execute_cli_script

What execute_cli_script does on Fortimanager

AI agents invoke execute_cli_script to trigger actions in Fortimanager. What it does depends on the arguments the agent supplies, and its effects often reach beyond the immediate call: builds kicked off, notifications sent, workflows started.

Why execute_cli_script is rated High

This tool runs scripts via CLI against a FortiManager system. Even with an empty description, the name and context make clear this executes arbitrary commands whose effects depend entirely on the script content provided by the caller. This is Execute category: triggering external operations (CLI scripts on security infrastructure) whose side effects are determined by arguments.

From the tool's definition Tool name 'execute_cli_script' directly indicates execution of CLI scripts. The sibling tools (add_custom_command_to_template, add_policies_to_block, add_ips_rule, etc.) all involve network security policy modifications through FortiManager, confirming this…

The rule that runs execute_cli_script safely

PolicyLayer is an MCP gateway: it sits between your AI agents and Fortimanager, and checks every tool call against a rule you set before the call runs. Nothing changes on the server itself. For execute_cli_script, this is the rule to start with:

{
  "version": "1",
  "default": "deny",
  "tools": {
    "execute_cli_script": {
      "limits": [
        {
          "counter": "execute_cli_script_rate",
          "window": "minute",
          "max": 10,
          "scope": "grant"
        }
      ]
    }
  }
}

Questions about execute_cli_script