New Your team’s decisions, in one playbook every coding agent works from. Never answer your agent twice
46482 tools

DESTRUCTIVE MCP TOOLS

Tools that permanently delete or destroy resources. Critical risk -- block by default.

Severity: Critical severity →

Real-world attack patterns documented against destructive-class MCP tools. Each links to the full case and the defensive policy.

Browse the full MCP Attack Database →

delete_action_rule Remove an automation (an action rule) from a table. Cannot be undone. Ids come from list_action_rules. delete_calendar Remove a calendar from the project and from every portal menu that shows it. Cannot be undone. Ids come from list_calendars. delete_chart Remove a chart from the project and from every portal menu that shows it. Cannot be undone. Ids come from list_charts. delete_dashboard_item Remove a card (widget) from a portal's dashboard. Only the card goes; the table, report or chart it showed stays. The person confirms it first. delete_few_records Видалити декілька записів одним запитом delete_field Delete a field (column, property) from a form. Irreversible — all data in this field will be lost. (remove field, drop column) delete_form Видалити форму та всі її записи. Незворотна операція. Не можна видалити єдину форму. delete_formatting Remove a formatting rule. The person confirms it first. delete_map Remove a map from the project and from every portal menu that shows it. Cannot be undone. Ids come from list_maps. delete_portal Remove a whole portal: its pages, menu, dashboard and its portal users' accounts. The tables and records stay. The person confirms it first; it can... delete_portal_group Видалити групу порталу разом з правами і учасниками. delete_portal_menu_item Видалити пункт меню порталу. section_id для top-level, item_id для підпункту підменю. + 69 more Every QuintaDB tool, risk-classified, on the server page.
answer_google_business_question Post the business’s answer to a public question on the brand’s Google Business Profile listing, or delete the answer already there. THIS IS AN UPSE... apple_ads_change_history Who changed what on this Apple Ads account, and when. Call it with start and/or end to get one row per TRANSACTION GROUP — a single user action tha... associate_linkedin_conversion_campaigns Associate LinkedIn campaigns with a conversion rule — or detach them with remove:true. THIS IS WHAT MAKES A CONVERSION COUNT: LinkedIn only attribu... cancel_openai_ads_audience_operation Cancel an accepted ADD or REMOVE on a ChatGPT Ads custom audience BEFORE its membership changes begin. ChatGPT Ads refuses once the operation is al... cancel_scheduled Remove a queued post before it goes out. Get the id from list_scheduled. Only works while it is still queued — something already published cannot b... cancel_stripe_subscription Cancel a Stripe subscription: at the end of the current period by default (the customer keeps access until then), or immediately:true to end it now... clear_sheet_range Empty a range of cells in a Google Sheet, leaving the rows themselves in place. DESTRUCTIVE: call it WITHOUT confirm first and nothing is cleared —... create_analytics_custom_dimension Register an event parameter the site ALREADY SENDS as a custom dimension, so reports can break down by it (plan tier, content category, logged-in s... create_openai_ads_campaign Build a campaign on the connected ChatGPT Ads account — the ads that appear below ChatGPT answers. ALWAYS created PAUSED at every level, with no ov... delete_analytics_key_event REMOVE A KEY EVENT — the reverse of create_analytics_key_event, and note the ASYMMETRY with custom dimensions: a key event really can be DELETED, w... delete_apple_ads_object Delete an Apple Ads campaign, ad group, keyword, negative keyword, ad, creative, asset, location group or budget order. Requires confirm:true, and ... delete_bluesky_post PERMANENTLY delete one of the connected Bluesky account + 66 more Every Hermoso tool, risk-classified, on the server page.
neuron_cancel_approval Cancel a still-pending approval (e.g. the upstream action was aborted). Fires the approval.cancelled callback. Requires a bot API key. neuron_cancel_booking Cancel a confirmed or pending booking. Sends cancellation notifications to the invitee. neuron_cancel_flow_run Cancel a running or waiting flow execution. Steps already completed are not rolled back. neuron_cancel_scheduled_message Cancel a scheduled message to prevent it from being sent. Only messages with status 'scheduled' can be cancelled. This action cannot be undone. neuron_clear_chat Delete messages (and their media) from chats; the conversations stay, empty. Chats a human is currently handling, or that a flow is waiting on, are... neuron_clear_media Remove media files (photos, videos, voice notes, documents) from chats while keeping the messages and captions; chats show 'Media removed'. Only Ne... neuron_delete_ad_request Permanently delete a draft ad request. Only ad requests in draft status can be deleted. neuron_delete_blog_post Permanently delete a blog post by its ID. This action cannot be undone. neuron_delete_bot Permanently delete a bot and all its associated data. This action cannot be undone. neuron_delete_broadcast Permanently delete a broadcast and its recipient data. This action cannot be undone. neuron_delete_calendar Permanently delete a calendar and all its event types, bookings, and availability data. neuron_delete_campaign Permanently delete a campaign that is in 'draft' status. Active or funded campaigns cannot be deleted. + 42 more Every Neuron tool, risk-classified, on the server page.

