backend_collections

What backend_collections does on Yaver

AI agents call backend_collections to retrieve information from Yaver without modifying anything. It is typically the context-gathering step in research, monitoring, and reporting workflows, before the agent takes action elsewhere.

Why backend_collections is rated Low

This tool performs a read-only operation to enumerate available database collections. It has no side effects, does not execute code, does not modify data, and does not involve financial transactions. The blast radius of misuse is minimal—an attacker gains only visibility into database structure, which is typically already known in a local development environment.

From the tool's definition Tool name and description both indicate 'List all PocketBase collections (tables)' — a query operation that retrieves metadata about database schema without modifying or executing anything.

The rule that runs backend_collections safely

PolicyLayer is an MCP gateway: it sits between your AI agents and Yaver, and checks every tool call against a rule you set before the call runs. Nothing changes on the server itself. For backend_collections, this is the rule to start with:

{
  "version": "1",
  "default": "deny",
  "tools": {
    "backend_collections": {}
  }
}

Questions about backend_collections