High-risk tools in LocalAnt

High severity LocalAnt MCP Server 60 of 216 tools

60 of the 216 tools in LocalAnt are classified as high risk. This page profiles those tools specifically, with recommended policy actions and the attack patterns that target them.

Every operation listed below is an action PolicyLayer recommends controlling at the transport layer. Open any tool to see the full profile, risk score, and YAML policy snippet.

Tools at high risk

adb_input_text Execute

Type text on the device (audited).
adb_install_apk Execute

Install an APK (path must be inside an allowed directory). Requires approval (risk 3).
adb_keyevent Execute

Send a key event (e.g. 4 = BACK).
adb_shell Execute

Run an adb shell command. Dangerous commands (rm -rf, reboot, wipe, …) are rejected. Risk 3.
adb_start_app Execute

Start an app by package/activity.
adb_stop_app Execute

Force-stop an app by package.
adb_swipe Execute

Swipe between coordinates.
adb_tap Execute

Tap at x,y.
agent_run Execute

${DEPRECATED} Delegate to a local coding agent. mode=plan returns a plan; mode=execute starts an execution task.
approval_approve Execute

Approve a pending request. scope
autopilot Execute

Delegate a natural-language local task to LocalAnt
bash Execute

Run a shell command (bash -c) inside an allowed directory. Pipelines and && chaining work. Blocked commands (sudo, rm -rf, dd, mkfs, …) are always rejected. Risk 3.
browser_click Execute

Click an element by selector.
browser_close Execute

Close the browser.
browser_evaluate Execute

Evaluate JavaScript in the page context (risk 4).
browser_open Execute

Open a URL in an isolated browser and return the title.
browser_press Execute

Press a keyboard key (e.g. Enter, Tab).
browser_scroll Execute

Scroll the page by (x, y) pixels.
browser_select Execute

Select an option in a <select> by selector + value.
browser_type Execute

Type into an input by selector.
browser_wait_for Execute

Wait for a selector to appear.
coding_agent_continue_task Execute

${DEPRECATED} Continue a task with additional instructions on the same branch.
coding_agent_run_validation Execute

${DEPRECATED} Run a validate/test command in a working directory.
coding_agent_start_task Execute

${DEPRECATED} Start an execution task with a coding agent.
coding_agent_stop_task Execute

${DEPRECATED} Stop a running task.
computer_double_click Execute

Double-click at x,y (screenshot coordinates). Requires approval (risk 3).
computer_drag Execute

Drag from x1,y1 to x2,y2 (screenshot coordinates). Requires approval (risk 3).
computer_left_click Execute

Left-click at x,y (screenshot coordinates). Requires approval (risk 3).
computer_move_mouse Execute

Move the mouse cursor to x,y (screenshot coordinates) without clicking.
computer_open_app Execute

Open (or bring to front) an application by name, e.g.
computer_paste_text Execute

Put text on the clipboard and paste it with Cmd+V (faster and more reliable than computer_type
computer_right_click Execute

Right-click at x,y (screenshot coordinates). Requires approval (risk 3).
computer_scroll Execute

Scroll the focused element by sending Page Up/Down key presses (click the target area first
computer_type Execute

Type text at the current focus (newlines become Return presses). Requires approval (risk 3).
desktop_commander_run_tool Execute

${DEPRECATED} Run a Desktop Commander tool through the MCP bridge.
git_checkout_branch Execute

Checkout an existing branch.
lsp_diagnostics Execute

Run TypeScript diagnostics (tsc --noEmit) for a project path. Falls back to install guidance if tsc is missing.
mcp_server_run_tool Execute

Invoke a tool on a downstream MCP server through the gateway. Risk 3.
openclaw_node_command Execute

${DEPRECATED} Run a command on an OpenClaw node.
openclaw_run_skill Execute

${DEPRECATED} Run an OpenClaw skill.
openclaw_send_session Execute

${DEPRECATED} Send a message to an OpenClaw session.
project_install_deps Execute

Install project dependencies using the detected package manager.
project_run_validation Execute

Run the project
restart_gateway Execute

Reload configuration into the running gateway.
shell_request_command_approval Execute

Request approval to run a command that is NOT on the allowlist. Returns an approval id; once approved, call shell_run_approved_command.
shell_run_allowed_command Execute

Run a command from the allowlist. Pipelines/redirection/chaining are rejected.
shell_run_approved_command Execute

Run an arbitrary command (still subject to the hard blocklist). Requires approval (risk 3).
shell_run_background Execute

Start a long-running command as a tracked background process. Returns a processId.
shell_stop Execute

Stop a tracked background process.
shell_stop_process Execute

Stop a tracked process.
skill_enable Execute

Enable a skill after reviewing its permissions. Validates first.
skill_publish_to_git Execute

Initialize/commit a skill directory ready to push to a git remote.
skill_run Execute

Run a tool exposed by an enabled skill in an isolated subprocess.
tunnel_restart Execute

Restart the public tunnel.
tunnel_start Execute

Start the public tunnel on the live gateway port.
tunnel_stop Execute

Stop the public tunnel.
video_studio_generate_audio Execute

Generate free local narration audio with VOICEVOX first, macOS say preview fallback, or FFmpeg silence fallback.
video_studio_generate_video Execute

Run assets, audio, captions, render, review, and publish_prepare in one local free pipeline.
video_studio_publish_video Execute

Dry-run or prepare a browser/manual publish action. Risk 4 for real publishing.
video_studio_render_video Execute

Render a local upload-ready MP4 with Remotion primary or FFmpeg static-slide fallback.

Attacks that target this class

High-risk tools in any server share these documented attack patterns. Each links to the full case and the defensive policy.

Destructive Action Autonomy
Runaway Tool Loops
Prompt Injection via Tool Results

High-risk tools in LocalAnt

Tools at high risk

Attacks that target this class

More on LocalAnt

Enforce policy on every LocalAnt tool call.