network-ls

What network-ls does on Cargo

AI agents call network-ls to retrieve information from Cargo without modifying anything. It is typically the context-gathering step in research, monitoring, and reporting workflows, before the agent takes action elsewhere.

Why network-ls is rated Low

This is a passive information retrieval operation. It lists Docker network configurations and metadata (driver, scope) without creating, modifying, deleting, or executing anything. The blast radius is minimal—worst case, an AI agent gains visibility into local Docker network topology, which is non-destructive and typically not sensitive in isolation.

From the tool's definition Tool name 'network-ls' and description 'Lists Docker networks with structured driver and scope information' indicate a read-only operation that queries and returns information about existing Docker networks without modifying or executing actions.

The rule that runs network-ls safely

PolicyLayer is an MCP gateway: it sits between your AI agents and Cargo, and checks every tool call against a rule you set before the call runs. Nothing changes on the server itself. For network-ls, this is the rule to start with:

{
  "version": "1",
  "default": "deny",
  "tools": {
    "network-ls": {}
  }
}

Questions about network-ls