# list_my_work_items

The cards that are YOURS, across every board in the workspace, ordered the way a developer actually picks: escalated first (the top band of each card's OWN scheme — a P1 is never equated with a Critical), then by the board's own left-to-right flow so the earliest active stage comes first, then longest-waiting. Cards in a terminal column (Production, Deep backlog) sink to the bottom, because nothing should be picked up from them. "Yours" is TWO things: cards you OWN (you are the assignee, carrying it end to end) and cards whose CURRENT PASS you hold (you took it at a stage — the QA case). Both appear here, and each card carries assignee and handler so you can tell which of the two put it in front of you. A QA person owns none of the cards they are testing, so a queue keyed only on the assignee would tell them they had no work while four cards sat on their bench. "You" is resolved from the authenticated token. There is deliberately NO parameter naming a user, and the endpoint refuses one rather than ignoring it — otherwise one agent could read another developer's queue through the very tool meant to keep them off each other's cards. To see somebody else's work, read their board with get_work_board. Start here for "what should I work on". With includeUnassigned it also returns the cards nobody owns AND nobody is handling, which are the ones free to take (move_work_item with claim:true).

Agent View of the PolicyLayer registry record for `list_my_work_items`. HTML page: https://policylayer.com/tools/adrata-starfield-mcp/list-my-work-items

## Facts

- Tool: `list_my_work_items`
- Server: Starfield (`@adrata/starfield-mcp`) — https://policylayer.com/tools/adrata-starfield-mcp.md
- Install: `npx -y @adrata/starfield-mcp`
- Homepage: https://www.npmjs.com/package/@adrata/starfield-mcp
- Risk category: Read (Low risk)
- Registry record: grade F, identity unverified
- Server rate-limited: no
- Parameters: 3
- Recommended policy verdict: Allowed

## Parameters

| Parameter | Type | Required | Description |
| --- | --- | --- | --- |
| `limit` | number | no | Cap each list. Defaults to 50; a queue that needs a second page is not a queue. |
| `boardId` | string | no | Narrow to one board. Omit for every board. |
| `includeUnassigned` | boolean | no | Also return the cards nobody owns and nobody is handling — the pool that is genuinely free. Use it when your own queue is empty, instead of pulling whole boards |

Parameters from the server's own tool schema.

## Example call (MCP tools/call, JSON-RPC 2.0)

```json
{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "list_my_work_items",
    "arguments": {}
  }
}
```

## Why list_my_work_items is rated Low

Even though list_my_work_items only reads data, uncontrolled read access leaks sensitive information and racks up API costs: an agent caught in a retry loop can make thousands of calls a minute without anyone noticing.

Risk signals: Bulk/mass operation — affects multiple targets

## Use case

AI agents call list_my_work_items to retrieve information from Starfield without modifying anything. It is typically the context-gathering step in research, monitoring, and reporting workflows, before the agent takes action elsewhere.

## Recommended policy (PolicyLayer)

Verdict: **Allowed**. Enforced by the PolicyLayer MCP gateway (https://policylayer.com/mcp-gateway) before a call reaches Starfield:

```json
{
  "version": "1",
  "default": "deny",
  "tools": {
    "list_my_work_items": {}
  }
}
```

