Run an action on a group: rename (needs name), collapse, expand, pin, unpin, focus (focuses its anchor), set-color (hex; omit to clear), set-icon (symbol; omit to clear), move (toIndex/before/after), ungroup (dissolve, keep workspaces), delete (CLOSES every member workspace — needs confirm=true; ...
AI agents call cmux_group_action to permanently remove resources in Cmux — typically in cleanup and lifecycle workflows. It does its job in a single call, and there is no undo.
The tool can irreversibly close every member workspace in a group via the 'delete' action. While other actions like rename, collapse, expand, and move are lower risk, the most severe applicable category must be chosen. Closing all member workspaces is a destructive, potentially irreversible operation with a large blast radius — an AI agent could accidentally wipe out an entire group of active workspaces.
From the tool's definition delete (CLOSES every member workspace — needs confirm=true; prefer ungroup)
Risk signalsBulk/mass operation — affects multiple targets
Attacks that exploit this kind of access
Run an action on a group: rename (needs name), collapse, expand, pin, unpin, focus (focuses its anchor), set-color (hex; omit to clear), set-icon (symbol; omit to clear), move (toIndex/before/after), ungroup (dissolve, keep workspaces), delete (CLOSES every member workspace — needs confirm=true; prefer ungroup). It is categorised as a Destructive tool in the Cmux MCP Server, which means it can permanently delete or destroy data. Block by default and require explicit approval.
Register the Cmux MCP server in PolicyLayer and add a rule for cmux_group_action: allow, deny, rate-limit, or require approval. Point your MCP client at the PolicyLayer proxy URL and the rule is enforced on every call, before it reaches Cmux. Nothing to install.
cmux_group_action is a Destructive tool with critical risk. Critical-risk tools should be blocked by default and only enabled with explicit human approval.
Yes. Add a rate_limit block to the cmux_group_action rule in your PolicyLayer policy. For example, setting max: 10 and window: 60 limits the tool to 10 calls per minute. Rate limits are tracked per agent session and reset automatically.
Set action: deny in the PolicyLayer policy for cmux_group_action. The AI agent will receive a policy violation error and cannot call the tool. You can also include a reason field to explain why the tool is blocked.
cmux_group_action is provided by the Cmux MCP server (puchkoff/cmux-mcp). PolicyLayer sits as a proxy in front of this server to enforce policies before tool calls reach the server.
Every MCP server has a record like this.
Type a name, get the same breakdown: verified identity, auth posture, risk grade, capabilities, recommended policy.
Teams ship this data inside their own products. See what a licence covers →