BINANCE MCP SERVER

54 All Binance MCP Server tools →
cancel_order Cancel a specific order. binance_us_cancel_all_open_orders Cancel all active orders on a symbol on Binance.US. This includes OCO orders. Use with caution - this will cancel ALL open orders for the specified... binance_us_cancel_oco Cancel an entire OCO order on Binance.US. Cancelling any individual leg will cancel the entire OCO. binance_us_cancel_order Cancel an active order on Binance.US. Either orderId or origClientOrderId must be provided. binance_us_cancel_replace Cancel an existing order and place a new order on the same symbol atomically. This is useful for modifying order parameters. binance_us_cust_cancel_oco Cancel an entire OCO (One-Cancels-the-Other) order list. ⚠️ REQUIRES CUSTODIAL SOLUTION API KEY This cancels both legs of the OCO order. Respons... binance_us_cust_cancel_order Cancel an active custodial trade order. ⚠️ REQUIRES CUSTODIAL SOLUTION API KEY Either orderId or origClientOrderId must be provided. Response in... binance_us_cust_cancel_orders_symbol Cancel all active custodial orders for a specific trading pair. ⚠️ REQUIRES CUSTODIAL SOLUTION API KEY This includes OCO orders. Use with caution... BinanceCancelHashRateResaleConfiguration Cancel an existing hashrate resale configuration using the mining ID and account details. BinanceConvertCancelLimitOrder Cancels a previously placed limit order using the orderId and returns the cancellation status along with the orderId. BinanceCrossMarginCancelAllOrders Cancel all open margin orders for a specific trading pair. This will cancel all open orders on the symbol. BinanceCrossMarginCancelOrder Cancel an active margin order. Either orderId or origClientOrderId must be provided. + 42 more Every Binance MCP Server tool, risk-classified, on the server page.

PIPEDRIVE MCP SERVER

53 All Pipedrive MCP Server tools →
pipedrive_convert_deal_to_lead Convert a deal to a lead (async job). DESTRUCTIVE: a successful conversion marks the source deal as deleted. Returns a conversion_id; the conversio... pipedrive_convert_lead_to_deal Convert a lead into a deal (Pipedrive v2). DESTRUCTIVE: a successful conversion marks the source lead as deleted. The conversion runs asynchronousl... pipedrive_delete_activity Delete an activity. pipedrive_delete_board Delete a project board. Requires PIPEDRIVE_MODE=full (back-compat: PIPEDRIVE_ENABLE_DESTRUCTIVE=true). (Projects add-on; Projects API in public beta.) pipedrive_delete_deal Delete a deal. The deal will be marked as deleted and permanently removed after 30 days. pipedrive_delete_deal_discount Delete an additional discount from a deal. pipedrive_delete_deal_field Delete a deal custom field by field_code. Requires PIPEDRIVE_MODE=full (back-compat: PIPEDRIVE_ENABLE_DESTRUCTIVE=true). pipedrive_delete_deal_field_options Bulk-delete options of a deal enum/set field. Atomic: fails if any ID does not exist. Requires PIPEDRIVE_MODE=full (back-compat: PIPEDRIVE_ENABLE_D... pipedrive_delete_deal_follower Remove a follower from a deal. pipedrive_delete_deal_installment Delete an installment from a deal. Growth+ plan required. pipedrive_delete_deal_product Remove a line-item product from a deal. pipedrive_delete_lead Delete a lead. Requires PIPEDRIVE_MODE=full (back-compat: PIPEDRIVE_ENABLE_DESTRUCTIVE=true). + 41 more Every Pipedrive MCP Server tool, risk-classified, on the server page.

