search_code

What search_code does on GitHub

AI agents call search_code to retrieve information from GitHub without modifying anything. It is typically the context-gathering step in research, monitoring, and reporting workflows, before the agent takes action elsewhere.

Why search_code is rated Low

This tool queries or retrieves code from repositories without modifying, executing, or deleting anything. It is a straightforward read operation that returns search results. The low severity reflects that an AI agent misusing this tool could at worst retrieve sensitive code, which is a confidentiality concern but lacks the blast radius of write, execute, or destructive operations.

From the tool's definition Tool name is 'search_code' with description 'Search code'. The verb 'search' indicates a read-only retrieval operation with no data modification, creation, or execution capabilities.

The rule that runs search_code safely

PolicyLayer is an MCP gateway: it sits between your AI agents and GitHub, and checks every tool call against a rule you set before the call runs. Nothing changes on the server itself. For search_code, this is the rule to start with:

{
  "version": "1",
  "default": "deny",
  "tools": {
    "search_code": {}
  }
}

Questions about search_code