Bootstrap the AIDE development environment into a project. Returns structured JSON for agent consumption — not prose. The tool uses a two-call pattern for progressive disclosure: First call (no category param): Returns a lightweight summary — every step with name, status (would-create/would-overw...
Risk signalsAccepts file system path (path) · Bulk/mass operation — affects multiple targets · Admin/system-level operation
Part of the Aidemd Mcp server.
Free to start. No card required.
AI agents invoke aide_init to trigger processes or run actions in Aidemd Mcp. Execute operations can have side effects beyond the immediate call -- triggering builds, sending notifications, or starting workflows. Rate limits and argument validation are essential to prevent runaway execution.
aide_init can trigger processes with real-world consequences. An uncontrolled agent might start dozens of builds, send mass notifications, or kick off expensive compute jobs. PolicyLayer enforces rate limits and validates arguments to keep execution within safe bounds.
Execute tools trigger processes. Rate-limit and validate arguments to prevent unintended side effects.
{
"version": "1",
"default": "deny",
"tools": {
"aide_init": {
"limits": [
{
"counter": "aide_init_rate",
"window": "minute",
"max": 10,
"scope": "grant"
}
]
}
}
} See the full Aidemd Mcp policy for all 9 tools.
These attack patterns abuse exactly the kind of access aide_init gives an agent. Each links to the full case and the policy that stops it:
Other execute tools across the catalogue. The same approach applies to each: rate-limit and validate the arguments.
Bootstrap the AIDE development environment into a project. Returns structured JSON for agent consumption — not prose. The tool uses a two-call pattern for progressive disclosure: First call (no category param): Returns a lightweight summary — every step with name, status (would-create/would-overwrite/would-skip/exists), category, and filePath, but NO content fields. Also returns brainHints (brain root candidates) and detected framework. Use this to understand what needs to be done and which categories require user prompts. Second call (with category param): The tool writes all would-create AND approved would-overwrite files directly to disk itself and returns a manifest — steps with filePath, status (created, overwritten, or exists), and name, but NO content. would-skip steps stay would-skip in the manifest (tool writes nothing for them). The agent never sees file content and never uses the Write tool for new files. Exception — MCP steps: For MCP steps, the manifest includes prescription data (key name and entry object) so the agent can read the existing config, merge, and write. The tool never touches MCP config directly. Exception — brain category: When calling with category=brain, also pass brainPath with the user-confirmed brain root path. The tool creates the brain root scaffold directories directly. Exception — IDE VS Code steps: IDE steps that need external tooling (VS Code CLI) return instructions for the agent to execute, since those aren't simple file writes. Agent branch logic — silent-on-create, prompt-on-overwrite: After the first call, walk the categories using this rule: - Pure-create category (all steps are would-create, would-skip, or exists): apply silently by calling with category=X immediately — no AskUserQuestion. A category with nothing on disk to overwrite has no decision the user can inform. - Overwrite-bearing category (any step is would-overwrite): pause and use AskUserQuestion with structured options. Name the files that would be overwritten. If the user approves, call with category=X — the tool overwrites and returns overwritten in the manifest. If the user declines an overwrite but wants the new files, call with category=X — the tool writes only would-create steps; the would-overwrite step stays would-overwrite in the manifest. - Inherent-decision categories (framework, brain root path, MCP config merge, IDE choice): always use AskUserQuestion regardless of disk state. These are not file-write decisions — filesystem contents cannot resolve them. IMPORTANT — one-at-a-time wizard pattern using AskUserQuestion: Do NOT present a summary table of all categories. Do NOT offer "all" as an option. Do NOT ask conversational questions — use the AskUserQuestion tool with structured options at every pause point. 1. Call without category first to get the metadata 2. Present ONLY the detected framework — use AskUserQuestion with Yes/{alternatives} options. STOP. 3. Walk categories in order: methodology, commands, agents, skills, mcp, brain, ide, readme. For each: - Pure-create: apply silently (call with category=X), report results, move to next. - Overwrite-bearing: use AskUserQuestion naming the would-overwrite files. STOP. Wait for selection, then call with category=X. Report manifest (created N, overwrote M). Move to next. - Inherent decision: always use AskUserQuestion. STOP. 4. For brain: use AskUserQuestion with brainHints as labeled options (user can pick Other for custom path). STOP. Then call with category=brain and brainPath. 5. For MCP: use AskUserQuestion with Merge/Skip options. Merge the prescription entry into the existing config yourself (read → merge → write). STOP. 6. For IDE: use AskUserQuestion with multiSelect for Zed/VS Code/Neither. STOP. Each pause point is ONE AskUserQuestion → wait for selection → then proceed. Never show multiple categories at once. Never ask open-ended conversational questions.. It is categorised as a Execute tool in the Aidemd Mcp MCP Server, which means it can trigger actions or run processes. Use rate limits and argument validation.
Register the Aidemd MCP server in PolicyLayer and add a rule for aide_init: allow, deny, rate-limit, or require approval. Point your MCP client at the PolicyLayer proxy URL and the rule is enforced on every call, before it reaches Aidemd Mcp. Nothing to install.
aide_init is a Execute tool with high risk. Execute tools should be rate-limited and have argument validation enabled.
Yes. Add a rate_limit block to the aide_init rule in your PolicyLayer policy. For example, setting max: 10 and window: 60 limits the tool to 10 calls per minute. Rate limits are tracked per agent session and reset automatically.
Set action: deny in the PolicyLayer policy for aide_init. The AI agent will receive a policy violation error and cannot call the tool. You can also include a reason field to explain why the tool is blocked.
aide_init is provided by the Aidemd MCP server (@aidemd-mcp/server). PolicyLayer sits as a proxy in front of this server to enforce policies before tool calls reach the server.
Deterministic rules across all 9 Aidemd Mcp tools. Per-identity grants. Full audit log. Live in minutes. Nothing to install.
Free to start. No card required.
4,600+ MCP servers and 31,000+ tools scanned and risk-classified.