# evidence_delete_attachment

Delete an attachment from a record.

Agent View of the PolicyLayer registry record for `evidence_delete_attachment`. HTML page: https://policylayer.com/tools/abraflexi/evidence-delete-attachment

## Facts

- Tool: `evidence_delete_attachment`
- Server: AbraFlexi (`abraflexi-mcp-server`) — https://policylayer.com/tools/abraflexi.md
- Install: `npx -y abraflexi-mcp-server`
- Homepage: https://github.com/VitexSoftware/abraflexi-mcp-server
- Risk category: Destructive (Critical risk)
- Registry record: grade F, identity verified
- Server rate-limited: no
- Parameters: 0
- Recommended policy verdict: Hidden

## Example call (MCP tools/call, JSON-RPC 2.0)

```json
{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "evidence_delete_attachment",
    "arguments": {}
  }
}
```

## Why evidence_delete_attachment is rated Critical

The tool permanently removes an attachment, which cannot be undone. While the blast radius is somewhat limited (one attachment per call), deletion operations are inherently destructive. The presence of other financial tools (bank_transaction_create) on the server raises the risk profile, as a compromised agent could target important financial documents attached to records.

From the tool's own definition: "Tool name contains 'delete' and description states 'Delete an attachment from a record.' This is an irreversible deletion operation."

## Use case

AI agents call evidence_delete_attachment to permanently remove resources in AbraFlexi, typically in cleanup and lifecycle workflows. It does its job in a single call, and there is no undo.

## Recommended policy (PolicyLayer)

Verdict: **Hidden**. Enforced by the PolicyLayer MCP gateway (https://policylayer.com/mcp-gateway) before a call reaches AbraFlexi:

```json
{
  "version": "1",
  "default": "deny",
  "hide": [
    "evidence_delete_attachment"
  ]
}
```

## Other tools on AbraFlexi (63)

- `contact_delete` — Destructive — https://policylayer.com/tools/abraflexi/contact-delete.md
- `evidence_delete` — Destructive — https://policylayer.com/tools/abraflexi/evidence-delete.md
- `evidence_storno` — Destructive — https://policylayer.com/tools/abraflexi/evidence-storno.md
- `invoice_issued_delete` — Destructive — https://policylayer.com/tools/abraflexi/invoice-issued-delete.md
- `invoice_issued_unlink_zdd` — Destructive — https://policylayer.com/tools/abraflexi/invoice-issued-unlink-zdd.md
- `product_delete` — Destructive — https://policylayer.com/tools/abraflexi/product-delete.md
- `evidence_perform_action` — Execute — https://policylayer.com/tools/abraflexi/evidence-perform-action.md
- `bank_transaction_create` — Financial — https://policylayer.com/tools/abraflexi/bank-transaction-create.md
- `invoice_issued_cash_payment` — Financial — https://policylayer.com/tools/abraflexi/invoice-issued-cash-payment.md
- `invoice_issued_deduct_advance` — Financial — https://policylayer.com/tools/abraflexi/invoice-issued-deduct-advance.md
- `invoice_issued_deduct_zdd` — Financial — https://policylayer.com/tools/abraflexi/invoice-issued-deduct-zdd.md
- `invoice_issued_match_payment` — Financial — https://policylayer.com/tools/abraflexi/invoice-issued-match-payment.md
- `invoice_issued_link_zdd` — Other — https://policylayer.com/tools/abraflexi/invoice-issued-link-zdd.md
- `bank_transaction_get` — Read — https://policylayer.com/tools/abraflexi/bank-transaction-get.md
- `call_user_query` — Read — https://policylayer.com/tools/abraflexi/call-user-query.md
- `changes_get` — Read — https://policylayer.com/tools/abraflexi/changes-get.md
- `changes_status` — Read — https://policylayer.com/tools/abraflexi/changes-status.md
- `contact_get` — Read — https://policylayer.com/tools/abraflexi/contact-get.md
- `contact_get_any_phone` — Read — https://policylayer.com/tools/abraflexi/contact-get-any-phone.md
- `contact_get_bank_accounts` — Read — https://policylayer.com/tools/abraflexi/contact-get-bank-accounts.md
- `contact_get_cell_phone` — Read — https://policylayer.com/tools/abraflexi/contact-get-cell-phone.md
- `contact_get_notification_email` — Read — https://policylayer.com/tools/abraflexi/contact-get-notification-email.md
- `evidence_download_attachment` — Read — https://policylayer.com/tools/abraflexi/evidence-download-attachment.md
- `evidence_get` — Read — https://policylayer.com/tools/abraflexi/evidence-get.md
- `evidence_get_attachment` — Read — https://policylayer.com/tools/abraflexi/evidence-get-attachment.md
- `evidence_get_attachment_thumbnail` — Read — https://policylayer.com/tools/abraflexi/evidence-get-attachment-thumbnail.md
- `evidence_get_labels` — Read — https://policylayer.com/tools/abraflexi/evidence-get-labels.md
- `evidence_get_properties` — Read — https://policylayer.com/tools/abraflexi/evidence-get-properties.md
- `evidence_get_qr_code` — Read — https://policylayer.com/tools/abraflexi/evidence-get-qr-code.md
- `evidence_get_record_changes` — Read — https://policylayer.com/tools/abraflexi/evidence-get-record-changes.md
- …and 33 more: https://policylayer.com/tools/abraflexi.md

## For agents

This record is a snapshot. Live verdicts and the full registry:

- Check every server in your MCP config at once: `npx -y policylayer stack`
- Vet a server before you add it: install the mcp-precheck skill — `npx skills add https://policylayer.com` (skill text: https://policylayer.com/skill.md)
- Query the registry over MCP: endpoint `https://api.policylayer.com/mcp` — tools `check_mcp_server`, `check_mcp_stack`, `check_tool`, `search_registry`, `get_change_events`

---

Source: the PolicyLayer MCP registry — one continuously verified record per MCP server. Full record: https://policylayer.com/registry?q=abraflexi · API: https://policylayer.com/registry/api · Policy library: https://policylayer.com/policies/abraflexi