list_drivers

What list_drivers does on Procmon

AI agents call list_drivers to retrieve information from Procmon without modifying anything. It is typically the context-gathering step in research, monitoring, and reporting workflows, before the agent takes action elsewhere.

Why list_drivers is rated Low

The tool retrieves a list of kernel drivers using the WMI Win32_SystemDriver class. This is a read-only operation that queries system information without creating, modifying, deleting, or executing any code. While kernel driver information could theoretically inform malicious actions, the tool itself performs no side effects and poses minimal direct risk as a standalone operation.

From the tool's definition Tool 'list_drivers' uses 'Enumerate kernel drivers via Win32_SystemDriver' - a passive query operation that retrieves system state without modification or execution.

The rule that runs list_drivers safely

PolicyLayer is an MCP gateway: it sits between your AI agents and Procmon, and checks every tool call against a rule you set before the call runs. Nothing changes on the server itself. For list_drivers, this is the rule to start with:

{
  "version": "1",
  "default": "deny",
  "tools": {
    "list_drivers": {}
  }
}

Questions about list_drivers