# harden_set_two_step_auth

Enable/disable two-factor authentication (2FA/TOTP) for a panel user.

Agent View of the PolicyLayer registry record for `harden_set_two_step_auth`. HTML page: https://policylayer.com/tools/aapanel-mcp/harden-set-two-step-auth

## Facts

- Tool: `harden_set_two_step_auth`
- Server: Aapanel (`nipunanirmal/aapanel-mcp`) — https://policylayer.com/tools/aapanel-mcp.md
- Homepage: https://github.com/nipunanirmal/aapanel-mcp
- Risk category: Write (Medium risk)
- Registry record: grade F, identity unverified
- Server rate-limited: no
- Parameters: 0
- Recommended policy verdict: Rate-limited

## Example call (MCP tools/call, JSON-RPC 2.0)

```json
{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "harden_set_two_step_auth",
    "arguments": {}
  }
}
```

## Why harden_set_two_step_auth is rated Medium

This tool modifies user authentication settings by toggling 2FA status. While reversible (can be re-enabled or disabled), it affects user account security and could lock users out or weaken security depending on how it's invoked. It does not execute arbitrary code, delete data, or move money, so Write is the appropriate category.

From the tool's own definition: "Tool name 'harden_set_two_step_auth' and description 'Enable/disable two-factor authentication' indicate creation/modification of user security settings. The verb 'set' and the action of enabling/disabling 2FA are reversible configuration changes."

## Use case

AI agents use harden_set_two_step_auth to create or update resources in Aapanel, usually the action step of a workflow, after the agent has gathered context. Every call changes real data in your Aapanel environment.

## Recommended policy (PolicyLayer)

Verdict: **Rate-limited**. Enforced by the PolicyLayer MCP gateway (https://policylayer.com/mcp-gateway) before a call reaches Aapanel:

```json
{
  "version": "1",
  "default": "deny",
  "tools": {
    "harden_set_two_step_auth": {
      "limits": [
        {
          "counter": "harden_set_two_step_auth_rate",
          "window": "minute",
          "max": 30,
          "scope": "grant"
        }
      ]
    }
  }
}
```

## Other tools on Aapanel (281)

- `backup_delete` — Destructive — https://policylayer.com/tools/aapanel-mcp/backup-delete.md
- `crontab_delete` — Destructive — https://policylayer.com/tools/aapanel-mcp/crontab-delete.md
- `cve_set_vuln_ignore` — Destructive — https://policylayer.com/tools/aapanel-mcp/cve-set-vuln-ignore.md
- `database_delete` — Destructive — https://policylayer.com/tools/aapanel-mcp/database-delete.md
- `database_delete_backup` — Destructive — https://policylayer.com/tools/aapanel-mcp/database-delete-backup.md
- `docker_image_delete` — Destructive — https://policylayer.com/tools/aapanel-mcp/docker-image-delete.md
- `file_delete` — Destructive — https://policylayer.com/tools/aapanel-mcp/file-delete.md
- `firewall_delete_ip` — Destructive — https://policylayer.com/tools/aapanel-mcp/firewall-delete-ip.md
- `firewall_delete_port` — Destructive — https://policylayer.com/tools/aapanel-mcp/firewall-delete-port.md
- `ftp_delete` — Destructive — https://policylayer.com/tools/aapanel-mcp/ftp-delete.md
- `harden_clear_temp_login` — Destructive — https://policylayer.com/tools/aapanel-mcp/harden-clear-temp-login.md
- `plugin_uninstall` — Destructive — https://policylayer.com/tools/aapanel-mcp/plugin-uninstall.md
- `project_delete` — Destructive — https://policylayer.com/tools/aapanel-mcp/project-delete.md
- `site_delete` — Destructive — https://policylayer.com/tools/aapanel-mcp/site-delete.md
- `site_delete_domain` — Destructive — https://policylayer.com/tools/aapanel-mcp/site-delete-domain.md
- `soft_uninstall` — Destructive — https://policylayer.com/tools/aapanel-mcp/soft-uninstall.md
- `ssl_delete_cert` — Destructive — https://policylayer.com/tools/aapanel-mcp/ssl-delete-cert.md
- `system_clear_all_cache` — Destructive — https://policylayer.com/tools/aapanel-mcp/system-clear-all-cache.md
- `system_clear_all_logs` — Destructive — https://policylayer.com/tools/aapanel-mcp/system-clear-all-logs.md
- `system_clear_cache` — Destructive — https://policylayer.com/tools/aapanel-mcp/system-clear-cache.md
- `system_clear_old_sessions` — Destructive — https://policylayer.com/tools/aapanel-mcp/system-clear-old-sessions.md
- `system_clear_panel_logs` — Destructive — https://policylayer.com/tools/aapanel-mcp/system-clear-panel-logs.md
- `system_clear_site_logs` — Destructive — https://policylayer.com/tools/aapanel-mcp/system-clear-site-logs.md
- `tamper_remove_file_deny` — Destructive — https://policylayer.com/tools/aapanel-mcp/tamper-remove-file-deny.md
- `task_remove` — Destructive — https://policylayer.com/tools/aapanel-mcp/task-remove.md
- `waf_delete_rule` — Destructive — https://policylayer.com/tools/aapanel-mcp/waf-delete-rule.md
- `abnormal_check_all` — Execute — https://policylayer.com/tools/aapanel-mcp/abnormal-check-all.md
- `crontab_start` — Execute — https://policylayer.com/tools/aapanel-mcp/crontab-start.md
- `deployment_install` — Execute — https://policylayer.com/tools/aapanel-mcp/deployment-install.md
- `docker_container_restart` — Execute — https://policylayer.com/tools/aapanel-mcp/docker-container-restart.md
- …and 251 more: https://policylayer.com/tools/aapanel-mcp.md

## For agents

This record is a snapshot. Live verdicts and the full registry:

- Check every server in your MCP config at once: `npx -y policylayer stack`
- Vet a server before you add it: install the mcp-precheck skill — `npx skills add https://policylayer.com` (skill text: https://policylayer.com/skill.md)
- Query the registry over MCP: endpoint `https://api.policylayer.com/mcp` — tools `check_mcp_server`, `check_mcp_stack`, `check_tool`, `search_registry`, `get_change_events`

---

Source: the PolicyLayer MCP registry — one continuously verified record per MCP server. Full record: https://policylayer.com/registry?q=aapanel-mcp · API: https://policylayer.com/registry/api · Policy library: https://policylayer.com/policies/aapanel-mcp