gcp_pubsub_get_subscription

What gcp_pubsub_get_subscription does on GCP MCP Server

AI agents call gcp_pubsub_get_subscription to retrieve information from GCP MCP Server without modifying anything. It is typically the context-gathering step in research, monitoring, and reporting workflows, before the agent takes action elsewhere.

Why gcp_pubsub_get_subscription is rated Low

This tool performs a read-only query operation to retrieve subscription configuration and metadata from Google Cloud Pub/Sub. It does not create, modify, delete, or execute any operations—it only fetches existing data. The blast radius of misuse is minimal; an attacker could enumerate subscription details but cannot alter infrastructure or access message payloads directly through this read operation alone.

From the tool's definition Tool name contains 'get' and description states 'Get details of a Pub/Sub subscription' — retrieves subscription metadata without modification or side effects.

The rule that runs gcp_pubsub_get_subscription safely

PolicyLayer is an MCP gateway: it sits between your AI agents and GCP MCP Server, and checks every tool call against a rule you set before the call runs. Nothing changes on the server itself. For gcp_pubsub_get_subscription, this is the rule to start with:

{
  "version": "1",
  "default": "deny",
  "tools": {
    "gcp_pubsub_get_subscription": {}
  }
}

Questions about gcp_pubsub_get_subscription