## Other tools on Starfield (232)

- `bulk_delete_buyer_groups` — Destructive — https://policylayer.com/tools/adrata-starfield-mcp/bulk-delete-buyer-groups.md
- `cancel_agent_task` — Destructive — https://policylayer.com/tools/adrata-starfield-mcp/cancel-agent-task.md
- `delete_action` — Destructive — https://policylayer.com/tools/adrata-starfield-mcp/delete-action.md
- `delete_buyer_group` — Destructive — https://policylayer.com/tools/adrata-starfield-mcp/delete-buyer-group.md
- `delete_company` — Destructive — https://policylayer.com/tools/adrata-starfield-mcp/delete-company.md
- `delete_note` — Destructive — https://policylayer.com/tools/adrata-starfield-mcp/delete-note.md
- `delete_opportunity` — Destructive — https://policylayer.com/tools/adrata-starfield-mcp/delete-opportunity.md
- `delete_partner` — Destructive — https://policylayer.com/tools/adrata-starfield-mcp/delete-partner.md
- `delete_person` — Destructive — https://policylayer.com/tools/adrata-starfield-mcp/delete-person.md
- `delete_webhook` — Destructive — https://policylayer.com/tools/adrata-starfield-mcp/delete-webhook.md
- `flag_work_item` — Destructive — https://policylayer.com/tools/adrata-starfield-mcp/flag-work-item.md
- `forget` — Destructive — https://policylayer.com/tools/adrata-starfield-mcp/forget.md
- `paper_delete_document` — Destructive — https://policylayer.com/tools/adrata-starfield-mcp/paper-delete-document.md
- `paper_revoke_share` — Destructive — https://policylayer.com/tools/adrata-starfield-mcp/paper-revoke-share.md
- `remove_buyer_group_member` — Destructive — https://policylayer.com/tools/adrata-starfield-mcp/remove-buyer-group-member.md
- `adrata_ai_tool_execute` — Execute — https://policylayer.com/tools/adrata-starfield-mcp/adrata-ai-tool-execute.md
- `adrata_api_request` — Execute — https://policylayer.com/tools/adrata-starfield-mcp/adrata-api-request.md
- `attribute_partner_to_deal` — Execute — https://policylayer.com/tools/adrata-starfield-mcp/attribute-partner-to-deal.md
- `build_pursuit_command_center` — Execute — https://policylayer.com/tools/adrata-starfield-mcp/build-pursuit-command-center.md
- `draft_workflow` — Execute — https://policylayer.com/tools/adrata-starfield-mcp/draft-workflow.md
- `dry_run_workflow` — Execute — https://policylayer.com/tools/adrata-starfield-mcp/dry-run-workflow.md
- `record_partner_consumption` — Execute — https://policylayer.com/tools/adrata-starfield-mcp/record-partner-consumption.md
- `replay_workflow_run` — Execute — https://policylayer.com/tools/adrata-starfield-mcp/replay-workflow-run.md
- `request_deployment` — Execute — https://policylayer.com/tools/adrata-starfield-mcp/request-deployment.md
- `request_provider_action_execution` — Execute — https://policylayer.com/tools/adrata-starfield-mcp/request-provider-action-execution.md
- `request_workflow_deployment` — Execute — https://policylayer.com/tools/adrata-starfield-mcp/request-workflow-deployment.md
- `warmup_email` — Execute — https://policylayer.com/tools/adrata-starfield-mcp/warmup-email.md
- `adrata_ai_tool_catalog` — Read — https://policylayer.com/tools/adrata-starfield-mcp/adrata-ai-tool-catalog.md
- `adrata_api_catalog` — Read — https://policylayer.com/tools/adrata-starfield-mcp/adrata-api-catalog.md
- `adrata_desktop_app_audit` — Read — https://policylayer.com/tools/adrata-starfield-mcp/adrata-desktop-app-audit.md
- …and 202 more: https://policylayer.com/tools/adrata-starfield-mcp.md

## For agents

This record is a snapshot. Live verdicts and the full registry:

- Check every server in your MCP config at once: `npx -y policylayer stack`
- Vet a server before you add it: install the mcp-precheck skill — `npx skills add https://policylayer.com` (skill text: https://policylayer.com/skill.md)
- Query the registry over MCP: endpoint `https://api.policylayer.com/mcp` — tools `check_mcp_server`, `check_mcp_stack`, `check_tool`, `search_registry`, `get_change_events`

---

Source: the PolicyLayer MCP registry — one continuously verified record per MCP server. Full record: https://policylayer.com/registry?q=adrata-starfield-mcp · API: https://policylayer.com/registry/api · Policy library: https://policylayer.com/policies/adrata-starfield-mcp