High-risk tools in Sflight

High severity Sflight MCP Server 4 of 19 tools

4 of the 19 tools in Sflight are classified as high risk. This page profiles those tools specifically, with recommended policy actions and the attack patterns that target them.

Every operation listed below is an action PolicyLayer recommends controlling at the transport layer. Open any tool to see the full profile, risk score, and YAML policy snippet.

Tools at high risk

cap_build Execute

Run CDS build (production or development). Compiles CDS models to deployment artifacts
cap_compile Execute

Compile CDS model to various output formats: json (CSN), edm/edmx (OData metadata),
cap_cql_query Execute

Execute a SQL query against the CAP project database (in-memory SQLite with all CSV seed data loaded).
cap_query Execute

Execute a CQL or OData-style query against the running CAP service.

Attacks that target this class

High-risk tools in any server share these documented attack patterns. Each links to the full case and the defensive policy.

High-risk tools in Sflight

Tools at high risk

Attacks that target this class

More on Sflight

Enforce policy on every Sflight tool call.