unifi_list_usergroups

What unifi_list_usergroups does on UniFi Access MCP

AI agents call unifi_list_usergroups to retrieve information from UniFi Access MCP without modifying anything. It is typically the context-gathering step in research, monitoring, and reporting workflows, before the agent takes action elsewhere.

Why unifi_list_usergroups is rated Low

This tool retrieves information about user groups without modifying, deleting, or executing actions. It is a straightforward informational read operation. The severity is low because listing user groups has minimal blast radius—an AI agent misusing this tool could only enumerate metadata about group membership, not access doors, modify credentials, or cause destructive changes.

From the tool's definition Tool name 'list_usergroups' and description 'List all user groups' indicate a query/retrieval operation with no side effects.

Risk signalsBulk/mass operation — affects multiple targets

The rule that runs unifi_list_usergroups safely

PolicyLayer is an MCP gateway: it sits between your AI agents and UniFi Access MCP, and checks every tool call against a rule you set before the call runs. Nothing changes on the server itself. For unifi_list_usergroups, this is the rule to start with:

{
  "version": "1",
  "default": "deny",
  "tools": {
    "unifi_list_usergroups": {}
  }
}

Questions about unifi_list_usergroups