tree

What tree does on Npm

AI agents call tree to retrieve information from Npm without modifying anything. It is typically the context-gathering step in research, monitoring, and reporting workflows, before the agent takes action elsewhere.

Why tree is rated Low

This is a passive information retrieval operation. The 'display' and 'tree' language indicates it queries existing project metadata to show the dependency structure. There are no side effects, no modifications to the project, no code execution, and no irreversible actions. It fits the Read category of tools that retrieve or query data without side effects.

From the tool's definition The tool 'displays the dependency tree for a Rust project' — a read-only operation that retrieves and presents hierarchical package dependency information without modifying any files, dependencies, or configurations.

The rule that runs tree safely

PolicyLayer is an MCP gateway: it sits between your AI agents and Npm, and checks every tool call against a rule you set before the call runs. Nothing changes on the server itself. For tree, this is the rule to start with:

{
  "version": "1",
  "default": "deny",
  "tools": {
    "tree": {}
  }
}

Questions about tree