# harden_set_password_safe

Set password complexity requirements for panel accounts.

Agent View of the PolicyLayer registry record for `harden_set_password_safe`. HTML page: https://policylayer.com/tools/aapanel-mcp/harden-set-password-safe

## Facts

- Tool: `harden_set_password_safe`
- Server: Aapanel (`nipunanirmal/aapanel-mcp`) — https://policylayer.com/tools/aapanel-mcp.md
- Homepage: https://github.com/nipunanirmal/aapanel-mcp
- Risk category: Write (Medium risk)
- Registry record: grade F, identity unverified
- Server rate-limited: no
- Parameters: 0
- Recommended policy verdict: Rate-limited

## Example call (MCP tools/call, JSON-RPC 2.0)

```json
{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "harden_set_password_safe",
    "arguments": {}
  }
}
```

## Why harden_set_password_safe is rated Medium

This tool creates or modifies security policy settings (password requirements) reversibly. It does not delete data, execute arbitrary commands, move money, or trigger external operations. While it affects security posture, the change is non-destructive and can be reverted.

From the tool's own definition: "Tool name contains 'set_' and description states 'Set password complexity requirements' — modifies configuration settings for panel accounts."

## Use case

AI agents use harden_set_password_safe to create or update resources in Aapanel, usually the action step of a workflow, after the agent has gathered context. Every call changes real data in your Aapanel environment.

## Recommended policy (PolicyLayer)

Verdict: **Rate-limited**. Enforced by the PolicyLayer MCP gateway (https://policylayer.com/mcp-gateway) before a call reaches Aapanel:

```json
{
  "version": "1",
  "default": "deny",
  "tools": {
    "harden_set_password_safe": {
      "limits": [
        {
          "counter": "harden_set_password_safe_rate",
          "window": "minute",
          "max": 30,
          "scope": "grant"
        }
      ]
    }
  }
}
```

## Other tools on Aapanel (281)

- `backup_delete` — Destructive — https://policylayer.com/tools/aapanel-mcp/backup-delete.md
- `crontab_delete` — Destructive — https://policylayer.com/tools/aapanel-mcp/crontab-delete.md
- `cve_set_vuln_ignore` — Destructive — https://policylayer.com/tools/aapanel-mcp/cve-set-vuln-ignore.md
- `database_delete` — Destructive — https://policylayer.com/tools/aapanel-mcp/database-delete.md
- `database_delete_backup` — Destructive — https://policylayer.com/tools/aapanel-mcp/database-delete-backup.md
- `docker_image_delete` — Destructive — https://policylayer.com/tools/aapanel-mcp/docker-image-delete.md
- `file_delete` — Destructive — https://policylayer.com/tools/aapanel-mcp/file-delete.md
- `firewall_delete_ip` — Destructive — https://policylayer.com/tools/aapanel-mcp/firewall-delete-ip.md
- `firewall_delete_port` — Destructive — https://policylayer.com/tools/aapanel-mcp/firewall-delete-port.md
- `ftp_delete` — Destructive — https://policylayer.com/tools/aapanel-mcp/ftp-delete.md
- `harden_clear_temp_login` — Destructive — https://policylayer.com/tools/aapanel-mcp/harden-clear-temp-login.md
- `plugin_uninstall` — Destructive — https://policylayer.com/tools/aapanel-mcp/plugin-uninstall.md
- `project_delete` — Destructive — https://policylayer.com/tools/aapanel-mcp/project-delete.md
- `site_delete` — Destructive — https://policylayer.com/tools/aapanel-mcp/site-delete.md
- `site_delete_domain` — Destructive — https://policylayer.com/tools/aapanel-mcp/site-delete-domain.md
- `soft_uninstall` — Destructive — https://policylayer.com/tools/aapanel-mcp/soft-uninstall.md
- `ssl_delete_cert` — Destructive — https://policylayer.com/tools/aapanel-mcp/ssl-delete-cert.md
- `system_clear_all_cache` — Destructive — https://policylayer.com/tools/aapanel-mcp/system-clear-all-cache.md
- `system_clear_all_logs` — Destructive — https://policylayer.com/tools/aapanel-mcp/system-clear-all-logs.md
- `system_clear_cache` — Destructive — https://policylayer.com/tools/aapanel-mcp/system-clear-cache.md
- `system_clear_old_sessions` — Destructive — https://policylayer.com/tools/aapanel-mcp/system-clear-old-sessions.md
- `system_clear_panel_logs` — Destructive — https://policylayer.com/tools/aapanel-mcp/system-clear-panel-logs.md
- `system_clear_site_logs` — Destructive — https://policylayer.com/tools/aapanel-mcp/system-clear-site-logs.md
- `tamper_remove_file_deny` — Destructive — https://policylayer.com/tools/aapanel-mcp/tamper-remove-file-deny.md
- `task_remove` — Destructive — https://policylayer.com/tools/aapanel-mcp/task-remove.md
- `waf_delete_rule` — Destructive — https://policylayer.com/tools/aapanel-mcp/waf-delete-rule.md
- `abnormal_check_all` — Execute — https://policylayer.com/tools/aapanel-mcp/abnormal-check-all.md
- `crontab_start` — Execute — https://policylayer.com/tools/aapanel-mcp/crontab-start.md
- `deployment_install` — Execute — https://policylayer.com/tools/aapanel-mcp/deployment-install.md
- `docker_container_restart` — Execute — https://policylayer.com/tools/aapanel-mcp/docker-container-restart.md
- …and 251 more: https://policylayer.com/tools/aapanel-mcp.md

## For agents

This record is a snapshot. Live verdicts and the full registry:

- Check every server in your MCP config at once: `npx -y policylayer stack`
- Vet a server before you add it: install the mcp-precheck skill — `npx skills add https://policylayer.com` (skill text: https://policylayer.com/skill.md)
- Query the registry over MCP: endpoint `https://api.policylayer.com/mcp` — tools `check_mcp_server`, `check_mcp_stack`, `check_tool`, `search_registry`, `get_change_events`

---

Source: the PolicyLayer MCP registry — one continuously verified record per MCP server. Full record: https://policylayer.com/registry?q=aapanel-mcp · API: https://policylayer.com/registry/api · Policy library: https://policylayer.com/policies/aapanel-mcp