list_trips

What list_trips does on GetMyHotels

AI agents call list_trips to retrieve information from GetMyHotels without modifying anything. It is typically the context-gathering step in research, monitoring, and reporting workflows, before the agent takes action elsewhere.

Why list_trips is rated Low

This tool retrieves existing trip data for an authenticated user without modifying, deleting, or executing any operations. It is a straightforward read operation. The blast radius is minimal — misuse would only expose the user's own trip information. Severity is low because the data retrieved belongs to the requesting user and exposure is limited to their personal itineraries.

From the tool's definition Tool description states 'List the signed-in user's saved trips (itineraries)' — a retrieval operation with no modification or deletion. The verb 'list' and context of fetching saved data indicate a read-only query.

The rule that runs list_trips safely

PolicyLayer is an MCP gateway: it sits between your AI agents and GetMyHotels, and checks every tool call against a rule you set before the call runs. Nothing changes on the server itself. For list_trips, this is the rule to start with:

{
  "version": "1",
  "default": "deny",
  "tools": {
    "list_trips": {}
  }
}

Questions about list_trips