oauth_user_list

What oauth_user_list does on Yaver

AI agents call oauth_user_list to retrieve information from Yaver without modifying anything. It is typically the context-gathering step in research, monitoring, and reporting workflows, before the agent takes action elsewhere.

Why oauth_user_list is rated Low

This tool retrieves user information (email and id) without side effects or the ability to modify, delete, or execute operations. It is purely informational. While it does expose PII (email addresses), the risk is limited to information disclosure rather than mutation or destructive capability, justifying a 'low' severity classification for an AI agent misusing it.

From the tool's definition 'List registered OAuth users (email + id only, never hashes)' - the verb 'List' and qualifier 'only' indicate a read-only retrieval of user metadata without modification or deletion.

The rule that runs oauth_user_list safely

PolicyLayer is an MCP gateway: it sits between your AI agents and Yaver, and checks every tool call against a rule you set before the call runs. Nothing changes on the server itself. For oauth_user_list, this is the rule to start with:

{
  "version": "1",
  "default": "deny",
  "tools": {
    "oauth_user_list": {}
  }
}

Questions about oauth_user_list