gradle-build

What gradle-build does on Search

AI agents invoke gradle-build to trigger actions in Search. What it does depends on the arguments the agent supplies, and its effects often reach beyond the immediate call: builds kicked off, notifications sent, workflows started.

Why gradle-build is rated High

This tool executes build processes which can run arbitrary code as part of the build lifecycle. While not immediately destructive, it has high blast radius as misconfigured or malicious builds can modify files, download dependencies, execute scripts, or affect system state. It represents Execute category severity due to its ability to trigger complex external operations with unpredictable side effects.

From the tool's definition Tool name 'gradle-build' directly indicates running a Gradle build process. Description states 'Runs' which confirms code execution capability. Gradle builds can execute arbitrary code including compilation, testing, and custom tasks.

The rule that runs gradle-build safely

PolicyLayer is an MCP gateway: it sits between your AI agents and Search, and checks every tool call against a rule you set before the call runs. Nothing changes on the server itself. For gradle-build, this is the rule to start with:

{
  "version": "1",
  "default": "deny",
  "tools": {
    "gradle-build": {
      "limits": [
        {
          "counter": "gradle-build_rate",
          "window": "minute",
          "max": 10,
          "scope": "grant"
        }
      ]
    }
  }
}

Questions about gradle-build