gcp_kms_list_crypto_key_versions

What gcp_kms_list_crypto_key_versions does on GCP MCP Server

AI agents call gcp_kms_list_crypto_key_versions to retrieve information from GCP MCP Server without modifying anything. It is typically the context-gathering step in research, monitoring, and reporting workflows, before the agent takes action elsewhere.

Why gcp_kms_list_crypto_key_versions is rated Low

This is a Read operation; it queries and retrieves information about KMS crypto key versions. However, severity is elevated to 'medium' rather than 'low' because the output could reveal sensitive key version metadata that, if misused by an agent (e.g., to identify outdated or weak key versions for targeting), could inform attacks on the cryptographic infrastructure.

From the tool's definition Tool name and description indicate 'List versions of a crypto key' — a read-only operation that retrieves metadata about cryptographic key versions without modifying, deleting, or executing operations.

The rule that runs gcp_kms_list_crypto_key_versions safely

PolicyLayer is an MCP gateway: it sits between your AI agents and GCP MCP Server, and checks every tool call against a rule you set before the call runs. Nothing changes on the server itself. For gcp_kms_list_crypto_key_versions, this is the rule to start with:

{
  "version": "1",
  "default": "deny",
  "tools": {
    "gcp_kms_list_crypto_key_versions": {}
  }
}

Questions about gcp_kms_list_crypto_key_versions