list_files

What list_files does on Ncp

AI agents call list_files to retrieve information from Ncp without modifying anything. It is typically the context-gathering step in research, monitoring, and reporting workflows, before the agent takes action elsewhere.

Why list_files is rated Low

This tool queries and retrieves a listing of files and folders from Google Drive. It is a read-only operation that has no side effects, does not execute code, does not modify or delete data, and does not involve financial transactions. The blast radius of misuse is minimal—an attacker gains visibility into file structure but cannot access, modify, or delete content.

From the tool's definition Tool name is 'list_files' and description states 'List files and folders in Google Drive' — this is a retrieval operation with no data modification or side effects.

The rule that runs list_files safely

PolicyLayer is an MCP gateway: it sits between your AI agents and Ncp, and checks every tool call against a rule you set before the call runs. Nothing changes on the server itself. For list_files, this is the rule to start with:

{
  "version": "1",
  "default": "deny",
  "tools": {
    "list_files": {}
  }
}

Questions about list_files