# get_export_manifest

See what an IN-PROGRESS export contains so far (entities included, per-entity record/file counts, and per-file checksums), growing as discovery and downloading proceed. The per-file list is paged: check filesPage.hasMore and pass fileOffset to walk it. Once the export finishes, this returns status 'complete' with a pointer instead of a list, because the full manifest travels inside the ZIP as manifest.json: get a download URL, then read manifest.json from the archive.

Agent View of the PolicyLayer registry record for `get_export_manifest`. HTML page: https://policylayer.com/tools/com-getboxkite-xero-backup-export/get-export-manifest

## Facts

- Tool: `get_export_manifest`
- Server: Boxkite — Xero Backup & Export (`https://app.getboxkite.com/mcp`) — https://policylayer.com/tools/com-getboxkite-xero-backup-export.md
- Homepage: https://github.com/https://app.getboxkite.com/mcp
- Risk category: Read (Low risk)
- Registry record: grade D, identity unverified
- Server auth posture: open
- Server rate-limited: no
- Parameters: 3 (1 required)
- Recommended policy verdict: Allowed

## Parameters

| Parameter | Type | Required | Description |
| --- | --- | --- | --- |
| `exportId` | string | yes |  |
| `fileLimit` | integer | no | Files per page (default 500, max 5000) |
| `fileOffset` | integer | no | Index of the first file to return (default 0) |

Parameters from the server's own tool schema.

## Example call (MCP tools/call, JSON-RPC 2.0)

```json
{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "get_export_manifest",
    "arguments": {
      "exportId": "<exportId>"
    }
  }
}
```

## Why get_export_manifest is rated Low

This tool performs pure data retrieval—it queries the status and contents of an ongoing export operation without creating, modifying, deleting, or executing anything. It is strictly informational, reading manifest metadata as exports proceed. The low severity reflects that misuse would only expose accounting data visibility (already backup/read-only context), not enable destructive or financial actions.

From the tool's own definition: "Tool description explicitly states it 'See what an IN-PROGRESS export contains' and returns status information and file lists. The server description emphasizes 'read-only backup and export' of accounting data."

## Use case

AI agents call get_export_manifest to retrieve information from Boxkite — Xero Backup & Export without modifying anything. It is typically the context-gathering step in research, monitoring, and reporting workflows, before the agent takes action elsewhere.

## Recommended policy (PolicyLayer)

Verdict: **Allowed**. Enforced by the PolicyLayer MCP gateway (https://policylayer.com/mcp-gateway) before a call reaches Boxkite — Xero Backup & Export:

```json
{
  "version": "1",
  "default": "deny",
  "tools": {
    "get_export_manifest": {}
  }
}
```

## Other tools on Boxkite — Xero Backup & Export (6)

- `start_export` — Financial — https://policylayer.com/tools/com-getboxkite-xero-backup-export/start-export.md
- `get_download_url` — Read — https://policylayer.com/tools/com-getboxkite-xero-backup-export/get-download-url.md
- `get_export_mapping` — Read — https://policylayer.com/tools/com-getboxkite-xero-backup-export/get-export-mapping.md
- `get_export_status` — Read — https://policylayer.com/tools/com-getboxkite-xero-backup-export/get-export-status.md
- `list_exports` — Read — https://policylayer.com/tools/com-getboxkite-xero-backup-export/list-exports.md
- `list_organisations` — Read — https://policylayer.com/tools/com-getboxkite-xero-backup-export/list-organisations.md

## For agents

This record is a snapshot. Live verdicts and the full registry:

- Check every server in your MCP config at once: `npx -y policylayer stack`
- Vet a server before you add it: install the mcp-precheck skill — `npx skills add https://policylayer.com` (skill text: https://policylayer.com/skill.md)
- Query the registry over MCP: endpoint `https://api.policylayer.com/mcp` — tools `check_mcp_server`, `check_mcp_stack`, `check_tool`, `search_registry`, `get_change_events`

---

Source: the PolicyLayer MCP registry — one continuously verified record per MCP server. Full record: https://policylayer.com/registry?q=com-getboxkite-xero-backup-export · API: https://policylayer.com/registry/api · Policy library: https://policylayer.com/policies/com-getboxkite-xero-backup-export