state-list

What state-list does on Github

AI agents call state-list to retrieve information from Github without modifying anything. It is typically the context-gathering step in research, monitoring, and reporting workflows, before the agent takes action elsewhere.

Why state-list is rated Low

This is a read-only operation that queries and returns Terraform state information. It retrieves resource addresses without creating, modifying, deleting, or executing any infrastructure changes. The blast radius is low—misuse would at worst expose information about tracked infrastructure but cannot alter deployments or trigger unintended operations.

From the tool's definition Tool description explicitly states: 'Lists all resources tracked in the Terraform state. Returns resource addresses.' The verb 'lists' and focus on returning/querying state information indicates data retrieval with no modification or side effects.

The rule that runs state-list safely

PolicyLayer is an MCP gateway: it sits between your AI agents and Github, and checks every tool call against a rule you set before the call runs. Nothing changes on the server itself. For state-list, this is the rule to start with:

{
  "version": "1",
  "default": "deny",
  "tools": {
    "state-list": {}
  }
}

Questions about state-list