retrieveTwoFactorRecoveryCodesWithId

What retrieveTwoFactorRecoveryCodesWithId does on Fusionauth

AI agents call retrieveTwoFactorRecoveryCodesWithId to retrieve information from Fusionauth without modifying anything. It is typically the context-gathering step in research, monitoring, and reporting workflows, before the agent takes action elsewhere.

Why retrieveTwoFactorRecoveryCodesWithId is rated Low

The tool retrieves sensitive authentication recovery codes but does not modify, delete, or execute actions. However, severity is elevated to 'high' because the data retrieved (2FA recovery codes) is highly sensitive—if exposed to an unauthorized AI agent, these codes could be used to bypass multi-factor authentication for the target user, compromising account security.

From the tool's definition Tool name contains 'Retrieve' and description states 'Retrieve two-factor recovery codes for a user.' This is a data retrieval operation with no modification or deletion.

The rule that runs retrieveTwoFactorRecoveryCodesWithId safely

PolicyLayer is an MCP gateway: it sits between your AI agents and Fusionauth, and checks every tool call against a rule you set before the call runs. Nothing changes on the server itself. For retrieveTwoFactorRecoveryCodesWithId, this is the rule to start with:

{
  "version": "1",
  "default": "deny",
  "tools": {
    "retrieveTwoFactorRecoveryCodesWithId": {}
  }
}

Questions about retrieveTwoFactorRecoveryCodesWithId