list_courses

What list_courses does on School MCP

AI agents call list_courses to retrieve information from School MCP without modifying anything. It is typically the context-gathering step in research, monitoring, and reporting workflows, before the agent takes action elsewhere.

Why list_courses is rated Low

This tool retrieves a list of courses from Canvas, a read-only operation with no data modification, execution of code, deletion, or financial implications. The blast radius is minimal—an AI agent could at worst enumerate courses already accessible to the authenticated user. Severity is low because the information returned is likely limited to courses the user is already enrolled in or has access to.

From the tool's definition Tool name 'list_courses' and description 'List available courses from Canvas' indicate a query operation that retrieves course data without modification or side effects.

The rule that runs list_courses safely

PolicyLayer is an MCP gateway: it sits between your AI agents and School MCP, and checks every tool call against a rule you set before the call runs. Nothing changes on the server itself. For list_courses, this is the rule to start with:

{
  "version": "1",
  "default": "deny",
  "tools": {
    "list_courses": {}
  }
}

Questions about list_courses