string_get

What string_get does on AWS

AI agents call string_get to retrieve information from AWS without modifying anything. It is typically the context-gathering step in research, monitoring, and reporting workflows, before the agent takes action elsewhere.

Why string_get is rated Low

This tool retrieves data (a string value) by key without modifying, deleting, or executing anything. It is a simple key-value lookup operation, analogous to a database GET or cache fetch. The blast radius of misuse is minimal—at worst, an agent could read sensitive stored strings, which is a confidentiality rather than integrity/availability risk. Classified as Read/low severity.

From the tool's definition Tool name 'string_get' and description 'Get string value' indicate a retrieval operation with no side effects. The function signature takes a key parameter and returns a value, consistent with read operations.

The rule that runs string_get safely

PolicyLayer is an MCP gateway: it sits between your AI agents and AWS, and checks every tool call against a rule you set before the call runs. Nothing changes on the server itself. For string_get, this is the rule to start with:

{
  "version": "1",
  "default": "deny",
  "tools": {
    "string_get": {}
  }
}

Questions about string_get