# defense_mgmt

Defense: tool checks, workflows, change history, posture, scheduled audits, remediation, reports

Agent View of the PolicyLayer registry record for `defense_mgmt`. HTML page: https://policylayer.com/tools/defense/defense-mgmt

## Facts

- Tool: `defense_mgmt`
- Server: Defense (`defense-mcp-server`) — https://policylayer.com/tools/defense.md
- Install: `npx -y defense-mcp-server`
- Homepage: git+https://github.com/bottobot/defense-mcp-server.git
- Risk category: Write (Medium risk)
- Registry record: grade F, identity unverified
- Server rate-limited: no
- Parameters: 12 (1 required)
- Recommended policy verdict: Rate-limited

## Parameters

| Parameter | Type | Required | Description |
| --- | --- | --- | --- |
| `gate` | boolean | no | Audit gate mode: block if required tools missing |
| `name` | string | no | Audit job name ([a-zA-Z0-9_-] only) |
| `tool` | string | no | Filter by tool name |
| `force` | boolean | no | Force reinstall even if installed |
| `limit` | number | no | Maximum entries to return |
| `lines` | number | no | Number of recent log lines |
| `since` | string | no | Filter by date, e.g. 'today', '2024-01-01' |
| `action` | string | yes | Defense management action |
| `format` | string | no | Report output format |
| `source` | string | no | Source of findings to remediate |
| `command` | string | no | Audit command from approved allowlist |
| `dry_run` | boolean | no | Preview without executing |

Parameters from the server's own tool schema.

## Example call (MCP tools/call, JSON-RPC 2.0)

```json
{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "defense_mgmt",
    "arguments": {
      "action": "<action>"
    }
  }
}
```

## Why defense_mgmt is rated Medium

While the tool includes read components (checks, reports, posture visibility), the presence of remediation capabilities and change tracking indicates it performs reversible modifications to system configurations and security policies. This is Write-category behavior rather than Read-only, as it alters defensive system states.

From the tool's own definition: "Tool description mentions 'change history', 'remediation', and 'scheduled audits' — these are write operations that modify system state. The term 'remediation' specifically indicates the tool makes corrective changes to security posture."

Risk signals: High parameter count (26 properties)

## Use case

AI agents use defense_mgmt to create or update resources in Defense, usually the action step of a workflow, after the agent has gathered context. Every call changes real data in your Defense environment.

## Recommended policy (PolicyLayer)

Verdict: **Rate-limited**. Enforced by the PolicyLayer MCP gateway (https://policylayer.com/mcp-gateway) before a call reaches Defense:

```json
{
  "version": "1",
  "default": "deny",
  "tools": {
    "defense_mgmt": {
      "limits": [
        {
          "counter": "defense_mgmt_rate",
          "window": "minute",
          "max": 30,
          "scope": "grant"
        }
      ]
    }
  }
}
```

## Other tools on Defense (30)

- `app_harden` — Execute — https://policylayer.com/tools/defense/app-harden.md
- `container_isolation` — Execute — https://policylayer.com/tools/defense/container-isolation.md
- `crypto` — Execute — https://policylayer.com/tools/defense/crypto.md
- `ebpf` — Execute — https://policylayer.com/tools/defense/ebpf.md
- `firewall` — Execute — https://policylayer.com/tools/defense/firewall.md
- `harden_kernel` — Execute — https://policylayer.com/tools/defense/harden-kernel.md
- `honeypot_manage` — Execute — https://policylayer.com/tools/defense/honeypot-manage.md
- `incident_response` — Execute — https://policylayer.com/tools/defense/incident-response.md
- `malware` — Execute — https://policylayer.com/tools/defense/malware.md
- `sudo_session` — Execute — https://policylayer.com/tools/defense/sudo-session.md
- `vuln_manage` — Execute — https://policylayer.com/tools/defense/vuln-manage.md
- `waf_manage` — Execute — https://policylayer.com/tools/defense/waf-manage.md
- `wireless_security` — Execute — https://policylayer.com/tools/defense/wireless-security.md
- `zero_trust` — Execute — https://policylayer.com/tools/defense/zero-trust.md
- `api_security` — Read — https://policylayer.com/tools/defense/api-security.md
- `cloud_security` — Read — https://policylayer.com/tools/defense/cloud-security.md
- `dns_security` — Read — https://policylayer.com/tools/defense/dns-security.md
- `secrets` — Read — https://policylayer.com/tools/defense/secrets.md
- `access_control` — Write — https://policylayer.com/tools/defense/access-control.md
- `backup` — Write — https://policylayer.com/tools/defense/backup.md
- `compliance` — Write — https://policylayer.com/tools/defense/compliance.md
- `container_docker` — Write — https://policylayer.com/tools/defense/container-docker.md
- `harden_host` — Write — https://policylayer.com/tools/defense/harden-host.md
- `integrity` — Write — https://policylayer.com/tools/defense/integrity.md
- `log_management` — Write — https://policylayer.com/tools/defense/log-management.md
- `network_defense` — Write — https://policylayer.com/tools/defense/network-defense.md
- `patch` — Write — https://policylayer.com/tools/defense/patch.md
- `process_security` — Write — https://policylayer.com/tools/defense/process-security.md
- `supply_chain` — Write — https://policylayer.com/tools/defense/supply-chain.md
- `threat_intel` — Write — https://policylayer.com/tools/defense/threat-intel.md

## For agents

This record is a snapshot. Live verdicts and the full registry:

- Check every server in your MCP config at once: `npx -y policylayer stack`
- Vet a server before you add it: install the mcp-precheck skill — `npx skills add https://policylayer.com` (skill text: https://policylayer.com/skill.md)
- Query the registry over MCP: endpoint `https://api.policylayer.com/mcp` — tools `check_mcp_server`, `check_mcp_stack`, `check_tool`, `search_registry`, `get_change_events`

---

Source: the PolicyLayer MCP registry — one continuously verified record per MCP server. Full record: https://policylayer.com/registry?q=defense · API: https://policylayer.com/registry/api · Policy library: https://policylayer.com/policies/defense