Reclaim docker disk space. Requires confirm=true.
AI agents call infra_prune_tool to permanently remove resources in Infra — typically in cleanup and lifecycle workflows. It does its job in a single call, and there is no undo.
Docker prune operations (docker system prune, docker image prune, etc.) permanently remove images, stopped containers, unused volumes, and networks. These cannot be recovered once deleted. The 'Requires confirm=true' guard acknowledges the destructive nature. Misuse by an AI agent could destroy build artifacts, cached layers, or data volumes needed for running services, making this high severity.
From the tool's definition 'Reclaim docker disk space' — pruning Docker resources (images, containers, volumes, networks) is an irreversible operation that permanently deletes unused or stopped Docker objects.
Attacks that exploit this kind of access
Reclaim docker disk space. Requires confirm=true. It is categorised as a Destructive tool in the Infra MCP Server, which means it can permanently delete or destroy data. Block by default and require explicit approval.
Register the Infra MCP server in PolicyLayer and add a rule for infra_prune_tool: allow, deny, rate-limit, or require approval. Point your MCP client at the PolicyLayer proxy URL and the rule is enforced on every call, before it reaches Infra. Nothing to install.
infra_prune_tool is a Destructive tool with critical risk. Critical-risk tools should be blocked by default and only enabled with explicit human approval.
Yes. Add a rate_limit block to the infra_prune_tool rule in your PolicyLayer policy. For example, setting max: 10 and window: 60 limits the tool to 10 calls per minute. Rate limits are tracked per agent session and reset automatically.
Set action: deny in the PolicyLayer policy for infra_prune_tool. The AI agent will receive a policy violation error and cannot call the tool. You can also include a reason field to explain why the tool is blocked.
infra_prune_tool is provided by the Infra MCP server (odanree/infra-mcp). PolicyLayer sits as a proxy in front of this server to enforce policies before tool calls reach the server.
Every MCP server has a record like this.
Type a name, get the same breakdown: verified identity, auth posture, risk grade, capabilities, recommended policy.
Teams ship this data inside their own products. See what a licence covers →