# runBeaconInterpreterC

Execute Beacon Interpreter C source using /execute/interpreter/pack.

Agent View of the PolicyLayer registry record for `runBeaconInterpreterC`. HTML page: https://policylayer.com/tools/cobalt-strike-cobaltstrike-mcp-server/runbeaconinterpreterc

## Facts

- Tool: `runBeaconInterpreterC`
- Server: Cobalt Strike MCP Server (`cobalt-strike/cobaltstrike-mcp-server`) — https://policylayer.com/tools/cobalt-strike-cobaltstrike-mcp-server.md
- Homepage: https://github.com/Cobalt-Strike/cobaltstrike-mcp-server
- Risk category: Execute (High risk)
- Registry record: grade F, identity unverified
- Server rate-limited: no
- Parameters: 0
- Recommended policy verdict: Rate-limited

## Example call (MCP tools/call, JSON-RPC 2.0)

```json
{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "runBeaconInterpreterC",
    "arguments": {}
  }
}
```

## Why runBeaconInterpreterC is rated High

This tool executes arbitrary C code through Cobalt Strike's Beacon interpreter on remote systems. This is a classic Execute category tool with critical severity due to its capability to run unrestricted code on compromised endpoints, potentially allowing lateral movement, privilege escalation, data exfiltration, or system compromise.

From the tool's own definition: "Tool name contains 'Execute' and description states 'Execute Beacon Interpreter C source'. Beacon Interpreter is a Cobalt Strike C2 feature for running arbitrary code on compromised hosts."

## Use case

AI agents invoke runBeaconInterpreterC to trigger actions in Cobalt Strike MCP Server. What it does depends on the arguments the agent supplies, and its effects often reach beyond the immediate call: builds kicked off, notifications sent, workflows started.

## Recommended policy (PolicyLayer)

Verdict: **Rate-limited**. Enforced by the PolicyLayer MCP gateway (https://policylayer.com/mcp-gateway) before a call reaches Cobalt Strike MCP Server:

```json
{
  "version": "1",
  "default": "deny",
  "tools": {
    "runBeaconInterpreterC": {
      "limits": [
        {
          "counter": "runbeaconinterpreterc_rate",
          "window": "minute",
          "max": 10,
          "scope": "grant"
        }
      ]
    }
  }
}
```

## Other tools on Cobalt Strike MCP Server (8)

- `executeBeaconConsoleAndWait` — Execute — https://policylayer.com/tools/cobalt-strike-cobaltstrike-mcp-server/executebeaconconsoleandwait.md
- `lintBeaconInterpreterC` — Execute — https://policylayer.com/tools/cobalt-strike-cobaltstrike-mcp-server/lintbeaconinterpreterc.md
- `startCobaltStrikeWebsocketStreams` — Execute — https://policylayer.com/tools/cobalt-strike-cobaltstrike-mcp-server/startcobaltstrikewebsocketstreams.md
- `getBeaconConsoleTail` — Read — https://policylayer.com/tools/cobalt-strike-cobaltstrike-mcp-server/getbeaconconsoletail.md
- `getCobaltStrikeWebsocketStatus` — Read — https://policylayer.com/tools/cobalt-strike-cobaltstrike-mcp-server/getcobaltstrikewebsocketstatus.md
- `getDownloadedFileText` — Read — https://policylayer.com/tools/cobalt-strike-cobaltstrike-mcp-server/getdownloadedfiletext.md
- `getLiveBeaconSnapshot` — Read — https://policylayer.com/tools/cobalt-strike-cobaltstrike-mcp-server/getlivebeaconsnapshot.md
- `getRecentEventLogTail` — Read — https://policylayer.com/tools/cobalt-strike-cobaltstrike-mcp-server/getrecenteventlogtail.md

## For agents

This record is a snapshot. Live verdicts and the full registry:

- Check every server in your MCP config at once: `npx -y policylayer stack`
- Vet a server before you add it: install the mcp-precheck skill — `npx skills add https://policylayer.com` (skill text: https://policylayer.com/skill.md)
- Query the registry over MCP: endpoint `https://api.policylayer.com/mcp` — tools `check_mcp_server`, `check_mcp_stack`, `check_tool`, `search_registry`, `get_change_events`

---

Source: the PolicyLayer MCP registry — one continuously verified record per MCP server. Full record: https://policylayer.com/registry?q=cobalt-strike-cobaltstrike-mcp-server · API: https://policylayer.com/registry/api · Policy library: https://policylayer.com/policies/cobalt-strike-cobaltstrike-mcp-server