get_api_key_info

What get_api_key_info does on Bybit

AI agents call get_api_key_info to retrieve information from Bybit without modifying anything. It is typically the context-gathering step in research, monitoring, and reporting workflows, before the agent takes action elsewhere.

Why get_api_key_info is rated Low

While this is a Read operation (no side effects, no state modification), it deserves medium severity because API key information itself is sensitive data. If exposed to an attacker, knowing permissions and IP whitelist settings could enable more targeted attacks or help an attacker understand the scope of compromised credentials.

From the tool's definition The tool is named 'get_api_key_info' and its description states it retrieves 'current API key information (permissions, IP whitelist, etc.)'. This is fundamentally a read/query operation that retrieves data without modifying state.

The rule that runs get_api_key_info safely

PolicyLayer is an MCP gateway: it sits between your AI agents and Bybit, and checks every tool call against a rule you set before the call runs. Nothing changes on the server itself. For get_api_key_info, this is the rule to start with:

{
  "version": "1",
  "default": "deny",
  "tools": {
    "get_api_key_info": {}
  }
}

Questions about get_api_key_info