network-ls

What network-ls does on Build

AI agents call network-ls to retrieve information from Build without modifying anything. It is typically the context-gathering step in research, monitoring, and reporting workflows, before the agent takes action elsewhere.

Why network-ls is rated Low

This tool performs a read-only enumeration of Docker network resources, returning structured information about driver and scope. It has no side effects, cannot modify or delete resources, and does not execute code. The blast radius of misuse is minimal—an attacker gains visibility into local Docker networking configuration but cannot leverage it to modify infrastructure or cause damage without additional tools.

From the tool's definition Tool name 'network-ls' and description 'Lists Docker networks' indicate a query operation that retrieves information about Docker networks without modification or execution.

The rule that runs network-ls safely

PolicyLayer is an MCP gateway: it sits between your AI agents and Build, and checks every tool call against a rule you set before the call runs. Nothing changes on the server itself. For network-ls, this is the rule to start with:

{
  "version": "1",
  "default": "deny",
  "tools": {
    "network-ls": {}
  }
}

Questions about network-ls