maven-build

What maven-build does on Git

AI agents invoke maven-build to trigger actions in Git. What it does depends on the arguments the agent supplies, and its effects often reach beyond the immediate call: builds kicked off, notifications sent, workflows started.

Why maven-build is rated High

This tool executes build processes which can run code, invoke plugins, and perform operations whose effects depend on build configuration and arguments. This fits the Execute category as it triggers external operations (Maven build system) whose side effects are not fully predictable. Severity is high because Maven builds can compile code, run tests, invoke plugins with arbitrary effects, and modify the filesystem.

From the tool's definition Tool name 'maven-build' and description 'Runs' indicate execution of Maven build operations. Maven builds can execute arbitrary code through plugins, compile and test code, and trigger external processes.

The rule that runs maven-build safely

PolicyLayer is an MCP gateway: it sits between your AI agents and Git, and checks every tool call against a rule you set before the call runs. Nothing changes on the server itself. For maven-build, this is the rule to start with:

{
  "version": "1",
  "default": "deny",
  "tools": {
    "maven-build": {
      "limits": [
        {
          "counter": "maven-build_rate",
          "window": "minute",
          "max": 10,
          "scope": "grant"
        }
      ]
    }
  }
}

Questions about maven-build