# list_devices

List devices, ONE PAGE at a time — YOUR OWN by default (owner-scoped to the calling account: the same reach the dashboard gives you), or the WHOLE fleet with all:true (devices:view operators only; re-verified server-side — for a non-operator all is rejected, never silently widened). PAGINATION (read this before concluding anything is absent): every response carries total (the EXACT count in scope), returned (rows in THIS page), has_more, and next_cursor. If has_more is true the answer is INCOMPLETE — call again with cursor: <next_cursor> (same order and same scope) and repeat until has_more is false. NEVER report that a device/port/name is absent from a page where has_more was true; page to the end or resolve it directly with get_device. truncated_by:"byte_budget" means the page stopped early to fit the response budget — the cut rows are simply the NEXT page, nothing was lost. ORDERING: order:"last_seen" (default) is recency-first and best for browsing, but last_seen_at moves whenever a device heartbeats, so a row can shift ahead of the cursor mid-run — for a GUARANTEED complete enumeration pass order:"uuid" (immutable key, stable_enumeration:true). Each row is a slim projection: uuid, name, platform, online (DERIVED from last_seen_at freshness — #776, never the raw device_status latch), last_seen_at, vpn_state, the per-device connection_type override (null = inherits user → global), and pac_port/pac_url for PAC-provisioned devices; null keys are omitted. fields:"full" adds model, os_version and parent_device_id + parent_name (farm/iOS children resolve their host's NAME) at ~2x the bytes per row. Fleet rows also resolve each owner to a human name. OPERATOR CROSS-USER: owner_email scopes the fleet to the account(s) whose email matches that substring (case-insensitive) — the dashboard /devices owner-email search's MCP twin; devices:view is required and re-verified in-handler, so for a non-operator owner_email is rejected exactly like all. Use to answer "what devices do I own" / "list my devices" / "which devices are online". BROWSING ONLY: to resolve a device you ALREADY have a uuid, name, or PAC port/URL for, call get_device with it directly — never scan or page this list hunting for a known device. Read-only, no confirm. Returns { ok, scope: own|fleet, order, stable_enumeration, returned, total, has_more, next_cursor, truncated_by, fields, devices:[…], note? }.

Agent View of the PolicyLayer registry record for `list_devices`. HTML page: https://policylayer.com/tools/dev-busymate-busymate-devtools/list-devices

## Facts

- Tool: `list_devices`
- Server: Busymate DevTools (`https://mcp.busymate.dev`) — https://policylayer.com/tools/dev-busymate-busymate-devtools.md
- Homepage: https://github.com/serebano/busymate-devtools
- Risk category: Read (Low risk)
- Registry record: grade F, identity unverified
- Server auth posture: open
- Server rate-limited: no
- Parameters: 7
- Recommended policy verdict: Allowed

## Parameters

| Parameter | Type | Required | Description |
| --- | --- | --- | --- |
| `all` | boolean | no | devices:view operators only — list EVERY device (the whole fleet) instead of just YOUR OWN. |
| `limit` | number | no | Max devices per page (default 100, cap 500). The byte budget may return fewer — check has_more. |
| `order` | string | no | "last_seen" (default) = most-recently-seen first, best for browsing. "uuid" = the immutable key — the ONLY ordering that guarantees a complete, skip-free enumer |
| `cursor` | string | no | Resume token from the previous page's `next_cursor`. Must be used with the SAME order and scope it was issued for. |
| `fields` | string | no | "slim" (default) = identity + status + PAC, null keys omitted. "full" adds model, os_version and the parent linkage (~2x bytes per row). |
| `max_bytes` | number | no | Page byte budget for the devices array (default 24000, min 2000, max 60000). Lower it for a small tool-result window. |
| `owner_email` | string | no | OPERATOR cross-user scope (devices:view required, re-verified in-handler fail-closed): list the devices owned by the account(s) whose email matches this substri |

Parameters from the server's own tool schema.

## Example call (MCP tools/call, JSON-RPC 2.0)

```json
{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "list_devices",
    "arguments": {}
  }
}
```

## Why list_devices is rated Low

Even though list_devices only reads data, uncontrolled read access leaks sensitive information and racks up API costs: an agent caught in a retry loop can make thousands of calls a minute without anyone noticing.

Risk signals: Bulk/mass operation — affects multiple targets

## Use case

AI agents call list_devices to retrieve information from Busymate DevTools without modifying anything. It is typically the context-gathering step in research, monitoring, and reporting workflows, before the agent takes action elsewhere.

