High-risk tools in Truenas

High severity Truenas MCP Server 34 of 279 tools

34 of the 279 tools in Truenas are classified as high risk. This page profiles those tools specifically, with recommended policy actions and the attack patterns that target them.

Every operation listed below is an action PolicyLayer recommends controlling at the transport layer. Open any tool to see the full profile, risk score, and YAML policy snippet.

Tools at high risk

app_start Execute

Start an installed app by its ID.
app_stop Execute

Stop a running app by its ID.
cloud_backup_run Execute

Run a cloud backup task now
cloudsync_run Execute

Run a cloud sync task now
cronjob_run Execute

Run a cron job immediately
pool_scrub Execute

Start, stop, or pause a pool scrub
replication_run Execute

Manually run a replication task now
rsync_task_run Execute

Run an rsync task immediately
service_restart Execute

Restart a service by name. Equivalent to stop + start. Useful after configuration changes that require a service reload.
service_start Execute

Start a service by name (e.g.
service_stop Execute

Stop a running service by name (e.g.
truenas Execute

Manage your TrueNAS SCALE system. 278 actions organized in categories. Usage: - No args or category=
vm_restart Execute

Restart a running virtual machine by its ID.
vm_start Execute

Start a virtual machine by its ID. Optionally allow memory overcommit.
vm_stop Execute

Stop a running virtual machine by its ID. Optionally force-stop (power off) instead of graceful shutdown.
alertservice_test Execute

Send a test notification through an alert service to verify it is configured correctly.
app_pull_images Execute

Pull the latest Docker images for a specific app.
app_redeploy Execute

Redeploy an app, recreating its containers with the current configuration.
app_upgrade Execute

Upgrade an app to a newer version.
cloudsync_abort Execute

Abort a running cloud sync task
cloudsync_credentials_verify Execute

Verify a cloud sync credential is working
directory_services_cache_refresh Execute

Refresh the directory services cache. Forces re-read of users and groups from the directory server.
disk_smart_test_run Execute

Run a SMART test on one or more disks. Returns a job ID for the test.
filesystem_chown Execute

Change ownership of a file or directory. Can optionally apply recursively.
network_checkin Execute

Check in after committing network changes to confirm they are working. This prevents the automatic rollback that occurs if you don
snapshot_task_run Execute

Run a periodic snapshot task immediately
truenas_api_call Execute

Make a raw API call to any TrueNAS endpoint not covered by specific tools. This is an escape hatch for advanced or uncommon operations. The body parameter accepts a JSON string ...
boot_scrub Execute

Start a scrub of the boot pool to check for and repair data integrity issues.
bootenv_activate Execute

Activate a boot environment so it will be used on next boot.
cronjob_create Execute

Create a new cron job
dataset_lock Execute

Lock an encrypted dataset
mail_send Execute

Send a test email to verify mail configuration is working. Provide a subject, body text, and one or more recipient addresses.
network_commit_changes Execute

Commit pending network interface changes. Network changes are staged and must be committed to take effect. Use checkin_timeout to set a rollback timer — if you do not check in (...
update_download Execute

Download pending system updates. This starts the download process; the system is not updated until update_apply is called.

Attacks that target this class

High-risk tools in any server share these documented attack patterns. Each links to the full case and the defensive policy.

High-risk tools in Truenas

Tools at high risk

Attacks that target this class

More on Truenas

Enforce policy on every Truenas tool call.