list_organisations

What list_organisations does on Boxkite — Xero Backup & Export

AI agents call list_organisations to retrieve information from Boxkite — Xero Backup & Export without modifying anything. It is typically the context-gathering step in research, monitoring, and reporting workflows, before the agent takes action elsewhere.

Why list_organisations is rated Low

This tool retrieves metadata about connected Xero organisations without modifying any data. It is a pure query operation with no side effects. Severity is medium rather than low because exposure of financial accounting system metadata (organisation names, connection status) could enable social engineering or targeting of specific companies, though the data itself is not financial transactions.

From the tool's definition Tool description states 'List the Xero organisations' which is a retrieval operation. The server is described as 'Complete read-only backup and export', confirming no modifications occur. Tool name uses 'list' which is a classic Read operation pattern.

The rule that runs list_organisations safely

PolicyLayer is an MCP gateway: it sits between your AI agents and Boxkite — Xero Backup & Export, and checks every tool call against a rule you set before the call runs. Nothing changes on the server itself. For list_organisations, this is the rule to start with:

{
  "version": "1",
  "default": "deny",
  "tools": {
    "list_organisations": {}
  }
}

Questions about list_organisations