APPSTORECONNECT MCP

52 All Appstoreconnect Mcp tools →
asc_delete_accessibility_declaration DELETE /v1/accessibilityDeclarations/{id} — remove a DRAFT declaration. Published declarations are superseded by publishing a new draft (REPLACED),... asc_delete_alternative_distribution_domain ⚠️ DELETE /v1/alternativeDistributionDomains/{id} — apps distributed from this domain stop being installable from it. Confirm intent first. asc_delete_alternative_distribution_key ⚠️ DELETE /v1/alternativeDistributionKeys/{id} — artifacts signed against this key stop validating. Confirm intent first. asc_delete_analytics_report_request DELETE /v1/analyticsReportRequests/{id} — stop report generation for this request and drop access to its report chain. Recreating later starts fres... asc_delete_app_custom_product_page DELETE an AppCustomProductPage. Removes the page + every version + every localization + every asset set under it. The public CPP URL stops resolvin... asc_delete_app_custom_product_page_localization DELETE an AppCustomProductPageLocalization. Customers in this locale fall back to the parent AppStoreVersionLocalization. Apple may refuse if the p... asc_delete_app_custom_product_page_version DELETE an AppCustomProductPageVersion. Removes every localization + asset set under it. Apple gates this — versions in WAITING_FOR_REVIEW / IN_REVI... asc_delete_app_event DELETE an AppEvent. Removes the event + every localization + every asset. Apple may refuse if the event is PUBLISHED or IN_REVIEW. asc_delete_app_event_localization DELETE an AppEventLocalization. Removes the per-locale copy + every event screenshot + video clip under it. Customers in this locale fall back to t... asc_delete_app_event_screenshot DELETE an AppEventScreenshot. Removes the asset under its slot; if the slot goes empty Apple may reject the event for review with an asset-missing ... asc_delete_app_event_video_clip DELETE an AppEventVideoClip. Removes the video asset; if both screenshot + video slot are emptied, Apple may reject the event for review with an as... asc_delete_app_info_localization DELETE an AppInfoLocalization. The locale-specific app-level copy is removed (subtitle, privacy URLs, etc.). Customers in that locale fall back to ... + 40 more Every Appstoreconnect Mcp tool, risk-classified, on the server page.
delete_activity Delete an activity from a course, with its participants' data (submissions, attempts, posts, grades). Destructive: confirm with the person first, n... delete_book_chapter Delete a chapter with its files; deleting a chapter (not a subchapter) deletes its subchapters too. Returns the chapters afterwards. Can't be undon... delete_database_entry Delete a database entry with its values and files. A student deletes their own while Moodle lets them change it; a teacher, anyone's. Can't be undo... delete_database_field Delete a database field: what every entry has in it goes too, and its tags leave the templates. Returns the fields. Can't be undone: confirm with t... delete_event Delete a calendar event the person can manage (a course event, or their own), by its id from list_events or create_event. Activities' dates are cha... delete_feedback_item Delete a feedback item; the answers people gave to it go with it. Returns the items left. Can't be undone: confirm with the person first. delete_feedback_template Delete a feedback template (a public one takes a manager's rights). Can't be undone: confirm with the person first. delete_glossary_entry Delete a glossary entry with its files. A student deletes their own while the site's editing time lasts; a teacher, anyone's. Can't be undone: conf... delete_grade_category Delete a grade category: Moodle moves what it held into its parent and deletes its total's grades; the course's own category can't be deleted. Can'... delete_grade_item Delete a manual grade item and every grade in it. An activity's item goes with its activity, so it's refused. Can't be undone: confirm with the per... delete_group Delete a group; its members stay in the course. Activities set to work by groups lose it. Can't be undone: confirm with the person first. delete_grouping Delete a grouping; its groups stay. Can't be undone: confirm with the person first. + 37 more Every Moodle tool, risk-classified, on the server page.

