High-risk tools in MCX (Modular Code Execution)
5 of the 18 tools in MCX (Modular Code Execution) are classified as high risk. This page profiles those tools specifically, with recommended policy actions and the attack patterns that target them.
Every operation listed below is an action PolicyLayer recommends controlling at the transport layer. Open any tool to see the full profile, risk score, and YAML policy snippet.
Tools at high risk
-
mcx_batchExecuteRun multiple executions and searches in one call. Bypasses throttling. Examples: - mcx_batch({ executions: [{ code:
-
mcx_doctorExecuteRun diagnostics to check MCX health: runtime, database, adapters, sandbox.
-
mcx_executeExecuteExecute JavaScript/TypeScript code in an isolated sandbox. NOT for file/content search - use mcx_find (files) or mcx_grep (content) instead. ## Calling Adapters Adapters are a...
-
mcx_run_skillExecuteRun a registered MCX skill by name. Available skills: [${skillNames}] ${skillList}
-
mcx_spawnExecuteRun code in background, returns immediately with task ID. Examples: - mcx_spawn({ code:
Attacks that target this class
High-risk tools in any server share these documented attack patterns. Each links to the full case and the defensive policy.