High-risk tools in Appaloft

High severity Appaloft MCP Server 84 of 358 tools

84 of the 358 tools in Appaloft are classified as high risk. This page profiles those tools specifically, with recommended policy actions and the attack patterns that target them.

Every operation listed below is an action PolicyLayer recommends controlling at the transport layer. Open any tool to see the full profile, risk score, and YAML policy snippet.

Tools at high risk

audit_events_legal_holds_release Execute

Run audit-events.legal-holds.release through the Appaloft application operation catalog. Shared with CLI and HTTP/API.
auth_bootstrap_first_admin Execute

Run auth.bootstrap-first-admin through the Appaloft application operation catalog. Shared with CLI and HTTP/API.
blueprints_install Execute

Run blueprints.install through the Appaloft application operation catalog. Shared with CLI and HTTP/API.
certificates_issue_or_renew Execute

Run certificates.issue-or-renew through the Appaloft application operation catalog. Shared with CLI and HTTP/API.
certificates_retry Execute

Run certificates.retry through the Appaloft application operation catalog. Shared with CLI and HTTP/API.
connections_capability_accept Execute

Run connections.capability.accept through the Appaloft application operation catalog. Shared with CLI and HTTP/API.
connections_capability_apply Execute

Run connections.capability.apply through the Appaloft application operation catalog. Shared with CLI and HTTP/API.
connections_connect_callback Execute

Run connections.connect.callback through the Appaloft application operation catalog. Shared with CLI and HTTP/API.
connections_connect_start Execute

Run connections.connect.start through the Appaloft application operation catalog. Shared with CLI and HTTP/API.
control_plane_portability_import Execute

Run control-plane-portability.import through the Appaloft application operation catalog. Shared with CLI and HTTP/API.
credentials_rotate_ssh Execute

Run credentials.rotate-ssh through the Appaloft application operation catalog. Shared with CLI and HTTP/API.
dependency_resources_import Execute

Run dependency-resources.import through the Appaloft application operation catalog. Shared with CLI and HTTP/API.
dependency_resources_provision Execute

Run dependency-resources.provision through the Appaloft application operation catalog. Shared with CLI and HTTP/API.
dependency_resources_provisioning_accept Execute

Run dependency-resources.provisioning.accept through the Appaloft application operation catalog. Shared with CLI and HTTP/API.
dependency_resources_provisioning_plan Execute

Run dependency-resources.provisioning.plan through the Appaloft application operation catalog. Shared with CLI and HTTP/API.
dependency_resources_rotate_connection Execute

Run dependency-resources.rotate-connection through the Appaloft application operation catalog. Shared with CLI and HTTP/API.
deploy_tokens_revoke Execute

Run deploy-tokens.revoke through the Appaloft application operation catalog. Shared with CLI and HTTP/API.
deployments_cancel Execute

Run deployments.cancel through the Appaloft application operation catalog. Shared with CLI and HTTP/API.
deployments_create Execute

Run deployments.create through the Appaloft application operation catalog. Shared with CLI and HTTP/API.
deployments_force_redeploy Execute

Run deployments.force-redeploy through the Appaloft application operation catalog. Shared with CLI and HTTP/API.
deployments_reconcile_stale Execute

Run deployments.reconcile-stale through the Appaloft application operation catalog. Shared with CLI and HTTP/API.
deployments_redeploy Execute

Run deployments.redeploy through the Appaloft application operation catalog. Shared with CLI and HTTP/API.
deployments_retry Execute

Run deployments.retry through the Appaloft application operation catalog. Shared with CLI and HTTP/API.
deployments_rollback Execute

Run deployments.rollback through the Appaloft application operation catalog. Shared with CLI and HTTP/API.
domain_bindings_configure_route Execute

Run domain-bindings.configure-route through the Appaloft application operation catalog. Shared with CLI and HTTP/API.
domain_bindings_confirm_ownership Execute

Run domain-bindings.confirm-ownership through the Appaloft application operation catalog. Shared with CLI and HTTP/API.
domain_bindings_retry_verification Execute

Run domain-bindings.retry-verification through the Appaloft application operation catalog. Shared with CLI and HTTP/API.
environments_clone Execute

