get_device_accounts

What get_device_accounts does on Android Forensics ADB MCP Server

AI agents call get_device_accounts to retrieve information from Android Forensics ADB MCP Server without modifying anything. It is typically the context-gathering step in research, monitoring, and reporting workflows, before the agent takes action elsewhere.

Why get_device_accounts is rated Low

This tool retrieves account data without side effects, placing it in the Read category. Severity is high because account lists constitute sensitive personal information that could be leveraged for further attacks (credential harvesting, social engineering, account compromise). The tool itself is non-destructive and non-modifying, but the data it exposes is high-value to attackers.

From the tool's definition Tool description states 'Get list of accounts configured on the device' — a retrieval operation with no modification or deletion. However, account information is sensitive PII that could enable account takeover or impersonation attacks if misused by an agent.

The rule that runs get_device_accounts safely

PolicyLayer is an MCP gateway: it sits between your AI agents and Android Forensics ADB MCP Server, and checks every tool call against a rule you set before the call runs. Nothing changes on the server itself. For get_device_accounts, this is the rule to start with:

{
  "version": "1",
  "default": "deny",
  "tools": {
    "get_device_accounts": {}
  }
}

Questions about get_device_accounts