list_groups

What list_groups does on AWS

AI agents call list_groups to retrieve information from AWS without modifying anything. It is typically the context-gathering step in research, monitoring, and reporting workflows, before the agent takes action elsewhere.

Why list_groups is rated Low

The tool lists AWS groups without creating, modifying, deleting, or executing operations. The 'list_*' naming pattern is canonical for Read operations that retrieve and enumerate resources. Sibling tools like 'add_user_to_group' and 'attach_group_policy' are clearly Write/Execute; this tool's name suggests the opposite—passive discovery.

From the tool's definition Tool name 'list_groups' indicates retrieval/enumeration of AWS groups with no side effects. Description is empty, but the tool name clearly suggests a query operation consistent with Read category semantics (e.g., similar to AWS IAM ListGroups API).

The rule that runs list_groups safely

PolicyLayer is an MCP gateway: it sits between your AI agents and AWS, and checks every tool call against a rule you set before the call runs. Nothing changes on the server itself. For list_groups, this is the rule to start with:

{
  "version": "1",
  "default": "deny",
  "tools": {
    "list_groups": {}
  }
}

Questions about list_groups