gcp_logging_list_sinks

What gcp_logging_list_sinks does on GCP MCP Server

AI agents call gcp_logging_list_sinks to retrieve information from GCP MCP Server without modifying anything. It is typically the context-gathering step in research, monitoring, and reporting workflows, before the agent takes action elsewhere.

Why gcp_logging_list_sinks is rated Low

This tool retrieves and enumerates logging sink configurations without creating, modifying, deleting, or executing any operations. It is a read-only informational query about existing log export destinations. The blast radius of misuse is minimal — an attacker gains only visibility into how logs are being routed, not the ability to alter logging behavior or access sensitive data through this call alone.

From the tool's definition Tool name contains 'list_' and description states 'List logging sinks (exports)' — a pure query/retrieval operation with no modification or execution of infrastructure.

The rule that runs gcp_logging_list_sinks safely

PolicyLayer is an MCP gateway: it sits between your AI agents and GCP MCP Server, and checks every tool call against a rule you set before the call runs. Nothing changes on the server itself. For gcp_logging_list_sinks, this is the rule to start with:

{
  "version": "1",
  "default": "deny",
  "tools": {
    "gcp_logging_list_sinks": {}
  }
}

Questions about gcp_logging_list_sinks