list_users

What list_users does on AIquila — Nextcloud MCP Server

AI agents call list_users to retrieve information from AIquila — Nextcloud MCP Server without modifying anything. It is typically the context-gathering step in research, monitoring, and reporting workflows, before the agent takes action elsewhere.

Why list_users is rated Low

This tool retrieves a list of all users without modifying, deleting, or executing any operations. It falls squarely into the Read category. However, the severity is high rather than low because it exposes a complete user directory of a Nextcloud instance, which could be misused for reconnaissance, targeted attacks, or privacy violations if an agent gains unauthorized access to admin credentials.

From the tool's definition Tool name 'list_users' and description 'List all users in the Nextcloud instance' indicate data retrieval with no side effects. The requirement for 'admin or sub-admin privileges' indicates access to sensitive user information.

Risk signalsBulk/mass operation — affects multiple targets · Admin/system-level operation

The rule that runs list_users safely

PolicyLayer is an MCP gateway: it sits between your AI agents and AIquila — Nextcloud MCP Server, and checks every tool call against a rule you set before the call runs. Nothing changes on the server itself. For list_users, this is the rule to start with:

{
  "version": "1",
  "default": "deny",
  "tools": {
    "list_users": {}
  }
}

Questions about list_users