retrieveJsonWebKeySetWithId

What retrieveJsonWebKeySetWithId does on Fusionauth

AI agents call retrieveJsonWebKeySetWithId to retrieve information from Fusionauth without modifying anything. It is typically the context-gathering step in research, monitoring, and reporting workflows, before the agent takes action elsewhere.

Why retrieveJsonWebKeySetWithId is rated Low

This tool retrieves public key material (JWKS) which is cryptographically public by design and intended for client-side JWT verification. It performs a query/read operation with no ability to modify, delete, execute commands, or affect financial systems. The blast radius of misuse is minimal since public keys are meant to be widely distributed.

From the tool's definition The tool 'retrieveJsonWebKeySetWithId' Returns public keys used by FusionAuth to cryptographically verify JWTs using the JSON Web Key format. This is a retrieval operation that reads and returns public cryptographic keys with no side effects or modifications.

The rule that runs retrieveJsonWebKeySetWithId safely

PolicyLayer is an MCP gateway: it sits between your AI agents and Fusionauth, and checks every tool call against a rule you set before the call runs. Nothing changes on the server itself. For retrieveJsonWebKeySetWithId, this is the rule to start with:

{
  "version": "1",
  "default": "deny",
  "tools": {
    "retrieveJsonWebKeySetWithId": {}
  }
}

Questions about retrieveJsonWebKeySetWithId