High-risk tools in Breakpoint
19 of the 280 tools in Breakpoint are classified as high risk. This page profiles those tools specifically, with recommended policy actions and the attack patterns that target them.
Every operation listed below is an action PolicyLayer recommends controlling at the transport layer. Open any tool to see the full profile, risk score, and YAML policy snippet.
Tools at high risk
-
breakpoint_doctorExecuteCheck this Breakpoint MCP setup end to end: the Godot binary, the editor addon's install and enable state, the capability groups in force, and the editor/runtime/LSP/DAP bridges...
-
cs_code_actionExecuteList the code actions (quick fixes / refactors) OmniSharp offers for a range — the lightbulb menu. Read-only: returns the available actions (title, kind, whether each carries a ...
-
cs_dbg_launchExecuteStart a C# Godot game under netcoredbg. `program` defaults to the configured Mono/.NET Godot binary (GODOT_CSHARP_BIN) and `args` to ['--path', <C# project>]; override either to...
-
cs_dbg_restartExecuteRestart the current C# debug session. Uses the DAP `restart` request when the adapter advertises `supportsRestartRequest`, otherwise falls back to terminate + relaunch — so it w...
-
dbg_launchExecuteStart the game under the debugger; breakpoints set beforehand are applied during the handshake. Refuses rather than report a session that never started: a scene outside the proj...
-
dbg_restartExecuteRestart the current debug session. Uses the DAP `restart` request when the adapter advertises `supportsRestartRequest`, otherwise falls back to terminate + relaunch — so it work...
-
filesystem_scanExecuteTrigger an editor rescan of the project filesystem so newly added or externally-changed files are picked up. Read-only side effect.
-
gd_code_actionExecuteList the code actions (quick fixes / refactors) the language server offers for a range — the lightbulb menu. Read-only: returns the available actions (title, kind, whether each ...
-
godot_launch_editorExecuteOpen the Godot editor for the configured project (detached). Needed before any editor_* bridge tool can be used.
-
godot_run_projectExecuteRun the project (detached). Optionally start from a specific scene path (res://...). WAITS until the game's runtime bridge answers ping and reports bridge_ready — the game takes...
-
godot_stopExecuteTerminate a managed process started by godot_run_managed.
-
runtime_anim_stopExecuteStop (or pause) a LIVE AnimationPlayer node. DESTRUCTIVE (drives the running game) — gated by confirmation. keep_state:true pauses in place; false (default) stops.
-
runtime_peer_stopExecuteTerminate a headless peer started by runtime_spawn_peers, or every one with all:true. DESTRUCTIVE (kills a child process). Stopping an already-stopped peer is a no-op, so this i...
-
runtime_peers_digestExecuteCompare runtime_state_digest across two or more peers over the SAME root and field set (read-only): converged when every peer's digest is byte-equal, otherwise diverged_at names...
-
runtime_state_digestExecuteCapture a compact, stable-ordered JSON snapshot of a live subtree's salient state (read-only) — position, rotation, scale, visibility, and modulate by default, or a caller-suppl...
-
runtime_step_framesExecuteAdvance the running game by an exact number of frames while otherwise frozen, for deterministic, frame-accurate playtesting. DESTRUCTIVE — gated by confirmation. `kind` selects ...
-
runtime_time_scaleExecuteSet Engine.time_scale on the running game: 0 freezes time, 1 is normal, >1 fast, <1 slow-motion. DESTRUCTIVE (alters the running game's clock) — gated by confirmation. Freeze wi...
-
signal_emitExecuteEmit a signal from a node in the EDITED scene, firing its connected callables now. DESTRUCTIVE (edit-time side effects) — gated by confirmation. Args use the tagged-Variant conv...
-
vcs_blameExecutePer-line last-change attribution for a file: for each line, the short commit, author, ISO date, and the line text. Optionally restrict to a [start,end] line range (1-based, incl...
Attacks that target this class
High-risk tools in any server share these documented attack patterns. Each links to the full case and the defensive policy.