High-risk tools in Devbox
23 of the 38 tools in Devbox are classified as high risk. This page profiles those tools specifically, with recommended policy actions and the attack patterns that target them.
Every operation listed below is an action PolicyLayer recommends controlling at the transport layer. Open any tool to see the full profile, risk score, and YAML policy snippet.
Tools at high risk
-
devbox_adminExecute 3/5Admin operations. action: invite_alpha | list_alpha_users | transition_alpha | stripe_platform_setup | stripe_platform_status | stripe_set_key | disputes | refunds.
-
devbox_agent_handoffExecute 3/5Agent handoff: send summary + context to DevBox, get next action (continue, create_run, done, wait). Use when about to summarize for user — DevBox tells Cursor what to do next. ...
-
devbox_billingExecute 3/5Billing and subscription management. action: subscription_status | usage | checkout | portal | entitlements | refunds | budget. Requires authentication.
-
devbox_context_bundleExecute 3/5Resolve a canonical bundle into provenance-heavy derived context. Returns ordered semantic sections, inline provenance, and compact supporting evidence so agents see compressed ...
-
devbox_context_compileExecute 3/5Compile a context bundle from a set of artifacts, applying layering (base, project, session, ephemeral), deduplication, and budget trimming. Returns a ready-to-inject bundle wit...
-
devbox_context_explainExecute 3/5Explain why a context bundle was compiled the way it was. Returns a human-readable explanation of layering decisions, deduplication, trimming, and trust-tier filtering applied t...
-
devbox_deployExecute 3/5Deploy and rollback. action: deploy | rollback. deploy requires step_id, image_uri, digest, service_name, environment. Requires prior approval for gated steps.
-
devbox_health_mapExecute 3/5Project Health Map. action: get | analyze | feature | summary | prompt | outcome | delta | infer_goals. get: latest analysis with all features. analyze: trigger new analysis. fe...
-
devbox_helpExecute 3/5Get DevBox tool documentation for a topic. Topics: turn_start, workflow, deploy, runs, projects, approvals, ci, logs, planner, memory, project_state, handoff, plans, terminology...
-
devbox_memoryExecute 4/5Project memory for agents. action: search | store | bootstrap | bootstrap_status. search: semantic retrieval. store: add a memory. bootstrap: start phased scan (docs→config→code...
-
devbox_opsExecute 3/5Ops and diagnostics. action: runner_health | worker_stats | ecs_status | logs_control_plane_tail | trace_by_run_id. Use trace_by_run_id for run-level trace inspection (more reli...
-
devbox_project_plansExecute 3/5Project plans for multi-stage work. action: create_plan | get_plan | update_plan_stage | list_plans. Coordinates multiple DevBox runs under a single plan.
-
devbox_project_stateExecute 3/5Project state and pipeline. action: state | pipeline_status. state returns run_branches, open_prs, orphans, pipeline_summary. pipeline_status returns deployment pipeline stages ...
-
devbox_quality_graphExecute 3/5Quality Graph queries — the unified verification chain from outcome to evidence. action: chain (full chain for a feature) | gaps (all gap nodes by severity) | failing (all faili...
-
devbox_run_code_resultExecute 3/5Submit code result or instruction feedback. action: code_result_submit | instruction_feedback. code_result_submit: REQUIRED workspace_path when branch provided. instruction_feed...
-
devbox_run_guidanceExecute 3/5Get full run guidance in one call: run status, next instruction, pending approvals, and suggested_action (APPLY_CODE_INSTRUCTION, DECIDE_APPROVAL, WAIT, DONE). Use this when the...
-
devbox_run_lifecycleExecute 3/5Run lifecycle control. action: cancel | close_with_note | report | diff | advance | next_instruction | events_poll. Use close_with_note when agent resolved issue outside normal ...
-
devbox_run_link_prExecute 3/5Link an existing PR to a run. Use when PR was opened from a different branch than the run's repo_ref. Syncs run with PR so the run page shows the PR link.
-
devbox_run_logsExecute 3/5Run step logs. action: step_log_get | logs_tail | step_fail_orphan. step_fail_orphan marks stuck step as orphaned when control plane restarted.
-
devbox_run_stepExecute 3/5Step control. action: retry | complete | rewind. retry: reset failed step to queued so worker re-executes. complete: manually mark step success (e.g. deploy done outside DevBox)...
-
devbox_run_validationsExecute 4/5DP-05: Run validations. action: review_code | review_architecture | uat_simulate | validate_logs | run_checks | check_coverage | generate_checks | verification_trends | verifica...
-
devbox_runsExecute 3/5Run discovery and creation. action: list | create | get | plan | steps. list discovers runs with awaiting_delegation; create starts a new run. REQUIRED at turn start: list to fi...
-
devbox_surfacesExecute 3/5Surface verification. action: surfaces_dashboard | surfaces_crawl | surfaces_verify | surfaces_fix | get_next_fix | list_issues. get_next_fix: returns highest-priority unresolve...
Attacks that target this class
High-risk tools in any server share these documented attack patterns. Each links to the full case and the defensive policy.
More on Devbox
Enforce policy on Devbox
One command generates a policy scaffold for every server in your MCP config.
npx -y @policylayer/intercept init