Is ALM X++ MCP Server safe?

Findings (2)

• highWrite-action tools reachable without authenticationauth.open-write
• lowUnusually long tool description (over 2,000 characters)poison.long-description

  tool create_aot_object: … Generate a complete, ready-to-deploy D365 F&O AOT XML scaffold for any object type. Returns the XML + the correct file path inside the model -- the calling client (VS Extension, Cursor, Copilot Chat) is responsible for writing the result to disk. This tool is fully read-only on the server: it never writes to the filesystem, never mutates external state, and is safe to expose from the cloud MCP. When the knowledge base is available the scaffold is auto-enriched with real metadata (existing field EDTs, related-table validation, auto-detected grid fields, etc.). Supported aotType values ---------------------------------------------- AxTable . AxClass . AxForm . AxEnum AxEdt . AxView . AxQuery . AxDataEntityView AxMenuItemDisplay . AxMenuItemAction . AxMenuItemOutput AxSecurityPrivilege . AxSecurityDuty . AxSecurityRole . AxSecurityPolicy AxReport . AxFormExtension . AxTableExtension . AxClassExtension AxEnumExtension . AxEdtExtension . AxQueryExtension . AxWorkflow Common options (all types) -------------------------------------------- label - human-readable label shown in the UI developerDoc - developer documentation string (tables/classes) AxTable -------------------------------------------------------------------------- tableGroup - Main | WorksheetHeader | WorksheetLine | Transaction | Parameter | Group cacheLookup - None | Found | FoundAndEmpty | NotInTTS | EntireTable fields - csv "Name:Type[:EDT[:Label[:mandatory]]]" Types: String Int Int64 Real Date DateTime Enum Container Guid indexes - csv "IndexName:field1+field2[:unique|:alternatekey]" relations - csv "RelName:RelatedTable:Field:RelatedField" titleField1/2 - field names for the lookup title createdBy / modifiedBy - true | false (default true) generateFind / generateExist / generateValidateWrite / generateInitValue - true | false AxClass -------------------------------------------------------------------------- extends - base class name implements - csv of interfaces abstract / final - true | false pattern - SysOperation | RunBase | Service | EventHandler | none (default) methods - csv of additional method names to stub AxForm ---------------------------------------------------------------------------- dataSourceTable - primary data-source table name pattern - SimpleList | DetailsTransaction | DetailsMaster | ListPage | Dialog gridFields - csv of field names for the grid (auto-detected from KB if omitted) detailFields - csv of field names for the detail group methods - csv of form method names to stub AxEnum ---------------------------------------------------------------------------- style - Ordinary | ComboBox | Radio | CheckBox values - csv "Name[:Label[:intValue]]" e.g. "Draft:Draft:0,Posted:Posted:1" AxEdt ----------------------------------------------------------------------------- extends - base EDT (e.g. Name, Description, Amount) stringSize - integer enumType - base enum for enum EDTs referenceTable - table that provides the lookup AxView ---------------------------------------------------------------------------- dataSources - csv "Table[:Alias]" fields - csv "DataSource.Field[:Alias]" AxQuery ------------------------------------------------------------------------- dataSources - csv "Table[:Alias[:JoinMode]]" AxDataEntityView ----------------------------------------------------------- primaryTable - root table joinTables - csv of additional tables publicEntityName - OData collection name (pluralised entity name) isPublic - true | false (default true) fields - csv "Table.Field[:PublicName]" (auto-detected from KB if omitted) AxMenuItemDisplay / Action / Output ------------------------------------------ objectName - target form / class / report name runOn - Server | Client | Called from (default Server) helpText - tooltip string AxSecurityPrivilege ----------------------------------------------------------- entryPoints - csv "MenuItemName[:ObjectType[:Grant]]" ObjectType: MenuItemDisplay | MenuItemAction | MenuItemOutput Grant: NoAccess | Read | Update | Create | Delete AxSecurityDuty --------------------------------------------------------------------- privileges - csv of privilege names to include AxSecurityRole ---------------------------------------------------------------------- duties - csv of duty names privileges - csv of privilege names (direct assignment -- avoid if possible) AxReport ------------------------------------------------------------------------- query- AxQuery name driving the dataset dataSourceTable - alternative: direct table name (if no query) AxFormExtension ----------------------------------------------------------------- baseForm - name of the standard form to extend fields - csv "ControlName[:EDT]" AxTableExtension --------------------------------------------------------------------- baseTable - name of the standard table to extend fields - csv "Name:Type[:EDT[:Label[:mandatory]]]" indexes - csv "IndexName:field1+field2[:unique|:alternatekey]" AxClassExtension (Chain of Command) ------------------------------------------- baseClass - name of the standard class/table/form to wrap baseType - class | table | form (default class) methods - csv of method names to wrap with CoC AxEnumExtension --------------------------------------------------------------- baseEnum - name of the standard enum to extend values - csv "Name[:Label[:intValue]]" IMPORTANT: start from value 10 or higher to avoid conflicts with standard values (D365 extension contract) AxEdtExtension ---------------------------------------------------------------- baseEdt - name of the standard EDT to extend stringSize - new StringSize (must be <= base EDT limit; omit to inherit) label - override label for this extension AxQueryExtension -------------------------------------------------------------- baseQuery - name of the standard query to extend dataSources - csv "Table[:Alias[:JoinMode]]" (add extra data sources) ranges - csv "DataSource.Field:value" (add filter ranges) AxSecurityPolicy (Row Level Security) ---------------------------------------- constrainedTable - primary table this policy restricts query - AxQuery name that defines the allowed rows operation - Select | Update | Create | Delete | Insert (default Select) enabled - true | false (default true) AxWorkflow --------------------------------------------------------------------- category - category name (links to a module/table) documentTable - table the workflow operates on documentMenuItem - menu item that opens the record…