expose_list

What expose_list does on Yaver

AI agents call expose_list to retrieve information from Yaver without modifying anything. It is typically the context-gathering step in research, monitoring, and reporting workflows, before the agent takes action elsewhere.

Why expose_list is rated Low

This tool retrieves information about active tunnels and their public URLs. While it performs no modifications or deletions, the exposure of tunnel URLs and their active status could reveal infrastructure details and development endpoints to an unauthorized user, warranting medium severity. However, it remains fundamentally a Read operation as it queries and returns existing state without side effects.

From the tool's definition Tool name 'expose_list' and description 'List active tunnels with their public URLs' indicate a query/retrieval operation. The word 'List' denotes read-only enumeration without data modification.

The rule that runs expose_list safely

PolicyLayer is an MCP gateway: it sits between your AI agents and Yaver, and checks every tool call against a rule you set before the call runs. Nothing changes on the server itself. For expose_list, this is the rule to start with:

{
  "version": "1",
  "default": "deny",
  "tools": {
    "expose_list": {}
  }
}

Questions about expose_list