On-demand brain entry-point tool. Call this when you need to reach the brain mid-task — do NOT call it on every /aide boot. Boot-time brain precondition state is already reported by aide_info.brain.status; firing aide_brain at boot duplicates that work unnecessarily. Optional kind parameter — clo...
Risk signalsBulk/mass operation — affects multiple targets
Part of the Aidemd Mcp server.
Free to start. No card required.
AI agents invoke aide_brain to trigger processes or run actions in Aidemd Mcp. Execute operations can have side effects beyond the immediate call -- triggering builds, sending notifications, or starting workflows. Rate limits and argument validation are essential to prevent runaway execution.
aide_brain can trigger processes with real-world consequences. An uncontrolled agent might start dozens of builds, send mass notifications, or kick off expensive compute jobs. PolicyLayer enforces rate limits and validates arguments to keep execution within safe bounds.
Execute tools trigger processes. Rate-limit and validate arguments to prevent unintended side effects.
{
"version": "1",
"default": "deny",
"tools": {
"aide_brain": {
"limits": [
{
"counter": "aide_brain_rate",
"window": "minute",
"max": 10,
"scope": "grant"
}
]
}
}
}See the full Aidemd Mcp policy for all 9 tools.
These attack patterns abuse exactly the kind of access aide_brain gives an agent. Each links to the full case and the policy that stops it:
Other execute tools across the catalogue. The same approach applies to each: rate-limit and validate the arguments.
On-demand brain entry-point tool. Call this when you need to reach the brain mid-task — do NOT call it on every /aide boot. Boot-time brain precondition state is already reported by aide_info.brain.status; firing aide_brain at boot duplicates that work unnecessarily. Optional kind parameter — closed two-value vocabulary: "orientation" (default) or "config". - "orientation" — returns the orientation section: a runtime briefing delivered when an agent reaches for the brain mid-task. Omitting kind is equivalent to passing "orientation". - "config" — returns the integration-specific wiring flow, used by /aide:brain config to walk through brain setup. Install-time seed sections (playbookIndex, studyPlaybook, updatePlaybook, researchIndex) are NOT surfaced via this tool — agents reach those via the brain's read tool against the on-disk seed files. Response shape: { status, instructions } — exactly two fields. No backend, no connector, no name, no kind. status — mirrors the BrainState tagged union from buildBrainState. The four-state vocabulary: ok, no-brain-aide, no-mcp-entry, mcp-drift. Branch on status alone — no other discriminant is present. instructions — always non-empty on every branch. Act on this field directly: - On ok: the verbatim bytes of the selected section from the host's .aide/config/brain.aide, byte-identical to what the user wrote between that section's markers. No trimming, no normalization, no ${...} substitution. The selected section takes over from here — the tool has no further role. - On no-brain-aide: fixed remediation prose directing the user to run npx @aidemd-mcp/server@latest init. Do not proceed as if the brain were available. - On no-mcp-entry: fixed remediation prose directing the user to run npx @aidemd-mcp/server@latest sync and restart Claude Code. Do not proceed as if the brain were available. - On mcp-drift: fixed remediation prose directing the user to run npx @aidemd-mcp/server@latest sync and restart Claude Code, explicitly forbidding the agent from patching .mcp.json itself. Non-ok remediation prose is identical regardless of kind — the file is broken for both sections in the same way.. It is categorised as a Execute tool in the Aidemd Mcp MCP Server, which means it can trigger actions or run processes. Use rate limits and argument validation.
Register the Aidemd MCP server in PolicyLayer and add a rule for aide_brain: allow, deny, rate-limit, or require approval. Point your MCP client at the PolicyLayer proxy URL and the rule is enforced on every call, before it reaches Aidemd Mcp. Nothing to install.
aide_brain is a Execute tool with high risk. Execute tools should be rate-limited and have argument validation enabled.
Yes. Add a rate_limit block to the aide_brain rule in your PolicyLayer policy. For example, setting max: 10 and window: 60 limits the tool to 10 calls per minute. Rate limits are tracked per agent session and reset automatically.
Set action: deny in the PolicyLayer policy for aide_brain. The AI agent will receive a policy violation error and cannot call the tool. You can also include a reason field to explain why the tool is blocked.
aide_brain is provided by the Aidemd MCP server (@aidemd-mcp/server). PolicyLayer sits as a proxy in front of this server to enforce policies before tool calls reach the server.
Deterministic rules across all 9 Aidemd Mcp tools. Per-identity grants. Full audit log. Live in minutes. Nothing to install.
Free to start. No card required.
4,600+ MCP servers and 31,000+ tools scanned and risk-classified.