container_stop · Kali MCP: Risk & Policy

WHAT IT DOES

What container_stop does on Kali

AI agents invoke container_stop to trigger actions in Kali. What it does depends on the arguments the agent supplies, and its effects often reach beyond the immediate call — builds kicked off, notifications sent, workflows started.

WHY IT NEEDS A POLICY

Why container_stop needs a policy

While the tool does not delete user data or move money, it executes a command that terminates and removes an infrastructure component. This is categorized as Execute rather than Destructive because the container removal is reversible (containers can be recreated), and the primary function is to trigger a Docker operation rather than irreversibly destroy persistent data.

From the tool's definition The tool description states it will "Stop and remove the Kali Linux Docker container." This is an active operational action that triggers external system operations (Docker container lifecycle management) whose effects depend on the container state and…

Attacks that exploit this kind of access

Recommended rule Ready

Verdict

container_stop Rate-limited

container_stop stays usable, but rate-capped — a runaway agent can't fire it dozens of times a minute. Everything else on the server is denied unless you say otherwise.

View as policy code

policy.json

{
  "version": "1",
  "default": "deny",
  "tools": {
    "container_stop": {
      "limits": [
        {
          "counter": "container_stop_rate",
          "window": "minute",
          "max": 10,
          "scope": "grant"
        }
      ]
    }
  }
}

RATE-LIMIT THIS TOOL →

Instant setup, no code required.

PolicyLayer is an MCP gateway: every tool call is checked against your rule before it reaches Kali, so you can run agents against it safely.

FAQ

Questions about container_stop

What does the container_stop tool do? +

Stop and remove the Kali Linux Docker container. It is categorised as a Execute tool in the Kali MCP Server, which means it can trigger actions or run processes. Use rate limits and argument validation.

How do I enforce a policy on container_stop? +

Register the Kali MCP server in PolicyLayer and add a rule for container_stop: allow, deny, rate-limit, or require approval. Point your MCP client at the PolicyLayer proxy URL and the rule is enforced on every call, before it reaches Kali. Nothing to install.

What risk level is container_stop? +

container_stop is a Execute tool with high risk. Execute tools should be rate-limited and have argument validation enabled.

Can I rate-limit container_stop? +

Yes. Add a rate_limit block to the container_stop rule in your PolicyLayer policy. For example, setting max: 10 and window: 60 limits the tool to 10 calls per minute. Rate limits are tracked per agent session and reset automatically.

How do I block container_stop completely? +

Set action: deny in the PolicyLayer policy for container_stop. The AI agent will receive a policy violation error and cannot call the tool. You can also include a reason field to explain why the tool is blocked.

What MCP server provides container_stop? +

container_stop is provided by the Kali MCP server (unaacceptable297/kali-mcp). PolicyLayer sits as a proxy in front of this server to enforce policies before tool calls reach the server.