High-risk tools in FlowDot MCP Server
14 of the 207 tools in FlowDot MCP Server are classified as high risk. This page profiles those tools specifically, with recommended policy actions and the attack patterns that target them.
Every operation listed below is an action PolicyLayer recommends controlling at the transport layer. Open any tool to see the full profile, risk score, and YAML policy snippet.
Tools at high risk
-
browser_launchExecuteOpen a web page in a real browser, OR launch an Electron app to QA it. Returns a session_id used by every other browser_* tool. Prefers your system Chrome/Edge (no download). Re...
-
browser_navigateExecuteNavigate a browser session to a new URL. Blocked from reaching the internal FlowDot node server (hub-mode).
-
browser_sequenceExecuteRun several actions in one call (fast, fewer round-trips). Each item is { action, target?, value? }.
-
browser_wait_forExecuteWait until a selector or text appears (up to a timeout).
-
convert_documentExecuteConvert a document to another format; the output extension sets the target. Supported:
-
email_sendExecuteSend an email through a connected mailbox. Subject to mailbox grant permissions —
-
execute_workflowExecuteExecute a FlowDot workflow by ID. Use list_workflows first to get available workflow IDs.
-
mcp__flowdot__invoke_toolkit_toolExecuteExecute a tool from an installed toolkit. Runs the tool with provided inputs using your configured credentials. You can optionally pass credential_overrides to provide dynamic...
-
mcp__flowdot__test_toolkit_installationExecuteRun a Test Connection diagnostic against an installed toolkit. Resolves the toolkit
-
panic_stopExecuteEMERGENCY STOP: Activates a sticky emergency stop for your account.
-
retry_executionExecuteRetry a failed workflow execution using the same inputs. Creates a new execution.
-
send_notificationExecuteSend a notification message to the user via their configured COMMS channels (Telegram, Discord, Slack, Signal).
-
unlink_app_recipeExecuteUnlink a recipe from an app. The app can no longer trigger that recipe.
-
unlink_app_toolkitExecuteUnlink a toolkit from an app. After unlinking, the app will no longer be able to invoke that toolkit
Attacks that target this class
High-risk tools in any server share these documented attack patterns. Each links to the full case and the defensive policy.