config_get_users

What config_get_users does on Aapanel

AI agents call config_get_users to retrieve information from Aapanel without modifying anything. It is typically the context-gathering step in research, monitoring, and reporting workflows, before the agent takes action elsewhere.

Why config_get_users is rated Low

This tool retrieves and displays existing panel user data. No data is created, modified, deleted, or executed. The blast radius is low—exposure allows an attacker to enumerate users but does not grant direct access to perform actions as those users or modify their configurations. This is consistent with the Read category for query/list operations with no side effects.

From the tool's definition Tool name 'config_get_users' and description 'List panel users' indicate retrieval of user information without modification. The verb 'List' is a classic read operation.

The rule that runs config_get_users safely

PolicyLayer is an MCP gateway: it sits between your AI agents and Aapanel, and checks every tool call against a rule you set before the call runs. Nothing changes on the server itself. For config_get_users, this is the rule to start with:

{
  "version": "1",
  "default": "deny",
  "tools": {
    "config_get_users": {}
  }
}

Questions about config_get_users