service_start

What service_start does on Truenas

AI agents invoke service_start to trigger actions in Truenas. What it does depends on the arguments the agent supplies, and its effects often reach beyond the immediate call: builds kicked off, notifications sent, workflows started.

Why service_start is rated High

Starting a service is an Execute action because it triggers system-level operations with real-world side effects. The severity is high because misuse could start critical services unexpectedly (e.g., malware distribution services, resource-intensive processes, or services that expose security vulnerabilities), affecting system stability and security.

From the tool's definition Tool name 'service_start' and description indicate it starts a service by name. This is an executable action that triggers external system operations (service initialization) whose effects depend on which service is specified as an argument.

The rule that runs service_start safely

PolicyLayer is an MCP gateway: it sits between your AI agents and Truenas, and checks every tool call against a rule you set before the call runs. Nothing changes on the server itself. For service_start, this is the rule to start with:

{
  "version": "1",
  "default": "deny",
  "tools": {
    "service_start": {
      "limits": [
        {
          "counter": "service_start_rate",
          "window": "minute",
          "max": 10,
          "scope": "grant"
        }
      ]
    }
  }
}

Questions about service_start