pane_split · Wmux MCP: Risk & Policy

WHAT IT DOES

What pane_split does on Wmux

AI agents invoke pane_split to trigger actions in Wmux. What it does depends on the arguments the agent supplies, and its effects often reach beyond the immediate call — builds kicked off, notifications sent, workflows started.

WHY IT NEEDS A POLICY

Why pane_split needs a policy

This tool creates a new terminal pane/PTY (pseudo-terminal) session in a tmux-like multiplexer. Spawning a PTY is an Execute-level action — it initializes a new terminal process that can subsequently run arbitrary commands.

From the tool's definition Split a leaf pane, creating a new sibling pane. Returns the new paneId (and a ptyWarning if a background PTY could not be pre-spawned).

Attacks that exploit this kind of access

Recommended rule Ready

Verdict

pane_split Rate-limited

pane_split stays usable, but rate-capped — a runaway agent can't fire it dozens of times a minute. Everything else on the server is denied unless you say otherwise.

View as policy code

policy.json

{
  "version": "1",
  "default": "deny",
  "tools": {
    "pane_split": {
      "limits": [
        {
          "counter": "pane_split_rate",
          "window": "minute",
          "max": 10,
          "scope": "grant"
        }
      ]
    }
  }
}

RATE-LIMIT THIS TOOL →

Instant setup, no code required.

PolicyLayer is an MCP gateway: every tool call is checked against your rule before it reaches Wmux, so you can run agents against it safely.

FAQ

Questions about pane_split

What does the pane_split tool do? +

Split a leaf pane, creating a new sibling pane. Returns the new paneId (and a ptyWarning if a background PTY could not be pre-spawned). Omit workspaceId to split inside your own (the caller\. It is categorised as a Execute tool in the Wmux MCP Server, which means it can trigger actions or run processes. Use rate limits and argument validation.

How do I enforce a policy on pane_split? +

Register the Wmux MCP server in PolicyLayer and add a rule for pane_split: allow, deny, rate-limit, or require approval. Point your MCP client at the PolicyLayer proxy URL and the rule is enforced on every call, before it reaches Wmux. Nothing to install.

What risk level is pane_split? +

pane_split is a Execute tool with high risk. Execute tools should be rate-limited and have argument validation enabled.

Can I rate-limit pane_split? +

Yes. Add a rate_limit block to the pane_split rule in your PolicyLayer policy. For example, setting max: 10 and window: 60 limits the tool to 10 calls per minute. Rate limits are tracked per agent session and reset automatically.

How do I block pane_split completely? +

Set action: deny in the PolicyLayer policy for pane_split. The AI agent will receive a policy violation error and cannot call the tool. You can also include a reason field to explain why the tool is blocked.

What MCP server provides pane_split? +

pane_split is provided by the Wmux MCP server (openwong2kim/wmux). PolicyLayer sits as a proxy in front of this server to enforce policies before tool calls reach the server.

// THE FULL RECORD

pane_split is one line of Wmux's registry record.

The record carries the whole server: verified identity, auth posture, risk grade, every tool classified, recommended policy — re-checked continuously.

Teams ship this data inside their own products. See what a licence covers →