spawn_shell

What spawn_shell does on Cobalt Strike MCP Server

AI agents invoke spawn_shell to trigger actions in Cobalt Strike MCP Server. What it does depends on the arguments the agent supplies, and its effects often reach beyond the immediate call: builds kicked off, notifications sent, workflows started.

Why spawn_shell is rated High

This tool allows execution of arbitrary shell commands on remote systems (beacons) without apparent constraints. In a red-team context, it can run commands with full privileges of the beacon process, potentially enabling lateral movement, data exfiltration, malware deployment, persistence mechanisms, or system compromise. Misuse by an AI agent could cause extensive damage across compromised infrastructure.

From the tool's definition Tool executes arbitrary shell commands on remote beacons. Description explicitly states 'Execute a shell command' with no restrictions on command types or parameters, enabling unrestricted code execution on compromised systems.

The rule that runs spawn_shell safely

PolicyLayer is an MCP gateway: it sits between your AI agents and Cobalt Strike MCP Server, and checks every tool call against a rule you set before the call runs. Nothing changes on the server itself. For spawn_shell, this is the rule to start with:

{
  "version": "1",
  "default": "deny",
  "tools": {
    "spawn_shell": {
      "limits": [
        {
          "counter": "spawn_shell_rate",
          "window": "minute",
          "max": 10,
          "scope": "grant"
        }
      ]
    }
  }
}

Questions about spawn_shell