## Recommended policy (PolicyLayer)

Verdict: **Allowed**. Enforced by the PolicyLayer MCP gateway (https://policylayer.com/mcp-gateway) before a call reaches Busymate DevTools:

```json
{
  "version": "1",
  "default": "deny",
  "tools": {
    "list_devices": {}
  }
}
```

## Other tools on Busymate DevTools (43)

- `share_advisor_finding` — Execute — https://policylayer.com/tools/dev-busymate-busymate-devtools/share-advisor-finding.md
- `summarize_device_traffic` — Execute — https://policylayer.com/tools/dev-busymate-busymate-devtools/summarize-device-traffic.md
- `download_snapshot` — Read — https://policylayer.com/tools/dev-busymate-busymate-devtools/download-snapshot.md
- `export_har` — Read — https://policylayer.com/tools/dev-busymate-busymate-devtools/export-har.md
- `get_advisor_finding` — Read — https://policylayer.com/tools/dev-busymate-busymate-devtools/get-advisor-finding.md
- `get_audit_event` — Read — https://policylayer.com/tools/dev-busymate-busymate-devtools/get-audit-event.md
- `get_block_rules_device` — Read — https://policylayer.com/tools/dev-busymate-busymate-devtools/get-block-rules-device.md
- `get_device` — Read — https://policylayer.com/tools/dev-busymate-busymate-devtools/get-device.md
- `get_device_egress_fail_posture` — Read — https://policylayer.com/tools/dev-busymate-busymate-devtools/get-device-egress-fail-posture.md
- `get_device_egress_status` — Read — https://policylayer.com/tools/dev-busymate-busymate-devtools/get-device-egress-status.md
- `get_device_health` — Read — https://policylayer.com/tools/dev-busymate-busymate-devtools/get-device-health.md
- `get_device_settings` — Read — https://policylayer.com/tools/dev-busymate-busymate-devtools/get-device-settings.md
- `get_device_status` — Read — https://policylayer.com/tools/dev-busymate-busymate-devtools/get-device-status.md
- `get_entry` — Read — https://policylayer.com/tools/dev-busymate-busymate-devtools/get-entry.md
- `get_entry_count` — Read — https://policylayer.com/tools/dev-busymate-busymate-devtools/get-entry-count.md
- `get_my_account` — Read — https://policylayer.com/tools/dev-busymate-busymate-devtools/get-my-account.md
- `get_push_response` — Read — https://policylayer.com/tools/dev-busymate-busymate-devtools/get-push-response.md
- `get_service_group` — Read — https://policylayer.com/tools/dev-busymate-busymate-devtools/get-service-group.md
- `get_stats` — Read — https://policylayer.com/tools/dev-busymate-busymate-devtools/get-stats.md
- `get_status` — Read — https://policylayer.com/tools/dev-busymate-busymate-devtools/get-status.md
- `get_subscription` — Read — https://policylayer.com/tools/dev-busymate-busymate-devtools/get-subscription.md
- `get_todo` — Read — https://policylayer.com/tools/dev-busymate-busymate-devtools/get-todo.md
- `get_usage` — Read — https://policylayer.com/tools/dev-busymate-busymate-devtools/get-usage.md
- `get_workspace` — Read — https://policylayer.com/tools/dev-busymate-busymate-devtools/get-workspace.md
- `inspect_requests` — Read — https://policylayer.com/tools/dev-busymate-busymate-devtools/inspect-requests.md
- `list_advisor_findings` — Read — https://policylayer.com/tools/dev-busymate-busymate-devtools/list-advisor-findings.md
- `list_audit_events` — Read — https://policylayer.com/tools/dev-busymate-busymate-devtools/list-audit-events.md
- `list_breakpoint_events` — Read — https://policylayer.com/tools/dev-busymate-busymate-devtools/list-breakpoint-events.md
- `list_device_audit_modes` — Read — https://policylayer.com/tools/dev-busymate-busymate-devtools/list-device-audit-modes.md
- `list_device_events` — Read — https://policylayer.com/tools/dev-busymate-busymate-devtools/list-device-events.md
- …and 13 more: https://policylayer.com/tools/dev-busymate-busymate-devtools.md

## For agents

This record is a snapshot. Live verdicts and the full registry:

- Check every server in your MCP config at once: `npx -y policylayer stack`
- Vet a server before you add it: install the mcp-precheck skill — `npx skills add https://policylayer.com` (skill text: https://policylayer.com/skill.md)
- Query the registry over MCP: endpoint `https://api.policylayer.com/mcp` — tools `check_mcp_server`, `check_mcp_stack`, `check_tool`, `search_registry`, `get_change_events`

---

Source: the PolicyLayer MCP registry — one continuously verified record per MCP server. Full record: https://policylayer.com/registry?q=dev-busymate-busymate-devtools · API: https://policylayer.com/registry/api · Policy library: https://policylayer.com/policies/dev-busymate-busymate-devtools