pfsense_replace_services_dns_forwarder_host_overrides

What pfsense_replace_services_dns_forwarder_host_overrides does on Pfsense

AI agents use pfsense_replace_services_dns_forwarder_host_overrides to create or update resources in Pfsense, usually the action step of a workflow, after the agent has gathered context. Every call changes real data in your Pfsense environment.

Why pfsense_replace_services_dns_forwarder_host_overrides is rated Medium

This tool modifies DNS forwarder host overrides through a PUT operation, making it a Write action. While not destructive (changes are reversible), it has high severity because unauthorized DNS configuration changes could redirect network traffic to malicious hosts, enabling man-in-the-middle attacks, credential theft, or service disruption across all clients using this pfSense firewall as their DNS resolver.

From the tool's definition Tool name contains 'replace' and performs PUT /api/v2/services/dns_forwarder/host_overrides, which modifies DNS host override configurations. The 'replace' operation updates existing DNS forwarder settings that control hostname-to-IP mappings.

The rule that runs pfsense_replace_services_dns_forwarder_host_overrides safely

PolicyLayer is an MCP gateway: it sits between your AI agents and Pfsense, and checks every tool call against a rule you set before the call runs. Nothing changes on the server itself. For pfsense_replace_services_dns_forwarder_host_overrides, this is the rule to start with:

{
  "version": "1",
  "default": "deny",
  "tools": {
    "pfsense_replace_services_dns_forwarder_host_overrides": {
      "limits": [
        {
          "counter": "pfsense_replace_services_dns_forwarder_host_overrides_rate",
          "window": "minute",
          "max": 30,
          "scope": "grant"
        }
      ]
    }
  }
}

Questions about pfsense_replace_services_dns_forwarder_host_overrides