High Risk →

aide_init

Bootstrap the AIDE development environment into a project. Returns structured JSON for agent consumption — not prose. The tool uses a two-call pattern for progressive disclosure: First call (no category param): Returns a lightweight summary — every step with name, status (would-create/would-overw...

Risk signalsAccepts file system path (path) · Bulk/mass operation — affects multiple targets · Admin/system-level operation

Part of the Aidemd Mcp server.

aide_init can trigger actions in Aidemd Mcp, with no limits today. PolicyLayer puts allow, deny, and rate-limit rules on every call. Live in minutes.

SECURE AIDEMD MCP →

Free to start. No card required.

AI agents invoke aide_init to trigger processes or run actions in Aidemd Mcp. Execute operations can have side effects beyond the immediate call -- triggering builds, sending notifications, or starting workflows. Rate limits and argument validation are essential to prevent runaway execution.

aide_init can trigger processes with real-world consequences. An uncontrolled agent might start dozens of builds, send mass notifications, or kick off expensive compute jobs. PolicyLayer enforces rate limits and validates arguments to keep execution within safe bounds.

Execute tools trigger processes. Rate-limit and validate arguments to prevent unintended side effects.

policy.json
{
  "version": "1",
  "default": "deny",
  "tools": {
    "aide_init": {
      "limits": [
        {
          "counter": "aide_init_rate",
          "window": "minute",
          "max": 10,
          "scope": "grant"
        }
      ]
    }
  }
}

See the full Aidemd Mcp policy for all 9 tools.

Get this rule live on your own Aidemd Mcp server in minutes. PolicyLayer enforces it on every call, before it runs.

ENFORCE ON MY AIDEMD MCP →

View all 9 tools →

These attack patterns abuse exactly the kind of access aide_init gives an agent. Each links to the full case and the policy that stops it:

Browse the full MCP Attack Database →

Every attack above starts with a tool call. PolicyLayer checks each one against your policy first, so aide_init only ever does what you allow.

SECURE AIDEMD MCP →

Other execute tools across the catalogue. The same approach applies to each: rate-limit and validate the arguments.

What does the aide_init tool do? +

Bootstrap the AIDE development environment into a project. Returns structured JSON for agent consumption — not prose. The tool uses a two-call pattern for progressive disclosure: First call (no category param): Returns a lightweight summary — every step with name, status (would-create/would-overwrite/would-skip/exists), category, and filePath, but NO content fields. Also returns brainHints (brain root candidates) and detected framework. Use this to understand what needs to be done and which categories require user prompts. Second call (with category param): The tool writes all would-create AND approved would-overwrite files directly to disk itself and returns a manifest — steps with filePath, status (created, overwritten, or exists), and name, but NO content. would-skip steps stay would-skip in the manifest (tool writes nothing for them). The agent never sees file content and never uses the Write tool for new files. Exception — MCP steps: For MCP steps, the manifest includes prescription data (key name and entry object) so the agent can read the existing config, merge, and write. The tool never touches MCP config directly. Exception — brain category: When calling with category=brain, also pass brainPath with the user-confirmed brain root path. The tool creates the brain root scaffold directories directly. Exception — IDE VS Code steps: IDE steps that need external tooling (VS Code CLI) return instructions for the agent to execute, since those aren't simple file writes. Agent branch logic — silent-on-create, prompt-on-overwrite: After the first call, walk the categories using this rule: - Pure-create category (all steps are would-create, would-skip, or exists): apply silently by calling with category=X immediately — no AskUserQuestion. A category with nothing on disk to overwrite has no decision the user can inform. - Overwrite-bearing category (any step is would-overwrite): pause and use AskUserQuestion with structured options. Name the files that would be overwritten. If the user approves, call with category=X — the tool overwrites and returns overwritten in the manifest. If the user declines an overwrite but wants the new files, call with category=X — the tool writes only would-create steps; the would-overwrite step stays would-overwrite in the manifest. - Inherent-decision categories (framework, brain root path, MCP config merge, IDE choice): always use AskUserQuestion regardless of disk state. These are not file-write decisions — filesystem contents cannot resolve them. IMPORTANT — one-at-a-time wizard pattern using AskUserQuestion: Do NOT present a summary table of all categories. Do NOT offer "all" as an option. Do NOT ask conversational questions — use the AskUserQuestion tool with structured options at every pause point. 1. Call without category first to get the metadata 2. Present ONLY the detected framework — use AskUserQuestion with Yes/{alternatives} options. STOP. 3. Walk categories in order: methodology, commands, agents, skills, mcp, brain, ide, readme. For each: - Pure-create: apply silently (call with category=X), report results, move to next. - Overwrite-bearing: use AskUserQuestion naming the would-overwrite files. STOP. Wait for selection, then call with category=X. Report manifest (created N, overwrote M). Move to next. - Inherent decision: always use AskUserQuestion. STOP. 4. For brain: use AskUserQuestion with brainHints as labeled options (user can pick Other for custom path). STOP. Then call with category=brain and brainPath. 5. For MCP: use AskUserQuestion with Merge/Skip options. Merge the prescription entry into the existing config yourself (read → merge → write). STOP. 6. For IDE: use AskUserQuestion with multiSelect for Zed/VS Code/Neither. STOP. Each pause point is ONE AskUserQuestion → wait for selection → then proceed. Never show multiple categories at once. Never ask open-ended conversational questions.. It is categorised as a Execute tool in the Aidemd Mcp MCP Server, which means it can trigger actions or run processes. Use rate limits and argument validation.

How do I enforce a policy on aide_init? +

Register the Aidemd MCP server in PolicyLayer and add a rule for aide_init: allow, deny, rate-limit, or require approval. Point your MCP client at the PolicyLayer proxy URL and the rule is enforced on every call, before it reaches Aidemd Mcp. Nothing to install.

What risk level is aide_init? +

aide_init is a Execute tool with high risk. Execute tools should be rate-limited and have argument validation enabled.

Can I rate-limit aide_init? +

Yes. Add a rate_limit block to the aide_init rule in your PolicyLayer policy. For example, setting max: 10 and window: 60 limits the tool to 10 calls per minute. Rate limits are tracked per agent session and reset automatically.

How do I block aide_init completely? +

Set action: deny in the PolicyLayer policy for aide_init. The AI agent will receive a policy violation error and cannot call the tool. You can also include a reason field to explain why the tool is blocked.

What MCP server provides aide_init? +

aide_init is provided by the Aidemd MCP server (@aidemd-mcp/server). PolicyLayer sits as a proxy in front of this server to enforce policies before tool calls reach the server.

Enforce policy on every Aidemd Mcp tool call.

Deterministic rules across all 9 Aidemd Mcp tools. Per-identity grants. Full audit log. Live in minutes. Nothing to install.

Free to start. No card required.

4,600+ MCP servers and 31,000+ tools scanned and risk-classified.

// GET IN TOUCH

Have a question or want to learn more? Send us a message.

Message sent.

We'll get back to you soon.