get_signed_url

What get_signed_url does on Tencent Cloud COS MCP Server

AI agents call get_signed_url to retrieve information from Tencent Cloud COS MCP Server without modifying anything. It is typically the context-gathering step in research, monitoring, and reporting workflows, before the agent takes action elsewhere.

Why get_signed_url is rated Low

Generating signed URLs is a read operation—it retrieves authentication tokens to access data without modifying or deleting anything. The 'temporary' nature limits exposure window. While signed URLs can theoretically be misused to grant unintended access, the tool itself performs only credential generation, making it Read category with low severity since it has no direct side effects on data integrity or availability.

From the tool's definition Tool name 'get_signed_url' and description '获取COS对象的临时签名URL' (Get temporary signed URL for COS object) indicate generation of read-only access URLs. This is a non-destructive operation that generates temporary credentials for accessing existing objects.

The rule that runs get_signed_url safely

PolicyLayer is an MCP gateway: it sits between your AI agents and Tencent Cloud COS MCP Server, and checks every tool call against a rule you set before the call runs. Nothing changes on the server itself. For get_signed_url, this is the rule to start with:

{
  "version": "1",
  "default": "deny",
  "tools": {
    "get_signed_url": {}
  }
}

Questions about get_signed_url