gcp_vpc_list_subnetworks

What gcp_vpc_list_subnetworks does on GCP MCP Server

AI agents call gcp_vpc_list_subnetworks to retrieve information from GCP MCP Server without modifying anything. It is typically the context-gathering step in research, monitoring, and reporting workflows, before the agent takes action elsewhere.

Why gcp_vpc_list_subnetworks is rated Low

This tool retrieves and lists existing VPC subnetwork data, which is a read operation. However, severity is elevated to 'medium' rather than 'low' because subnetwork information can reveal sensitive infrastructure topology, segmentation, IP allocation schemes, and security posture to an unauthorized AI agent, potentially enabling further reconnaissance attacks.

From the tool's definition Tool name 'gcp_vpc_list_subnetworks' and description 'List subnetworks in a region' indicate a read-only query operation that retrieves network infrastructure information without modification.

The rule that runs gcp_vpc_list_subnetworks safely

PolicyLayer is an MCP gateway: it sits between your AI agents and GCP MCP Server, and checks every tool call against a rule you set before the call runs. Nothing changes on the server itself. For gcp_vpc_list_subnetworks, this is the rule to start with:

{
  "version": "1",
  "default": "deny",
  "tools": {
    "gcp_vpc_list_subnetworks": {}
  }
}

Questions about gcp_vpc_list_subnetworks