TREKMAIL MCP SERVER

49 All TrekMail MCP Server tools →
bulk_action Perform an action on up to 50 messages at once. Actions: read, unread, star, unstar, delete, move, spam, notspam. The cancel_bulk_migration Cancel an active bulk migration batch. All queued and running jobs will be stopped. Set confirm_cancel=true to proceed. cancel_migration Cancel a running email migration. Set confirm_cancel=true to proceed. cancel_scheduled Cancel a pending scheduled message. Requires TREKMAIL_ALLOW_DESTRUCTIVE=true. change_mailbox_password Change the password of a mailbox. Requires TREKMAIL_ALLOW_DESTRUCTIVE=true because password changes are irreversible. While app passwords are enabl... confirm_delete_intent Confirm a delete intent to delete a mailbox. This is step 2 of the two-step deletion process. The mailbox is moved to the recycle bin and can be re... consume_private_note_encrypted DESTRUCTIVE: one-time notes become unavailable immediately. Unlock the fragment/password locally BEFORE calling. Requires explicit confirm_open=tru... convert_mailbox_to_shared Convert an existing regular mailbox into a shared (team) mailbox. The specified members are added immediately. IMPORTANT: this rotates the mailbox ... create_delete_intent Create a delete intent for a mailbox. This is step 1 of the two-step deletion process. Returns an intent that expires in 10 minutes. The intent mus... delete_alias Permanently remove an email alias from a mailbox. Mail sent to this address will no longer be delivered. This cannot be undone. delete_bulk_migration Delete a completed, failed, or cancelled bulk migration batch record. Cannot delete active batches. Both TREKMAIL_ALLOW_MIGRATION=true and confirm_... delete_calendar_event Delete a calendar event. Requires TREKMAIL_ALLOW_DESTRUCTIVE=true. + 37 more Every TrekMail MCP Server tool, risk-classified, on the server page.
caddy_remove_site Remove a site block from the Caddyfile (matched by address) and reload Caddy. Destructive — the change is persisted to disk. crow_bookstack_delete Delete a page or chapter from BookStack (irreversible) crow_campaign_delete Delete a campaign and all its posts. Requires confirmation. crow_deactivate_server Deactivate a server crow_delete_bot_schedule Delete a recurring bot-cron schedule by its scheduleId (from crow_list_bot_schedules). crow_delete_context_section Delete a custom crow.md section. Protected sections cannot be deleted — only disabled. Scoped overrides (device/project) of protected sections CAN ... crow_delete_file Permanently delete a file from storage. This cannot be undone. Returns a preview and confirmation token on first call; pass the token back to execute. crow_delete_memory Permanently delete a memory. This cannot be undone. Returns a preview and confirmation token on first call; pass the token back to execute. crow_delete_post Permanently delete a blog post. This cannot be undone — use crow_unpublish_post to revert to draft instead. Returns a preview and confirmation toke... crow_delete_setlist Permanently delete a setlist. Returns a preview and confirmation token on first call; pass the token back to execute. crow_frigate_set_detect Enable/disable motion detection for a camera. DESTRUCTIVE: disabling detect also stops motion-triggered recording on that camera. Use sparingly. crow_glasses_undo_last_append Remove the most recently appended line from an active glasses note session. Use when the user says + 36 more Every Crow tool, risk-classified, on the server page.