Run environments.clone through the Appaloft application operation catalog. Shared with CLI and HTTP/API.
environments_duplicate_profile Execute

Run environments.duplicate-profile through the Appaloft application operation catalog. Shared with CLI and HTTP/API.
environments_lock Execute

Run environments.lock through the Appaloft application operation catalog. Shared with CLI and HTTP/API.
environments_promote Execute

Run environments.promote through the Appaloft application operation catalog. Shared with CLI and HTTP/API.
environments_sync_profile Execute

Run environments.sync-profile through the Appaloft application operation catalog. Shared with CLI and HTTP/API.
environments_unlock Execute

Run environments.unlock through the Appaloft application operation catalog. Shared with CLI and HTTP/API.
environments_unset_variable Execute

Run environments.unset-variable through the Appaloft application operation catalog. Shared with CLI and HTTP/API.
operator_work_cancel Execute

Run operator-work.cancel through the Appaloft application operation catalog. Shared with CLI and HTTP/API.
operator_work_dead_letter Execute

Run operator-work.dead-letter through the Appaloft application operation catalog. Shared with CLI and HTTP/API.
operator_work_retry Execute

Run operator-work.retry through the Appaloft application operation catalog. Shared with CLI and HTTP/API.
resources_bind_dependency Execute

Run resources.bind-dependency through the Appaloft application operation catalog. Shared with CLI and HTTP/API.
resources_configure_health Execute

Run resources.configure-health through the Appaloft application operation catalog. Shared with CLI and HTTP/API.
resources_configure_network Execute

Run resources.configure-network through the Appaloft application operation catalog. Shared with CLI and HTTP/API.
resources_configure_runtime Execute

Run resources.configure-runtime through the Appaloft application operation catalog. Shared with CLI and HTTP/API.
resources_configure_source Execute

Run resources.configure-source through the Appaloft application operation catalog. Shared with CLI and HTTP/API.
resources_reset_health Execute

Run resources.reset-health through the Appaloft application operation catalog. Shared with CLI and HTTP/API.
resources_rotate_dependency_binding_secret Execute

Run resources.rotate-dependency-binding-secret through the Appaloft application operation catalog. Shared with CLI and HTTP/API.
resources_runtime_restart Execute

Run resources.runtime.restart through the Appaloft application operation catalog. Shared with CLI and HTTP/API.
resources_runtime_start Execute

Run resources.runtime.start through the Appaloft application operation catalog. Shared with CLI and HTTP/API.
resources_runtime_stop Execute

Run resources.runtime.stop through the Appaloft application operation catalog. Shared with CLI and HTTP/API.
resources_secrets_rotate Execute

Run resources.secrets.rotate through the Appaloft application operation catalog. Shared with CLI and HTTP/API.
resources_unbind_dependency Execute

Run resources.unbind-dependency through the Appaloft application operation catalog. Shared with CLI and HTTP/API.
resources_unset_variable Execute

Run resources.unset-variable through the Appaloft application operation catalog. Shared with CLI and HTTP/API.
sandbox_credentials_grant Execute

Run sandbox-credentials.grant through the Appaloft application operation catalog. Shared with HTTP/API.
sandbox_credentials_request Execute

Run sandbox-credentials.request through the Appaloft application operation catalog. Shared with HTTP/API.
sandbox_ports_expose Execute

Run sandbox-ports.expose through the Appaloft application operation catalog. Shared with CLI and HTTP/API.
sandboxes_agents_approvals_resolve Execute

Run sandboxes.agents.approvals.resolve through the Appaloft application operation catalog. Shared with CLI and HTTP/API.
sandboxes_agents_runs_cancel Execute

Run sandboxes.agents.runs.cancel through the Appaloft application operation catalog. Shared with CLI and HTTP/API.
sandboxes_agents_runs_create Execute

Run sandboxes.agents.runs.create through the Appaloft application operation catalog. Shared with CLI and HTTP/API.
sandboxes_agents_runtimes_create Execute

Run sandboxes.agents.runtimes.create through the Appaloft application operation catalog. Shared with CLI and HTTP/API.
sandboxes_candidate_previews_create Execute

