cloud_backup_run

What cloud_backup_run does on Truenas

AI agents invoke cloud_backup_run to trigger actions in Truenas. What it does depends on the arguments the agent supplies, and its effects often reach beyond the immediate call: builds kicked off, notifications sent, workflows started.

Why cloud_backup_run is rated High

The tool executes a backup operation, which is a real-time action that initiates data transfer and processing on external systems. While not destructive in the sense of deletion, it is an Execute action because it triggers an irreversible operational sequence. Severity is high because a malicious agent could exhaust cloud storage, incur unexpected costs, or disrupt backup schedules.

From the tool's definition Tool name and description indicate 'Run a cloud backup task now' — this triggers an external operation (cloud backup execution) whose effects depend on system state and backup configuration.

The rule that runs cloud_backup_run safely

PolicyLayer is an MCP gateway: it sits between your AI agents and Truenas, and checks every tool call against a rule you set before the call runs. Nothing changes on the server itself. For cloud_backup_run, this is the rule to start with:

{
  "version": "1",
  "default": "deny",
  "tools": {
    "cloud_backup_run": {
      "limits": [
        {
          "counter": "cloud_backup_run_rate",
          "window": "minute",
          "max": 10,
          "scope": "grant"
        }
      ]
    }
  }
}

Questions about cloud_backup_run