users_search

What users_search does on Vikunja

AI agents call users_search to retrieve information from Vikunja without modifying anything. It is typically the context-gathering step in research, monitoring, and reporting workflows, before the agent takes action elsewhere.

Why users_search is rated Low

This tool retrieves or queries user data without creating, modifying, deleting, or executing any operations. It performs a search operation which is a read-only action. Severity is low because search results of user metadata poses minimal risk even if misused—it returns informational data without enabling account compromise, financial transactions, or data destruction.

From the tool's definition Tool description explicitly states 'Search for users' which is a retrieval operation with no modification or side effects. The function name 'users_search' and description indicate querying user information by username, name, or email.

The rule that runs users_search safely

PolicyLayer is an MCP gateway: it sits between your AI agents and Vikunja, and checks every tool call against a rule you set before the call runs. Nothing changes on the server itself. For users_search, this is the rule to start with:

{
  "version": "1",
  "default": "deny",
  "tools": {
    "users_search": {}
  }
}

Questions about users_search