Run sandboxes.candidate-previews.create through the Appaloft application operation catalog. Shared with CLI and HTTP/API.
sandboxes_create Execute

Run sandboxes.create through the Appaloft application operation catalog. Shared with CLI and HTTP/API.
sandboxes_exec Execute

Run sandboxes.exec through the Appaloft application operation catalog. Shared with CLI and HTTP/API.
sandboxes_network_policy_configure Execute

Run sandboxes.network-policy.configure through the Appaloft application operation catalog. Shared with CLI and HTTP/API.
sandboxes_pause Execute

Run sandboxes.pause through the Appaloft application operation catalog. Shared with CLI and HTTP/API.
sandboxes_promotions_accept Execute

Run sandboxes.promotions.accept through the Appaloft application operation catalog. Shared with CLI and HTTP/API.
sandboxes_promotions_plan Execute

Run sandboxes.promotions.plan through the Appaloft application operation catalog. Shared with CLI and HTTP/API.
sandboxes_promotions_retry Execute

Run sandboxes.promotions.retry through the Appaloft application operation catalog. Shared with CLI and HTTP/API.
sandboxes_resume Execute

Run sandboxes.resume through the Appaloft application operation catalog. Shared with CLI and HTTP/API.
scheduled_tasks_configure Execute

Run scheduled-tasks.configure through the Appaloft application operation catalog. Shared with CLI and HTTP/API.
scheduled_tasks_run_now Execute

Run scheduled-tasks.run-now through the Appaloft application operation catalog. Shared with CLI and HTTP/API.
servers_bootstrap_proxy Execute

Run servers.bootstrap-proxy through the Appaloft application operation catalog. Shared with CLI and HTTP/API.
servers_configure_edge_proxy Execute

Run servers.configure-edge-proxy through the Appaloft application operation catalog. Shared with HTTP/API.
servers_prepare_runtime Execute

Run servers.prepare-runtime through the Appaloft application operation catalog. Shared with CLI and HTTP/API.
servers_test_connectivity Execute

Run servers.test-connectivity through the Appaloft application operation catalog. Shared with CLI and HTTP/API.
servers_test_draft_connectivity Execute

Run servers.test-draft-connectivity through the Appaloft application operation catalog. Shared with HTTP/API.
source_events_ingest Execute

Run source-events.ingest through the Appaloft application operation catalog. Shared with HTTP/API.
source_events_replay Execute

Run source-events.replay through the Appaloft application operation catalog. Shared with CLI and HTTP/API.
source_links_relink Execute

Run source-links.relink through the Appaloft application operation catalog. Shared with CLI and HTTP/API.
static_artifacts_publish_payload Execute

Run static-artifacts.publish-payload through the Appaloft application operation catalog. Shared with CLI and HTTP/API.
storage_volumes_cleanup_runtime Execute

Run storage-volumes.cleanup-runtime through the Appaloft application operation catalog. Shared with CLI and HTTP/API.
system_control_plane_secret_rotation_apply Execute

Run system.control-plane-secret-rotation.apply through the Appaloft application operation catalog. Shared with CLI.
system_db_migrate Execute

Run system.db-migrate through the Appaloft application operation catalog. Shared with CLI.
system_instance_upgrade_apply Execute

Run system.instance-upgrade.apply through the Appaloft application operation catalog. Shared with CLI and HTTP/API.
terminal_sessions_expire Execute

Run terminal-sessions.expire through the Appaloft application operation catalog. Shared with CLI and HTTP/API.
terminal_sessions_open Execute

Run terminal-sessions.open through the Appaloft application operation catalog. Shared with CLI and HTTP/API.
tunnels_start Execute

Run tunnels.start through the Appaloft application operation catalog. Shared with CLI and HTTP/API.

Attacks that target this class

High-risk tools in any server share these documented attack patterns. Each links to the full case and the defensive policy.

Destructive Action Autonomy
Runaway Tool Loops
Prompt Injection via Tool Results

High-risk tools in Appaloft

Tools at high risk

Attacks that target this class

More on Appaloft

Enforce policy on every Appaloft tool call.