# harden_set_admin_path

Change the panel admin access URL path (security URL suffix for hardening).

Agent View of the PolicyLayer registry record for `harden_set_admin_path`. HTML page: https://policylayer.com/tools/aapanel-mcp/harden-set-admin-path

## Facts

- Tool: `harden_set_admin_path`
- Server: Aapanel (`nipunanirmal/aapanel-mcp`) — https://policylayer.com/tools/aapanel-mcp.md
- Homepage: https://github.com/nipunanirmal/aapanel-mcp
- Risk category: Write (Medium risk)
- Registry record: grade F, identity unverified
- Server rate-limited: no
- Parameters: 0
- Recommended policy verdict: Rate-limited

## Example call (MCP tools/call, JSON-RPC 2.0)

```json
{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "harden_set_admin_path",
    "arguments": {}
  }
}
```

## Why harden_set_admin_path is rated Medium

This tool modifies security configuration (admin panel URL path) reversibly; a new path can be set again. It does not execute arbitrary code, delete data, move funds, or execute external operations based on dynamic arguments. While the security implications are significant (misconfiguration could lock out legitimate admins or expose the panel), the action itself is a straightforward configuration write.

From the tool's own definition: "Tool description states 'Change the panel admin access URL path' – this modifies configuration data (the admin URL suffix) that is stored and used by the system. The term 'Change' explicitly indicates a modification operation."

Risk signals: Admin/system-level operation

## Use case

AI agents use harden_set_admin_path to create or update resources in Aapanel, usually the action step of a workflow, after the agent has gathered context. Every call changes real data in your Aapanel environment.

## Recommended policy (PolicyLayer)

Verdict: **Rate-limited**. Enforced by the PolicyLayer MCP gateway (https://policylayer.com/mcp-gateway) before a call reaches Aapanel:

```json
{
  "version": "1",
  "default": "deny",
  "tools": {
    "harden_set_admin_path": {
      "limits": [
        {
          "counter": "harden_set_admin_path_rate",
          "window": "minute",
          "max": 30,
          "scope": "grant"
        }
      ]
    }
  }
}
```

## Other tools on Aapanel (281)

- `backup_delete` — Destructive — https://policylayer.com/tools/aapanel-mcp/backup-delete.md
- `crontab_delete` — Destructive — https://policylayer.com/tools/aapanel-mcp/crontab-delete.md
- `cve_set_vuln_ignore` — Destructive — https://policylayer.com/tools/aapanel-mcp/cve-set-vuln-ignore.md
- `database_delete` — Destructive — https://policylayer.com/tools/aapanel-mcp/database-delete.md
- `database_delete_backup` — Destructive — https://policylayer.com/tools/aapanel-mcp/database-delete-backup.md
- `docker_image_delete` — Destructive — https://policylayer.com/tools/aapanel-mcp/docker-image-delete.md
- `file_delete` — Destructive — https://policylayer.com/tools/aapanel-mcp/file-delete.md
- `firewall_delete_ip` — Destructive — https://policylayer.com/tools/aapanel-mcp/firewall-delete-ip.md
- `firewall_delete_port` — Destructive — https://policylayer.com/tools/aapanel-mcp/firewall-delete-port.md
- `ftp_delete` — Destructive — https://policylayer.com/tools/aapanel-mcp/ftp-delete.md
- `harden_clear_temp_login` — Destructive — https://policylayer.com/tools/aapanel-mcp/harden-clear-temp-login.md
- `plugin_uninstall` — Destructive — https://policylayer.com/tools/aapanel-mcp/plugin-uninstall.md
- `project_delete` — Destructive — https://policylayer.com/tools/aapanel-mcp/project-delete.md
- `site_delete` — Destructive — https://policylayer.com/tools/aapanel-mcp/site-delete.md
- `site_delete_domain` — Destructive — https://policylayer.com/tools/aapanel-mcp/site-delete-domain.md
- `soft_uninstall` — Destructive — https://policylayer.com/tools/aapanel-mcp/soft-uninstall.md
- `ssl_delete_cert` — Destructive — https://policylayer.com/tools/aapanel-mcp/ssl-delete-cert.md
- `system_clear_all_cache` — Destructive — https://policylayer.com/tools/aapanel-mcp/system-clear-all-cache.md
- `system_clear_all_logs` — Destructive — https://policylayer.com/tools/aapanel-mcp/system-clear-all-logs.md
- `system_clear_cache` — Destructive — https://policylayer.com/tools/aapanel-mcp/system-clear-cache.md
- `system_clear_old_sessions` — Destructive — https://policylayer.com/tools/aapanel-mcp/system-clear-old-sessions.md
- `system_clear_panel_logs` — Destructive — https://policylayer.com/tools/aapanel-mcp/system-clear-panel-logs.md
- `system_clear_site_logs` — Destructive — https://policylayer.com/tools/aapanel-mcp/system-clear-site-logs.md
- `tamper_remove_file_deny` — Destructive — https://policylayer.com/tools/aapanel-mcp/tamper-remove-file-deny.md
- `task_remove` — Destructive — https://policylayer.com/tools/aapanel-mcp/task-remove.md
- `waf_delete_rule` — Destructive — https://policylayer.com/tools/aapanel-mcp/waf-delete-rule.md
- `abnormal_check_all` — Execute — https://policylayer.com/tools/aapanel-mcp/abnormal-check-all.md
- `crontab_start` — Execute — https://policylayer.com/tools/aapanel-mcp/crontab-start.md
- `deployment_install` — Execute — https://policylayer.com/tools/aapanel-mcp/deployment-install.md
- `docker_container_restart` — Execute — https://policylayer.com/tools/aapanel-mcp/docker-container-restart.md
- …and 251 more: https://policylayer.com/tools/aapanel-mcp.md

## For agents

This record is a snapshot. Live verdicts and the full registry:

- Check every server in your MCP config at once: `npx -y policylayer stack`
- Vet a server before you add it: install the mcp-precheck skill — `npx skills add https://policylayer.com` (skill text: https://policylayer.com/skill.md)
- Query the registry over MCP: endpoint `https://api.policylayer.com/mcp` — tools `check_mcp_server`, `check_mcp_stack`, `check_tool`, `search_registry`, `get_change_events`

---

Source: the PolicyLayer MCP registry — one continuously verified record per MCP server. Full record: https://policylayer.com/registry?q=aapanel-mcp · API: https://policylayer.com/registry/api · Policy library: https://policylayer.com/policies/aapanel-mcp