list_payloads

What list_payloads does on Claude C2

AI agents call list_payloads to retrieve information from Claude C2 without modifying anything. It is typically the context-gathering step in research, monitoring, and reporting workflows, before the agent takes action elsewhere.

Why list_payloads is rated Low

The tool performs a read-only enumeration of available payload types and platforms. While the server context suggests capability for remote system control and the sibling tools indicate access to sensitive operations (AMSI bypass, UAC bypass, defender exclusion), this specific tool only lists metadata about payloads rather than executing, creating, modifying, or deleting them.

From the tool's definition Tool name is 'list_payloads' and description states 'List all available payload types and platforms' — this retrieves information without modifying, deleting, or executing any payloads.

The rule that runs list_payloads safely

PolicyLayer is an MCP gateway: it sits between your AI agents and Claude C2, and checks every tool call against a rule you set before the call runs. Nothing changes on the server itself. For list_payloads, this is the rule to start with:

{
  "version": "1",
  "default": "deny",
  "tools": {
    "list_payloads": {}
  }
}

Questions about list_payloads