elicit-secret

What elicit-secret does on Frontmcp

AI agents call elicit-secret to retrieve information from Frontmcp without modifying anything. It is typically the context-gathering step in research, monitoring, and reporting workflows, before the agent takes action elsewhere.

Why elicit-secret is rated Low

This tool retrieves sensitive information (a secret) from a client through an elicitation request. While it is fundamentally a Read operation (obtaining data), the severity is high because the tool explicitly handles secrets, which are sensitive authentication or authorization credentials. Misuse by an AI agent could trick users into revealing secrets through social engineering via the elicitation mechanism.

From the tool's definition The tool 'elicit-secret' is described as 'Ask the calling client for a secret via elicitation.' It retrieves or queries information (a secret) from the client rather than modifying, deleting, or executing external operations.

The rule that runs elicit-secret safely

PolicyLayer is an MCP gateway: it sits between your AI agents and Frontmcp, and checks every tool call against a rule you set before the call runs. Nothing changes on the server itself. For elicit-secret, this is the rule to start with:

{
  "version": "1",
  "default": "deny",
  "tools": {
    "elicit-secret": {}
  }
}

Questions about elicit-secret