MAX MCP SERVER

47 All Max MCP Server tools →
automation_cancel_run Cancel a queued or waiting (delayed) run; 409 if it already ran or is running. Returns {data: Run}. automation_delete Permanently delete a workflow with all its versions and run history. Returns {data: {deleted: true}}. automation_discard_draft Archive the pending draft, keeping the active version (409 if there is no draft; 404 where the draft lifecycle is not enabled). Returns {data: Vers... bulk_delete_organizations Delete multiple organizations. Set deleteProspects=true to cascade-delete linked prospects. bulk_delete_prospects Delete multiple prospects by IDs. cancel_meeting Cancel a recorded meeting by its meetings.id UUID. If the meeting has a Cal.com booking uid it is cancelled on Cal.com first, then the row is marke... cancel_meeting_series Cancel a recurring Cal.com series from one occurrence (meeting_id): scope cancel_warmup Stop a warm-up at the end of its paid period (no refund; ends immediately if unpaid). resume_warmup undoes a pending cancellation. clear_failed_requests Drain the dead-letter queue. Returns the number of entries removed. Use after manually replaying or after resolving the upstream issue. decline_meeting Reject a pending Cal.com booking request by meeting_id, with an optional reason. Irreversible; Cal.com notifies the attendee. Returns {data: meetin... delete_calendar_event Delete an event from a synced Google/Outlook calendar by event_id + account_id. Irreversible; the provider may notify attendees. Returns {success: ... delete_campaign Permanently delete a campaign and all its workflow executions. Prefer archive for soft removal. + 35 more Every Max MCP Server tool, risk-classified, on the server page.
account_delete Run account.delete through the Appaloft application operation catalog. Shared with HTTP/API. account_sessions_revoke Run account.sessions.revoke through the Appaloft application operation catalog. Shared with HTTP/API. agent_adapters_uninstall Run agent-adapters.uninstall through the Appaloft application operation catalog. Shared with CLI and HTTP/API. agent_workspace_profiles_uninstall Run agent-workspace-profiles.uninstall through the Appaloft application operation catalog. Shared with CLI and HTTP/API. audit_events_archives_prune Run audit-events.archives.prune through the Appaloft application operation catalog. Shared with CLI and HTTP/API. audit_events_prune Run audit-events.prune through the Appaloft application operation catalog. Shared with CLI and HTTP/API. certificates_delete Run certificates.delete through the Appaloft application operation catalog. Shared with CLI and HTTP/API. certificates_revoke Run certificates.revoke through the Appaloft application operation catalog. Shared with CLI and HTTP/API. connections_revoke Run connections.revoke through the Appaloft application operation catalog. Shared with CLI and HTTP/API. control_plane_portability_artifacts_delete Run control-plane-portability.artifacts.delete through the Appaloft application operation catalog. Shared with CLI and HTTP/API. credentials_delete_ssh Run credentials.delete-ssh through the Appaloft application operation catalog. Shared with CLI and HTTP/API. dependency_resources_delete Run dependency-resources.delete through the Appaloft application operation catalog. Shared with CLI and HTTP/API. + 34 more Every Appaloft tool, risk-classified, on the server page.
accept_handoff [SUPPORT] Read-only: (1bd5e810) Canonical receiver-side acceptance check for a handoff envelope — composes token verification, capability/tool avai... acquire_docx_document_lease [MAINTENANCE] 6507e83a — Whole-document cross-process lease for .docx files, the counterpart claim_docx_region never provided (that tool hard-requi... answer_hitl [SUPPORT] Answer a pending HITL request programmatically. Marks it answered so the waiting session can resume. Use list_hitl_requests to find reque... batch_mutate [SUPPORT] 133bfff6 — run a batch of TRANSACTIONAL mutation entries in ONE call, mixing entry kinds selected per-entry via 'kind': 'sprint_item_poin... capture_research_finding [SUPPORT] Inline capture for web/paper research during planning: save a finding from a URL as an addressable note with the source link, optionally ... checkpoint [SUPPORT] Save progress mid-session. Runs auto_capture (buckets done tasks into a note), generates a delta handoff, and returns a compact summary w... claim_docx_region [MAINTENANCE] f7ee1ba7 — Model B scoped-region claiming for .docx files. Claim a specific paragraph/element by its durable `element_id` (the w14:pa... claim_file [SUPPORT] Claim edit rights on a file for this session. Whole-file by default (auto-expires after 2 hours). For symbol-level claims — so two sessio... claim_sprint_item Claim a pending sprint item: sets status to in_progress and records claimed_at + actor. Read-only: false. Rejects if the item is already in_progres... clear_capability_profile [SUPPORT] 02038afe — Delete a scope's ENTIRE capability profile row (both its capabilities and its disabled_capability_ids) so it reverts to purely... clone_profile_layer [SUPPORT] 0bec79a7 (PROFILE-5) — Copy one layer's fields/reset_fields/provenance onto another scope, going through the exact same validation/hashin... delete_custom_hook [MAINTENANCE] 273287cb — delete a user-defined hook by id (the id returned by add_custom_hook / get_custom_hooks). Idempotent: deleting an already-... + 34 more Every Meridian tool, risk-classified, on the server page.

Showing the 50 servers with the most destructive tools — 14331 servers in the catalogue expose them. Find the rest through tool search or the policy library.

FREQUENTLY ASKED QUESTIONS

Tools that permanently delete or destroy resources. Critical risk -- block by default. There are 46482 destructive tools across 14331 MCP servers in the PolicyLayer reference.

Destructive tools should be blocked by default. Only enable with explicit human approval workflows.

GoHighLevel MCP Server, Pfsense, Huly, Mcp, Discord, and 14326 more.

Take your agents live. Without losing control.

Route your MCP traffic through PolicyLayer. Every tool call is checked against your policy before it runs: allow, deny, or require approval. Per-identity grants. Full audit log. Live in minutes.

Instant setup, no code required.

46,500+ MCP servers and 515,000+ tools scanned and risk-classified.

// GET IN TOUCH

Have a question or want to learn more? Send us a message.

Message sent.

We'll get back to you soon.