared with CLI and HTTP/API.
domain_bindings_retry_verification Execute

Run domain-bindings.retry-verification through the Appaloft application operation catalog. Shared with CLI and HTTP/API.
domain_events_prune Execute

Run domain-events.prune through the Appaloft application operation catalog. Shared with CLI and HTTP/API.
environments_clone Execute

Run environments.clone through the Appaloft application operation catalog. Shared with CLI and HTTP/API.
environments_duplicate_profile Execute

Run environments.duplicate-profile through the Appaloft application operation catalog. Shared with CLI and HTTP/API.
environments_sync_profile Execute

Run environments.sync-profile through the Appaloft application operation catalog. Shared with CLI and HTTP/API.
environments_unset_variable Execute

Run environments.unset-variable through the Appaloft application operation catalog. Shared with CLI and HTTP/API.
operator_work_dead_letter Execute

Run operator-work.dead-letter through the Appaloft application operation catalog. Shared with CLI and HTTP/API.
operator_work_prune Execute

Run operator-work.prune through the Appaloft application operation catalog. Shared with CLI and HTTP/API.
operator_work_retry Execute

Run operator-work.retry through the Appaloft application operation catalog. Shared with CLI and HTTP/API.
organizations_change_member_role Execute

Run organizations.change-member-role through the Appaloft application operation catalog. Shared with CLI and HTTP/API.
organizations_profile_change Execute

Run organizations.profile.change through the Appaloft application operation catalog. Shared with HTTP/API.
organizations_reactivate_member Execute

Run organizations.reactivate-member through the Appaloft application operation catalog. Shared with CLI and HTTP/API.
projects_reorder Execute

Run projects.reorder through the Appaloft application operation catalog. Shared with CLI and HTTP/API.
provider_job_logs_prune Execute

Run provider-job-logs.prune through the Appaloft application operation catalog. Shared with CLI and HTTP/API.
resources_bind_dependency Execute

Run resources.bind-dependency through the Appaloft application operation catalog. Shared with CLI and HTTP/API.
resources_detach_storage Execute

Run resources.detach-storage through the Appaloft application operation catalog. Shared with CLI and HTTP/API.
resources_rotate_dependency_binding_secret Execute

Run resources.rotate-dependency-binding-secret through the Appaloft application operation catalog. Shared with CLI and HTTP/API.
resources_runtime_control_attempts_prune Execute

Run resources.runtime-control-attempts.prune through the Appaloft application operation catalog. Shared with CLI and HTTP/API.
resources_runtime_log_archives_prune Execute

Run resources.runtime-log-archives.prune through the Appaloft application operation catalog. Shared with CLI and HTTP/API.
resources_runtime_restart Execute

Run resources.runtime.restart through the Appaloft application operation catalog. Shared with CLI and HTTP/API.
resources_runtime_start Execute

Run resources.runtime.start through the Appaloft application operation catalog. Shared with CLI and HTTP/API.
resources_runtime_stop Execute

Run resources.runtime.stop through the Appaloft application operation catalog. Shared with CLI and HTTP/API.
resources_secrets_rotate Execute

Run resources.secrets.rotate through the Appaloft application operation catalog. Shared with CLI and HTTP/API.
resources_unbind_dependency Execute

Run resources.unbind-dependency through the Appaloft application operation catalog. Shared with CLI and HTTP/API.
resources_unset_variable Execute

Run resources.unset-variable through the Appaloft application operation catalog. Shared with CLI and HTTP/API.
sandbox_credentials_grant Execute

Run sandbox-credentials.grant through the Appaloft application operation catalog. Shared with HTTP/API.
sandbox_credentials_request Execute

Run sandbox-credentials.request through the Appaloft application operation catalog. Shared with HTTP/API.
sandbox_ports_expose Execute

Run sandbox-ports.expose through the Appaloft application operation catalog. Shared with CLI and HTTP/API.
sandboxes_exec Execute

Run sandboxes.exec through the Appaloft application operation catalog. Shared with CLI and HTTP/API.
sandboxes_pause Execute

Run sandboxes.pause through the Appaloft application operation catalog. Shared with CLI and HTTP/API.
sandboxes_promotions_accept Execute

Run sandboxes.promotions.accept through the Appaloft application operation catalog. Shared with CLI and HTTP/API.
sandboxes_promotions_retry Execute

Run sandboxes.promotions.retry through the Appaloft application operation catalog. Shared with CLI and HTTP/API.
scheduled_tasks_run_now Execute

Run scheduled-tasks.run-now through the Appaloft application operation catalog. Shared with CLI and HTTP/API.
servers_bootstrap_proxy Execute

Run servers.bootstrap-proxy through the Appaloft application operation catalog. Shared with CLI and HTTP/API.
servers_capacity_prune Execute

Run servers.capacity.prune through the Appaloft application operation catalog. Shared with CLI and HTTP/API.
servers_deactivate Execute

Run servers.deactivate through the Appaloft application operation catalog. Shared with CLI and HTTP/API.
servers_prepare_runtime Execute

Run servers.prepare-runtime through the Appaloft application operation catalog. Shared with CLI and HTTP/API.
servers_reorder Execute

Run servers.reorder through the Appaloft application operation catalog. Shared with CLI and HTTP/API.
source_events_ingest Execute

Run source-events.ingest through the Appaloft application operation catalog. Shared with HTTP/API.
source_events_prune Execute

Run source-events.prune through the Appaloft application operation catalog. Shared with CLI and HTTP/API.
source_events_replay Execute

Run source-events.replay through the Appaloft application operation catalog. Shared with CLI and HTTP/API.
source_links_relink Execute

Run source-links.relink through the Appaloft application operation catalog. Shared with CLI and HTTP/API.
storage_volumes_cleanup_runtime Execute

Run storage-volumes.cleanup-runtime through the Appaloft application operation catalog. Shared with CLI and HTTP/API.
storage_volumes_prune_backups Execute

Run storage-volumes.prune-backups through the Appaloft application operation catalog. Shared with CLI and HTTP/API.
terminal_sessions_expire Execute

Run terminal-sessions.expire through the Appaloft application operation catalog. Shared with CLI and HTTP/API.
tunnels_start Execute

Run tunnels.start through the Appaloft application operation catalog. Shared with CLI and HTTP/API.

Attacks that target this class

High-risk tools in any server share these documented attack patterns. Each links to the full case and the defensive policy.

Destructive Action Autonomy
Runaway Tool Loops
Prompt Injection via Tool Results

High-risk tools in Appaloft

Tools at high risk

Attacks that target this class

More on Appaloft

Enforce policy on every Appaloft tool call.