list_tokens

What list_tokens does on Js Reverse

AI agents call list_tokens to retrieve information from Js Reverse without modifying anything. It is typically the context-gathering step in research, monitoring, and reporting workflows, before the agent takes action elsewhere.

Why list_tokens is rated Low

This is a Read operation as it retrieves sensitive token metadata without side effects. However, severity is high because exposure of authentication tokens (even just their names, types, and active status) creates significant security risk if an AI agent gains access to this information, potentially enabling token exfiltration, unauthorized authentication, or lateral movement attacks.

From the tool's definition Tool performs a query operation: 'List all saved authentication tokens' with no modification or deletion capability. The description explicitly indicates retrieval only ('Shows name, type, metadata, and which one is active').

The rule that runs list_tokens safely

PolicyLayer is an MCP gateway: it sits between your AI agents and Js Reverse, and checks every tool call against a rule you set before the call runs. Nothing changes on the server itself. For list_tokens, this is the rule to start with:

{
  "version": "1",
  "default": "deny",
  "tools": {
    "list_tokens": {}
  }
}

Questions about list_tokens