list_dependabot_alerts

What list_dependabot_alerts does on GitHub

AI agents call list_dependabot_alerts to retrieve information from GitHub without modifying anything. It is typically the context-gathering step in research, monitoring, and reporting workflows, before the agent takes action elsewhere.

Why list_dependabot_alerts is rated Low

This tool queries existing Dependabot security alerts in a repository. It performs information retrieval with no side effects, no modifications to data, and no execution of code or workflows. The blast radius of misuse is minimal—an unauthorized user could view vulnerability information about project dependencies, which is a read-level information disclosure risk, not a destructive or execute-level risk.

From the tool's definition The tool name 'list_dependabot_alerts' and description 'List dependabot alerts' indicate a read-only operation that retrieves security alert data without modifying, deleting, or executing anything.

The rule that runs list_dependabot_alerts safely

PolicyLayer is an MCP gateway: it sits between your AI agents and GitHub, and checks every tool call against a rule you set before the call runs. Nothing changes on the server itself. For list_dependabot_alerts, this is the rule to start with:

{
  "version": "1",
  "default": "deny",
  "tools": {
    "list_dependabot_alerts": {}
  }
}

Questions about list_dependabot_alerts