High-risk tools in 0nmcp
25 of the 218 tools in 0nmcp are classified as high risk. This page profiles those tools specifically, with recommended policy actions and the attack patterns that target them.
Every operation listed below is an action PolicyLayer recommends controlling at the transport layer. Open any tool to see the full profile, risk score, and YAML policy snippet.
Tools at high risk
-
ai_chatExecuteChat with your local Llama model. Zero cost, fully private. Supports multi-turn conversation, system prompts, and .brain file loading. Example: ai_chat({ message:
-
ai_embedExecuteCreate text embeddings locally using Ollama. Free, private. Useful for: semantic search, similarity matching, RAG pipelines. Example: ai_embed({ text:
-
ai_generateExecuteOne-shot text generation with local Llama. No conversation context. Good for: summarization, code generation, analysis, content creation. Example: ai_generate({ prompt:
-
api_callExecuteMake a direct API call to any connected service. For advanced use when you need fine-grained control beyond the execute tool.
-
app_buildExecuteBuild a .0n application bundle — a portable encrypted file containing endpoints, workflows, operations, automations, and connections. Deploy anywhere with: 0nmcp app run <file> ...
-
app_openExecuteOpen a .0n application bundle file. Decrypts and extracts the application for local use. Example: app_open({ bundle:
-
brain_compileExecuteCompile a trained brain into a portable .brain file. The .brain file can be imported into any app on any LLM. Also generates the system prompt version for direct use. Example:...
-
brain_importExecuteImport a .brain file and extract its system prompt for use in any LLM. Can import from file path or raw JSON. Example: brain_import({ path:
-
brain_trainExecuteRun scenario-based training on a brain. Executes each scenario against the brain
-
council_debateExecuteHave AI providers critique each other
-
council_solveExecuteFull multi-AI problem-solving pipeline: 1. Ask all AIs the question (parallel) 2. Have them critique each other 3. Synthesize the best answer from all responses This is the mos...
-
crm_build_ai_workflowExecuteBuild and deploy a complete AI Workflow (Agent Studio agent) from a natural language description. Creates the agent, configures knowledge base connections, adds MCP server nodes...
-
crm_deploy_snapshotExecuteDeploy a full snapshot — pipeline, tags, custom values, and workflow definitions — in a single operation.
-
crm_run_ai_workflowExecuteExecute an AI Workflow (Agent Studio agent). Send a message and get a response. Maintains conversation context via executionId.
-
executeExecuteExecute any task using connected services. The AI orchestrator automatically: 1. Parses your intent from natural language 2. Finds the best services to use 3. Creates an executi...
-
flow_run_nowExecuteFire one action immediately — no flow, no enrollment, no schedule. Useful for one-shot sends (
-
landing_pages_deployExecutePOST the rendered HTML to Vercel as a single-file static deployment. Returns the live URL. Requires VERCEL_TOKEN in connections or passed as arg.
-
plugin_buildExecuteBuild a plugin from a service key or custom spec. If building from catalog, returns the plugin
-
plugin_executeExecuteExecute a plugin endpoint with automatic .0n field resolution. Accepts canonical .0n fields (email.0n, fullname.0n, etc.) and auto-translates to the service
-
rc_sequence_to_user_workflowExecuteMirror an rc_sequence into user_workflows so the customer can edit / run / schedule it from the onork-app /dashboard/automations surface. Produces a node/edge graph compatible w...
-
run_workflowExecuteExecute a pre-defined .0n workflow file. Workflows are deterministic, step-by-step automations stored in ~/.0n/workflows/. Unlike the
-
site_runExecuteExecute a plan that a human has approved. Runs only the legs carried in the signed plan. A plan can be run once — replay is blocked in the database, not in code. Every leg writ...
-
training_feedExecuteManage the 0nAI training feed — continuous data ingestion from verified public sources. Fetches from ${FEED_SOURCES.length} sources: Hacker News, arXiv, Dev.to, GitHub, npm, Coi...
-
vault_container_escrow_unwrapExecuteUnwrap a 0nVault container using an escrow party
-
vault_unsealExecuteDecrypt a service
Attacks that target this class
High-risk tools in any server share these documented attack patterns. Each links to the full case and the defensive policy.