stop_bruteshark_live

What stop_bruteshark_live does on Pentester-MCP

AI agents invoke stop_bruteshark_live to trigger actions in Pentester-MCP. What it does depends on the arguments the agent supplies, and its effects often reach beyond the immediate call: builds kicked off, notifications sent, workflows started.

Why stop_bruteshark_live is rated High

This tool stops a running network packet capture process. While termination itself is not destructive (the capture data already exists), it is an Execute action because it controls an external tool's operation state. Severity is medium because stopping a live capture could disrupt active penetration testing operations, but it causes no permanent data loss or financial impact.

From the tool's definition Terminates a background Bruteshark live capture process—directly controls an external process/tool execution state via MCP without permanent data deletion, fitting the Execute pattern of triggering external operations whose effects depend on runtime context.

The rule that runs stop_bruteshark_live safely

PolicyLayer is an MCP gateway: it sits between your AI agents and Pentester-MCP, and checks every tool call against a rule you set before the call runs. Nothing changes on the server itself. For stop_bruteshark_live, this is the rule to start with:

{
  "version": "1",
  "default": "deny",
  "tools": {
    "stop_bruteshark_live": {
      "limits": [
        {
          "counter": "stop_bruteshark_live_rate",
          "window": "minute",
          "max": 10,
          "scope": "grant"
        }
      ]
    }
  }
}

Questions about stop_bruteshark_live