metasploit_run

What metasploit_run does on Hexstrike Ai

AI agents invoke metasploit_run to trigger actions in Hexstrike Ai. What it does depends on the arguments the agent supplies, and its effects often reach beyond the immediate call: builds kicked off, notifications sent, workflows started.

Why metasploit_run is rated High

Metasploit modules execute arbitrary code/exploits against targets. This is Execute rather than Destructive because the outcome (destruction, modification, or read access) depends entirely on which module is executed. However, in the context of a pentesting server where modules may include destructive exploits, the potential blast radius is critical.

From the tool's definition Tool name 'metasploit_run' and description 'Execute a Metasploit module with enhanced logging' indicates execution of arbitrary Metasploit modules, which are payloads and exploits that run code and trigger external operations with unpredictable side effects.

The rule that runs metasploit_run safely

PolicyLayer is an MCP gateway: it sits between your AI agents and Hexstrike Ai, and checks every tool call against a rule you set before the call runs. Nothing changes on the server itself. For metasploit_run, this is the rule to start with:

{
  "version": "1",
  "default": "deny",
  "tools": {
    "metasploit_run": {
      "limits": [
        {
          "counter": "metasploit_run_rate",
          "window": "minute",
          "max": 10,
          "scope": "grant"
        }
      ]
    }
  }
}

Questions about metasploit_run