query_collection

What query_collection does on Ncp

AI agents call query_collection to retrieve information from Ncp without modifying anything. It is typically the context-gathering step in research, monitoring, and reporting workflows, before the agent takes action elsewhere.

Why query_collection is rated Low

This tool performs a read operation against a Firestore database. While it retrieves data (Read category), the severity is medium rather than low because: (1) Firestore queries can return sensitive data depending on collection contents and access patterns, (2) an AI agent could potentially construct queries to extract unintended information, and (3) the tool operates in an N-to-1 orchestration context where…

From the tool's definition Tool name 'query_collection' and description 'Query Firestore collection' indicate data retrieval from a database without modification capabilities.

The rule that runs query_collection safely

PolicyLayer is an MCP gateway: it sits between your AI agents and Ncp, and checks every tool call against a rule you set before the call runs. Nothing changes on the server itself. For query_collection, this is the rule to start with:

{
  "version": "1",
  "default": "deny",
  "tools": {
    "query_collection": {}
  }
}

Questions about query_collection