runbox_list_directory

What runbox_list_directory does on Runbox Website Builder MCP

AI agents call runbox_list_directory to retrieve information from Runbox Website Builder MCP without modifying anything. It is typically the context-gathering step in research, monitoring, and reporting workflows, before the agent takes action elsewhere.

Why runbox_list_directory is rated Low

This tool only retrieves directory contents without side effects, matching the Read category definition. The blast radius is minimal: exposure of this tool allows an attacker to discover file structure but cannot modify, delete, or execute code. Severity is low because directory enumeration alone presents limited risk compared to write, execute, or destructive operations on the same server.

From the tool's definition Tool name contains 'list' and description states 'List all direct children in a directory' — core read operation with no modification or execution capability. The non-recursive scope and read-only nature further confirm this.

The rule that runs runbox_list_directory safely

PolicyLayer is an MCP gateway: it sits between your AI agents and Runbox Website Builder MCP, and checks every tool call against a rule you set before the call runs. Nothing changes on the server itself. For runbox_list_directory, this is the rule to start with:

{
  "version": "1",
  "default": "deny",
  "tools": {
    "runbox_list_directory": {}
  }
}

Questions about runbox_list_directory