High-risk tools in ArvanCloud MCP Server

High severity ArvanCloud MCP Server MCP Server 35 of 232 tools

35 of the 232 tools in ArvanCloud MCP Server are classified as high risk. This page profiles those tools specifically, with recommended policy actions and the attack patterns that target them.

Every operation listed below is an action PolicyLayer recommends controlling at the transport layer. Open any tool to see the full profile, risk score, and YAML policy snippet.

Tools at high risk

arvan_ansible_playbook Execute

Run an Ansible playbook against a host (requires ``ansible-playbook``).
arvan_git_checkout Execute

Check out a branch, tag, or commit.
arvan_git_clone Execute

Clone a repository to ``dest`` (defaults to a fresh temp directory).
arvan_git_pull Execute

Pull the latest changes for the current branch.
arvan_helm_install Execute

Install/upgrade a Helm chart.
arvan_iac_opentofu_validate Execute

Validate OpenTofu configuration (``tofu validate``).
arvan_iac_packer_validate Execute

Validate a Packer template (``packer validate``).
arvan_iac_terraform_apply Execute

Run ``terraform apply`` to create/update real ArvanCloud infrastructure.
arvan_iac_terraform_fmt Execute

Check (or apply, with ``write=True``) Terraform formatting.
arvan_iac_terraform_init Execute

Run ``terraform init`` (downloads the arvancloud/arvan provider).
arvan_iac_terraform_plan Execute

Run ``terraform plan`` against the arvancloud/arvan provider.
arvan_iac_terraform_validate Execute

Validate Terraform configuration (optionally ``terraform init`` first).
arvan_iac_validate_kubernetes Execute

Validate Kubernetes manifests against the schema with kubeconform.
arvan_k8s_apply Execute

``kubectl apply`` a manifest (inline YAML) or a directory of manifests.
arvan_kubectl Execute

Run an arbitrary kubectl command (e.g. ``["get","pods","-o","wide"]``).
arvan_net_http_check Execute

Make an HTTP(S) request and report status, timing, and key headers.
arvan_net_http_load_test Execute

Fire a quick concurrent load test and report latency percentiles.
arvan_net_ping Execute

ICMP ping a host (requires the system ``ping`` binary).
arvan_net_port_scan Execute

Scan a list of TCP ports on a host (defaults to common service ports).
arvan_net_traceroute Execute

Trace the network path to a host (requires ``traceroute``).
arvan_notify_slack Execute

Post a message to a Slack incoming webhook.
arvan_notify_telegram Execute

Send a Telegram message via a bot.
arvan_notify_webhook Execute

POST a JSON payload (or ``{"text": ...}``) to an arbitrary webhook.
arvan_provision_server Execute

arvan_provision_server
arvan_resize_server Execute

Change a server's plan/flavor (resize CPU & RAM).
arvan_security_grype Execute

Scan a container image or a directory for vulnerabilities with grype.
arvan_security_sast Execute

Static application security testing (SAST) with semgrep.
arvan_security_scan_image Execute

Scan a container image for vulnerabilities with Trivy (``trivy image``).
arvan_security_scan_vulnerabilities Execute

Scan a filesystem for vulns, secrets and misconfig with Trivy (``trivy fs``).
arvan_server_action Execute

Run a power/maintenance action on a server.
arvan_ssh_check_connection Execute

Verify SSH connectivity/auth to a server (useful after provisioning).
arvan_ssh_run Execute

arvan_ssh_run
arvan_ssh_run_script Execute

Run a multi-line script on a server over SSH (piped to ``bash -s``).
arvan_trigger_cdn_app_webhook Execute

Trigger a CDN app's webhook action.
arvan_wait_for_server Execute

Poll a server until it becomes active (or the timeout elapses).

Attacks that target this class

High-risk tools in any server share these documented attack patterns. Each links to the full case and the defensive policy.

Destructive Action Autonomy
Runaway Tool Loops
Prompt Injection via Tool Results

High-risk tools in ArvanCloud MCP Server

Tools at high risk

Attacks that target this class

More on ArvanCloud MCP Server

Enforce policy on every ArvanCloud MCP Server tool call.