# invoke_method

Call a public method BY NAME on a component of a live scene GameObject, passing ARGUMENTS. The with-args sibling of invoke_button (which only calls parameterless [Button]/methods on a scene component). Finds a public method matching name + arg-count, coerces each JSON arg to the parameter type (primitives/enums; Color/Vector3 as comma strings

Agent View of the PolicyLayer registry record for `invoke_method`. HTML page: https://policylayer.com/tools/sbox/invoke-method

## Facts

- Tool: `invoke_method`
- Server: Sbox (`sbox-mcp-server`) — https://policylayer.com/tools/sbox.md
- Install: `npx -y sbox-mcp-server`
- Homepage: git+https://github.com/LouSputthole/Sbox-Claude.git
- Risk category: Execute (High risk)
- Registry record: grade F, identity unverified
- Server rate-limited: no
- Parameters: 0
- Recommended policy verdict: Rate-limited

## Example call (MCP tools/call, JSON-RPC 2.0)

```json
{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "invoke_method",
    "arguments": {}
  }
}
```

## Why invoke_method is rated High

This tool executes code dynamically by invoking public methods on live scene components with arbitrary arguments. The ability to call any public method matching a name and argument count, with type coercion of JSON inputs, means an AI agent could trigger unintended side effects, game logic changes, or state modifications depending on which methods exist and what they do.

From the tool's own definition: "Tool description states: 'Call a public method BY NAME on a component of a live scene GameObject, passing ARGUMENTS' and 'coerces each JSON arg to the parameter type'. This directly invokes arbitrary methods on game objects with user-supplied arguments."

## Use case

AI agents invoke invoke_method to trigger actions in Sbox. What it does depends on the arguments the agent supplies, and its effects often reach beyond the immediate call: builds kicked off, notifications sent, workflows started.

## Recommended policy (PolicyLayer)

Verdict: **Rate-limited**. Enforced by the PolicyLayer MCP gateway (https://policylayer.com/mcp-gateway) before a call reaches Sbox:

```json
{
  "version": "1",
  "default": "deny",
  "tools": {
    "invoke_method": {
      "limits": [
        {
          "counter": "invoke_method_rate",
          "window": "minute",
          "max": 10,
          "scope": "grant"
        }
      ]
    }
  }
}
```

## Other tools on Sbox (206)

- `clear_cave_path` — Destructive — https://policylayer.com/tools/sbox/clear-cave-path.md
- `clear_forest_pois` — Destructive — https://policylayer.com/tools/sbox/clear-forest-pois.md
- `clear_terrain_features` — Destructive — https://policylayer.com/tools/sbox/clear-terrain-features.md
- `debug_clear` — Destructive — https://policylayer.com/tools/sbox/debug-clear.md
- `delete_gameobject` — Destructive — https://policylayer.com/tools/sbox/delete-gameobject.md
- `delete_script` — Destructive — https://policylayer.com/tools/sbox/delete-script.md
- `remove_component` — Destructive — https://policylayer.com/tools/sbox/remove-component.md
- `snap_to_ground` — Destructive — https://policylayer.com/tools/sbox/snap-to-ground.md
- `bake_navmesh` — Execute — https://policylayer.com/tools/sbox/bake-navmesh.md
- `bake_reflections` — Execute — https://policylayer.com/tools/sbox/bake-reflections.md
- `build_terrain_mesh` — Execute — https://policylayer.com/tools/sbox/build-terrain-mesh.md
- `console_run` — Execute — https://policylayer.com/tools/sbox/console-run.md
- `create_event_director` — Execute — https://policylayer.com/tools/sbox/create-event-director.md
- `create_npc_spawner` — Execute — https://policylayer.com/tools/sbox/create-npc-spawner.md
- `create_trigger_zone` — Execute — https://policylayer.com/tools/sbox/create-trigger-zone.md
- `debug_draw_box` — Execute — https://policylayer.com/tools/sbox/debug-draw-box.md
- `debug_draw_ray` — Execute — https://policylayer.com/tools/sbox/debug-draw-ray.md
- `debug_draw_sphere` — Execute — https://policylayer.com/tools/sbox/debug-draw-sphere.md
- `drive_player` — Execute — https://policylayer.com/tools/sbox/drive-player.md
- `execute_csharp` — Execute — https://policylayer.com/tools/sbox/execute-csharp.md
- `focus_object` — Execute — https://policylayer.com/tools/sbox/focus-object.md
- `frame_camera` — Execute — https://policylayer.com/tools/sbox/frame-camera.md
- `invoke_button` — Execute — https://policylayer.com/tools/sbox/invoke-button.md
- `load_scene` — Execute — https://policylayer.com/tools/sbox/load-scene.md
- `network_spawn` — Execute — https://policylayer.com/tools/sbox/network-spawn.md
- `play_animation` — Execute — https://policylayer.com/tools/sbox/play-animation.md
- `play_sound_preview` — Execute — https://policylayer.com/tools/sbox/play-sound-preview.md
- `playtest` — Execute — https://policylayer.com/tools/sbox/playtest.md
- `recompile_asset` — Execute — https://policylayer.com/tools/sbox/recompile-asset.md
- `restart_editor` — Execute — https://policylayer.com/tools/sbox/restart-editor.md
- …and 176 more: https://policylayer.com/tools/sbox.md

## For agents

This record is a snapshot. Live verdicts and the full registry:

- Check every server in your MCP config at once: `npx -y policylayer stack`
- Vet a server before you add it: install the mcp-precheck skill — `npx skills add https://policylayer.com` (skill text: https://policylayer.com/skill.md)
- Query the registry over MCP: endpoint `https://api.policylayer.com/mcp` — tools `check_mcp_server`, `check_mcp_stack`, `check_tool`, `search_registry`, `get_change_events`

---

Source: the PolicyLayer MCP registry — one continuously verified record per MCP server. Full record: https://policylayer.com/registry?q=sbox · API: https://policylayer.com/registry/api · Policy library: https://policylayer.com/policies/sbox