maven-dependencies

What maven-dependencies does on Cargo

AI agents call maven-dependencies to retrieve information from Cargo without modifying anything. It is typically the context-gathering step in research, monitoring, and reporting workflows, before the agent takes action elsewhere.

Why maven-dependencies is rated Low

This tool reads and displays Maven dependency metadata. It has no side effects—it does not modify code, execute build processes, delete files, or trigger external operations. It is purely informational, analogous to running 'mvn dependency:tree' to inspect dependencies. The low severity reflects that misuse would only expose harmless structural information about project dependencies.

From the tool's definition Tool name 'maven-dependencies' and description 'Shows the Maven dependency tree with structured output per artifact' indicate a query/inspection operation that retrieves and displays dependency information without modifying systems or executing code.

The rule that runs maven-dependencies safely

PolicyLayer is an MCP gateway: it sits between your AI agents and Cargo, and checks every tool call against a rule you set before the call runs. Nothing changes on the server itself. For maven-dependencies, this is the rule to start with:

{
  "version": "1",
  "default": "deny",
  "tools": {
    "maven-dependencies": {}
  }
}

Questions about maven-dependencies