docker_ps

What docker_ps does on Terminal Guardian

AI agents call docker_ps to retrieve information from Terminal Guardian without modifying anything. It is typically the context-gathering step in research, monitoring, and reporting workflows, before the agent takes action elsewhere.

Why docker_ps is rated Low

This tool performs passive information retrieval about running Docker containers. It is analogous to the standard 'docker ps' command, which lists containers but does not execute code, modify containers, or cause destructive actions. The blast radius of misuse is minimal—an attacker could gain visibility into the container environment but cannot directly compromise it through this tool alone.

From the tool's definition Tool name 'docker_ps' and description 'List Docker containers with their status, image, and port information' indicate a read-only query operation that retrieves container metadata without modifying, executing, or deleting anything.

The rule that runs docker_ps safely

PolicyLayer is an MCP gateway: it sits between your AI agents and Terminal Guardian, and checks every tool call against a rule you set before the call runs. Nothing changes on the server itself. For docker_ps, this is the rule to start with:

{
  "version": "1",
  "default": "deny",
  "tools": {
    "docker_ps": {}
  }
}

Questions about docker_ps