list_api_keys

What list_api_keys does on agentView

AI agents call list_api_keys to retrieve information from agentView without modifying anything. It is typically the context-gathering step in research, monitoring, and reporting workflows, before the agent takes action elsewhere.

Parameters from the server's own tool schema.

Why list_api_keys is rated Low

This is a Read category tool because it retrieves data (API key metadata) with no side effects. However, severity is medium rather than low because: (1) it requires admin scope, indicating privileged access; (2) API key metadata (prefix, scope, creation dates) could be valuable reconnaissance for an attacker planning credential attacks or understanding the system's authentication landscape; (3) in the context of a…

From the tool's definition Tool name is 'list_api_keys' and description states it 'Lists all API keys for the current user. Returns key metadata (prefix, name, scope, dates)' — this is a read operation that queries and retrieves data without modifying or executing anything.

Risk signalsHandles credentials or secrets (access_token) · Admin/system-level operation

The rule that runs list_api_keys safely

PolicyLayer is an MCP gateway: it sits between your AI agents and agentView, and checks every tool call against a rule you set before the call runs. Nothing changes on the server itself. For list_api_keys, this is the rule to start with:

{
  "version": "1",
  "default": "deny",
  "tools": {
    "list_api_keys": {}
  }
}

Questions about list_api_keys