xero_contacts

What xero_contacts does on UnClick

AI agents call xero_contacts to retrieve information from UnClick without modifying anything. It is typically the context-gathering step in research, monitoring, and reporting workflows, before the agent takes action elsewhere.

Parameters from the server's own tool schema.

Why xero_contacts is rated Low

This tool queries and retrieves contact data from Xero accounting software without modifying, creating, or deleting any records. It has no side effects beyond data retrieval. While contacts may contain sensitive information, the risk is mitigated by the read-only nature and the fact that access control is typically enforced at the API/authentication level rather than the tool level.

From the tool's definition Tool name 'xero_contacts' and description 'Get contacts from Xero' indicate a retrieval operation. The verb 'Get' and lack of any modification language (create, update, delete) confirm read-only behavior.

Risk signalsHandles credentials or secrets (access_token)

The rule that runs xero_contacts safely

PolicyLayer is an MCP gateway: it sits between your AI agents and UnClick, and checks every tool call against a rule you set before the call runs. Nothing changes on the server itself. For xero_contacts, this is the rule to start with:

{
  "version": "1",
  "default": "deny",
  "tools": {
    "xero_contacts": {}
  }
}

Questions about xero_contacts