该工具将启动web服务并展示模型，启动后会后台运行，所以避免重复调用！ 调用成功后，请在浏览器里输入本地地址和 init 中指定的端口号进行查看。 在调用此工具前，下面的事情需要就位，否则此工具可能无法正常工作： - 遵循 getSpec 工具中的指示并进行了原型创造。 - 已经调用 init 工具进行了初始化。
AI agents invoke start to trigger actions in MCP-Prototype. What it does depends on the arguments the agent supplies, and its effects often reach beyond the immediate call — builds kicked off, notifications sent, workflows started.
This tool executes a web server startup operation, which falls under Execute rather than Write. While it creates/modifies the runtime state of a service, the primary action is triggering an external process (web server launch). The severity is high because a malicious actor could use this to instantiate services that consume resources, expose ports, or run unintended code.
From the tool's definition The tool description states it will '启动web服务并展示模型' (start a web service and display the model) and runs '后台运行' (in the background). This involves launching and running a web server process, which is a command execution action that triggers external operations.
Attacks that exploit this kind of access
该工具将启动web服务并展示模型，启动后会后台运行，所以避免重复调用！ 调用成功后，请在浏览器里输入本地地址和 init 中指定的端口号进行查看。 在调用此工具前，下面的事情需要就位，否则此工具可能无法正常工作： - 遵循 getSpec 工具中的指示并进行了原型创造。 - 已经调用 init 工具进行了初始化。. It is categorised as a Execute tool in the MCP-Prototype MCP Server, which means it can trigger actions or run processes. Use rate limits and argument validation.
Register the MCP-Prototype MCP server in PolicyLayer and add a rule for start: allow, deny, rate-limit, or require approval. Point your MCP client at the PolicyLayer proxy URL and the rule is enforced on every call, before it reaches MCP-Prototype. Nothing to install.
start is a Execute tool with high risk. Execute tools should be rate-limited and have argument validation enabled.
Yes. Add a rate_limit block to the start rule in your PolicyLayer policy. For example, setting max: 10 and window: 60 limits the tool to 10 calls per minute. Rate limits are tracked per agent session and reset automatically.
Set action: deny in the PolicyLayer policy for start. The AI agent will receive a policy violation error and cannot call the tool. You can also include a reason field to explain why the tool is blocked.
start is provided by the MCP-Prototype MCP server (llxxbb/mcp-prototype). PolicyLayer sits as a proxy in front of this server to enforce policies before tool calls reach the server.
Every MCP server has a record like this.
Type a name, get the same breakdown: verified identity, auth posture, risk grade, capabilities, recommended policy.
Teams ship this data inside their own products. See what a licence covers →