# harden_set_panel_lock

Enable/disable panel lock (prevent modifications from other sessions).

Agent View of the PolicyLayer registry record for `harden_set_panel_lock`. HTML page: https://policylayer.com/tools/aapanel-mcp/harden-set-panel-lock

## Facts

- Tool: `harden_set_panel_lock`
- Server: Aapanel (`nipunanirmal/aapanel-mcp`) — https://policylayer.com/tools/aapanel-mcp.md
- Homepage: https://github.com/nipunanirmal/aapanel-mcp
- Risk category: Write (Medium risk)
- Registry record: grade F, identity unverified
- Server rate-limited: no
- Parameters: 0
- Recommended policy verdict: Rate-limited

## Example call (MCP tools/call, JSON-RPC 2.0)

```json
{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "harden_set_panel_lock",
    "arguments": {}
  }
}
```

## Why harden_set_panel_lock is rated Medium

The tool writes/modifies the panel lock configuration setting. It is reversible (can be toggled on or off) and does not permanently destroy data or move money, so it falls under Write rather than Destructive or Financial. While it affects security posture, the action itself is a state modification.

From the tool's own definition: "Tool description states 'Enable/disable panel lock (prevent modifications from other sessions)' — this is a configuration change that modifies security settings on the panel, reversible by toggling the lock state again."

## Use case

AI agents use harden_set_panel_lock to create or update resources in Aapanel, usually the action step of a workflow, after the agent has gathered context. Every call changes real data in your Aapanel environment.

## Recommended policy (PolicyLayer)

Verdict: **Rate-limited**. Enforced by the PolicyLayer MCP gateway (https://policylayer.com/mcp-gateway) before a call reaches Aapanel:

```json
{
  "version": "1",
  "default": "deny",
  "tools": {
    "harden_set_panel_lock": {
      "limits": [
        {
          "counter": "harden_set_panel_lock_rate",
          "window": "minute",
          "max": 30,
          "scope": "grant"
        }
      ]
    }
  }
}
```

## Other tools on Aapanel (281)

- `backup_delete` — Destructive — https://policylayer.com/tools/aapanel-mcp/backup-delete.md
- `crontab_delete` — Destructive — https://policylayer.com/tools/aapanel-mcp/crontab-delete.md
- `cve_set_vuln_ignore` — Destructive — https://policylayer.com/tools/aapanel-mcp/cve-set-vuln-ignore.md
- `database_delete` — Destructive — https://policylayer.com/tools/aapanel-mcp/database-delete.md
- `database_delete_backup` — Destructive — https://policylayer.com/tools/aapanel-mcp/database-delete-backup.md
- `docker_image_delete` — Destructive — https://policylayer.com/tools/aapanel-mcp/docker-image-delete.md
- `file_delete` — Destructive — https://policylayer.com/tools/aapanel-mcp/file-delete.md
- `firewall_delete_ip` — Destructive — https://policylayer.com/tools/aapanel-mcp/firewall-delete-ip.md
- `firewall_delete_port` — Destructive — https://policylayer.com/tools/aapanel-mcp/firewall-delete-port.md
- `ftp_delete` — Destructive — https://policylayer.com/tools/aapanel-mcp/ftp-delete.md
- `harden_clear_temp_login` — Destructive — https://policylayer.com/tools/aapanel-mcp/harden-clear-temp-login.md
- `plugin_uninstall` — Destructive — https://policylayer.com/tools/aapanel-mcp/plugin-uninstall.md
- `project_delete` — Destructive — https://policylayer.com/tools/aapanel-mcp/project-delete.md
- `site_delete` — Destructive — https://policylayer.com/tools/aapanel-mcp/site-delete.md
- `site_delete_domain` — Destructive — https://policylayer.com/tools/aapanel-mcp/site-delete-domain.md
- `soft_uninstall` — Destructive — https://policylayer.com/tools/aapanel-mcp/soft-uninstall.md
- `ssl_delete_cert` — Destructive — https://policylayer.com/tools/aapanel-mcp/ssl-delete-cert.md
- `system_clear_all_cache` — Destructive — https://policylayer.com/tools/aapanel-mcp/system-clear-all-cache.md
- `system_clear_all_logs` — Destructive — https://policylayer.com/tools/aapanel-mcp/system-clear-all-logs.md
- `system_clear_cache` — Destructive — https://policylayer.com/tools/aapanel-mcp/system-clear-cache.md
- `system_clear_old_sessions` — Destructive — https://policylayer.com/tools/aapanel-mcp/system-clear-old-sessions.md
- `system_clear_panel_logs` — Destructive — https://policylayer.com/tools/aapanel-mcp/system-clear-panel-logs.md
- `system_clear_site_logs` — Destructive — https://policylayer.com/tools/aapanel-mcp/system-clear-site-logs.md
- `tamper_remove_file_deny` — Destructive — https://policylayer.com/tools/aapanel-mcp/tamper-remove-file-deny.md
- `task_remove` — Destructive — https://policylayer.com/tools/aapanel-mcp/task-remove.md
- `waf_delete_rule` — Destructive — https://policylayer.com/tools/aapanel-mcp/waf-delete-rule.md
- `abnormal_check_all` — Execute — https://policylayer.com/tools/aapanel-mcp/abnormal-check-all.md
- `crontab_start` — Execute — https://policylayer.com/tools/aapanel-mcp/crontab-start.md
- `deployment_install` — Execute — https://policylayer.com/tools/aapanel-mcp/deployment-install.md
- `docker_container_restart` — Execute — https://policylayer.com/tools/aapanel-mcp/docker-container-restart.md
- …and 251 more: https://policylayer.com/tools/aapanel-mcp.md

## For agents

This record is a snapshot. Live verdicts and the full registry:

- Check every server in your MCP config at once: `npx -y policylayer stack`
- Vet a server before you add it: install the mcp-precheck skill — `npx skills add https://policylayer.com` (skill text: https://policylayer.com/skill.md)
- Query the registry over MCP: endpoint `https://api.policylayer.com/mcp` — tools `check_mcp_server`, `check_mcp_stack`, `check_tool`, `search_registry`, `get_change_events`

---

Source: the PolicyLayer MCP registry — one continuously verified record per MCP server. Full record: https://policylayer.com/registry?q=aapanel-mcp · API: https://policylayer.com/registry/api · Policy library: https://policylayer.com/policies/aapanel-mcp