maven-test

What maven-test does on Git

AI agents invoke maven-test to trigger actions in Git. What it does depends on the arguments the agent supplies, and its effects often reach beyond the immediate call: builds kicked off, notifications sent, workflows started.

Why maven-test is rated High

Maven test execution runs JVM code, build lifecycle phases, and potentially arbitrary scripts defined in pom.xml. Even though the description is truncated to just 'Runs', the tool name clearly indicates it executes Maven tests, which constitutes running external processes and code. Severity is high because a misused build tool can execute arbitrary code, exfiltrate data, or affect the build environment.

From the tool's definition Tool name 'maven-test' and description 'Runs' (truncated/uninformative) strongly implies executing Maven test commands (e.g., 'mvn test'), which runs arbitrary build and test code on the system.

The rule that runs maven-test safely

PolicyLayer is an MCP gateway: it sits between your AI agents and Git, and checks every tool call against a rule you set before the call runs. Nothing changes on the server itself. For maven-test, this is the rule to start with:

{
  "version": "1",
  "default": "deny",
  "tools": {
    "maven-test": {
      "limits": [
        {
          "counter": "maven-test_rate",
          "window": "minute",
          "max": 10,
          "scope": "grant"
        }
      ]
    }
  }
}

Questions about maven-test