Manually build production Docker images and push to GitHub Container Registry. Optionally build a specific service only. NOTE: Only use this for manual deployments. If the project has CI/CD configured (e.g. GitHub Actions), pushing to the main branch triggers a build automatically — do NOT call t...
AI agents invoke cli_deploy_build to trigger actions in LaunchFrame MCP. What it does depends on the arguments the agent supplies, and its effects often reach beyond the immediate call — builds kicked off, notifications sent, workflows started.
This tool executes a build and deployment pipeline targeting production infrastructure. While not destructive (images can be overwritten) or financial, it performs irreversible operations in external systems (Docker image publication) whose outcome depends on runtime arguments. The high severity reflects the blast radius: a misused call could deploy broken or malicious code to production.
From the tool's definition Tool description states it will 'build production Docker images and push to GitHub Container Registry' — these are external operations with side effects that depend on arguments (which service to build, registry credentials, etc.).
Attacks that exploit this kind of access
Manually build production Docker images and push to GitHub Container Registry. Optionally build a specific service only. NOTE: Only use this for manual deployments. If the project has CI/CD configured (e.g. GitHub Actions), pushing to the main branch triggers a build automatically — do NOT call this unless the user explicitly requests a manual build. It is categorised as a Execute tool in the LaunchFrame MCP MCP Server, which means it can trigger actions or run processes. Use rate limits and argument validation.
Register the LaunchFrame MCP server in PolicyLayer and add a rule for cli_deploy_build: allow, deny, rate-limit, or require approval. Point your MCP client at the PolicyLayer proxy URL and the rule is enforced on every call, before it reaches LaunchFrame MCP. Nothing to install.
cli_deploy_build is a Execute tool with high risk. Execute tools should be rate-limited and have argument validation enabled.
Yes. Add a rate_limit block to the cli_deploy_build rule in your PolicyLayer policy. For example, setting max: 10 and window: 60 limits the tool to 10 calls per minute. Rate limits are tracked per agent session and reset automatically.
Set action: deny in the PolicyLayer policy for cli_deploy_build. The AI agent will receive a policy violation error and cannot call the tool. You can also include a reason field to explain why the tool is blocked.
cli_deploy_build is provided by the LaunchFrame MCP server (launchframe-dev/mcp). PolicyLayer sits as a proxy in front of this server to enforce policies before tool calls reach the server.
Every MCP server has a record like this.
Type a name, get the same breakdown: verified identity, auth posture, risk grade, capabilities, recommended policy.
Teams ship this data inside their own products. See what a licence covers →