list_api_tokens

What list_api_tokens does on cPanel MCP Server

AI agents call list_api_tokens to retrieve information from cPanel MCP Server without modifying anything. It is typically the context-gathering step in research, monitoring, and reporting workflows, before the agent takes action elsewhere.

Why list_api_tokens is rated Low

This tool retrieves existing cPanel API tokens, which are sensitive authentication credentials that could grant significant access if exposed to an attacker. While the action itself is read-only (no data modification), the severity is elevated due to the sensitivity of the data being exposed—API tokens are equivalent to passwords and can be used to authenticate and authorize actions on the cPanel account.

From the tool's definition Tool name 'list_api_tokens' and description 'List all cPanel API tokens for the account' indicate retrieval of sensitive authentication credentials without modification.

The rule that runs list_api_tokens safely

PolicyLayer is an MCP gateway: it sits between your AI agents and cPanel MCP Server, and checks every tool call against a rule you set before the call runs. Nothing changes on the server itself. For list_api_tokens, this is the rule to start with:

{
  "version": "1",
  "default": "deny",
  "tools": {
    "list_api_tokens": {}
  }
}

Questions about list_api_tokens