get_env

What get_env does on CoWork OS

AI agents call get_env to retrieve information from CoWork OS without modifying anything. It is typically the context-gathering step in research, monitoring, and reporting workflows, before the agent takes action elsewhere.

Why get_env is rated Low

This tool retrieves environment variable values without creating, modifying, or deleting data. It is a simple query operation that has no side effects. Severity is low because environment variables typically contain configuration data, though sensitive values (API keys, credentials) could theoretically be exposed—however, the tool itself is read-only and any risk depends entirely on what is stored in the environment…

From the tool's definition Tool description: 'Get the value of an environment variable'. The verb 'get' and the action of retrieving a value with no modification indicates a read-only operation.

The rule that runs get_env safely

PolicyLayer is an MCP gateway: it sits between your AI agents and CoWork OS, and checks every tool call against a rule you set before the call runs. Nothing changes on the server itself. For get_env, this is the rule to start with:

{
  "version": "1",
  "default": "deny",
  "tools": {
    "get_env": {}
  }
}

Questions about get_env