High-risk tools in wafle MCP server
16 of the 117 tools in wafle MCP server are classified as high risk. This page profiles those tools specifically, with recommended policy actions and the attack patterns that target them.
Every operation listed below is an action PolicyLayer recommends controlling at the transport layer. Open any tool to see the full profile, risk score, and YAML policy snippet.
Tools at high risk
-
wafle_ads_bulk_pauseExecutePause many Meta campaigns in a single tool call. Returns per-id success/failure so partial successes are visible.\n\n
-
wafle_ads_campaign_pauseExecutePause a Meta Ads campaign by id. Idempotent — pausing an already-paused campaign returns ok=true. Uses the tenant
-
wafle_ads_campaign_resumeExecuteResume a paused Meta Ads campaign by id. Sets status to ACTIVE. Idempotent for already-active campaigns.\n\n
-
wafle_ads_recommendation_applyExecuteApply a wafle ads recommendation by id — runs the underlying writer action (pause campaign, raise budget, etc.) and marks the recommendation applied. Idempotent: re-applying ret...
-
wafle_ads_sync_fullExecuteRun a full ads-platform catalog sync (Meta Catalog API or equivalent) AND wait until it finishes. Emits progress notifications.\n\n
-
wafle_agents_runExecuteManually dispatch a run for an agent. Returns the
-
wafle_agents_runs_approveExecuteApprove a run that is
-
wafle_domains_verifyExecuteTrigger immediate verification + SSL + nginx provisioning for a previously-added domain. Idempotent — safe to call repeatedly. The pipeline:\n
-
wafle_gateways_testExecuteRun a live credential test against the gateway provider. For MP it calls
-
wafle_products_sync_triggerExecuteTrigger an asynchronous catalog sync for a store. Returns a job id; poll
-
wafle_products_sync_trigger_and_waitExecuteTrigger a catalog sync AND wait until it finishes (or 5min timeout). Emits MCP progress notifications during the wait — clients that support progress (Claude Desktop) show a liv...
-
wafle_resources_invalidateExecuteInvalidate the in-memory MCP resource cache. Pass
-
wafle_shipping_carriers_statusExecuteRun the carrier connection self-test for a store. Hits each configured carrier API once and reports
-
wafle_system_queue_retryExecuteRetry a failed queue job by id, or all failed jobs of a kind.
-
wafle_system_release_deployExecuteDeploy a specific version of a component. Server-side this kicks off the deploy pipeline.\n\n
-
wafle_users_switch_tenantExecuteSet the session
Attacks that target this class
High-risk tools in any server share these documented attack patterns. Each links to the full case and the defensive policy.