test-graph-api-exploration

THE RISK

High Risk

Why test-graph-api-exploration needs a policy

This tool actively executes Graph API queries to probe and discover endpoints/properties, which constitutes running external operations against a live API. It's not a simple read because it performs exploratory/discovery queries that could trigger unintended side effects or expose sensitive data. The 'discover hidden properties or endpoints' language indicates probing behavior beyond standard retrieval.

From the tool's definition "Test various Graph API queries" and "discover hidden properties or endpoints" — executes exploratory API calls against Microsoft Graph

Documented attack patterns abuse exactly the kind of access test-graph-api-exploration gives an agent:

POLICY

How to control test-graph-api-exploration

PolicyLayer is an MCP gateway — it sits between your AI agents and My MCP, and nothing reaches the server without passing your rules. This is the rule we recommend for test-graph-api-exploration:

policy.json

{
  "version": "1",
  "default": "deny",
  "tools": {
    "test-graph-api-exploration": {
      "limits": [
        {
          "counter": "test-graph-api-exploration_rate",
          "window": "minute",
          "max": 10,
          "scope": "grant"
        }
      ]
    }
  }
}

test-graph-api-exploration stays usable, but rate-capped — a runaway agent can't fire it dozens of times a minute. Everything else on the server is denied unless you say otherwise.

Create a free account and register My MCP — nothing to install.
Add this policy — paste it, or build it visually.
Point your MCP client (Claude, Cursor, anything) at your gateway URL.

RATE-LIMIT THIS TOOL →

Free to start. No card required.

EXPLORE

Related tools and policies

More My MCP tools

Destructive delete-checklist-item Delete a checklist item (subtask) from a task. This removes just the specific subtask, not Destructive delete-task Delete a task from a Microsoft Todo list. This will remove the task and all its checklist Destructive delete-task-list Delete a task list (top-level container) from Microsoft Todo. This will remove the list an Write archive-completed-tasks Move completed tasks older than a specified number of days from one list to another (archi Write create-checklist-item Create a new checklist item (subtask) for a task. Checklist items help break down a task i Write create-task Create a new task in a specific Microsoft Todo list. A task is the main todo item that can Write create-task-list Create a new task list (top-level container) in Microsoft Todo to help organize your tasks Write update-checklist-item Update an existing checklist item (subtask). Allows changing the text content or completio

All 16 My MCP tools →

Execute tools on other servers

Android Forensics ADB MCP Server adb_shell_command EMBA-MCP run_emba_scan Frida Game Hacking MCP remove_breakpoint Procmon request_elevation

Go deeper

High-risk tools in My MCP → Every high-risk tool this server exposes, in one view.
All high-risk MCP tools → Every high-risk tool across the catalogue, and the policy pattern that contains them.
The MCP Attack Database → Documented attack patterns against MCP deployments — and the policies that stop them.
Agent sandbox → Bounding what an agent can execute and where the boundary should sit.
Least privilege for MCP → Granting agents the minimum tool surface the task needs.
Rate Limiting MCP Tool Calls: A Practical Guide →
MCP Security: Why Prompt Guardrails Aren't Enough →

FAQ

Questions about test-graph-api-exploration

What does the test-graph-api-exploration tool do? +

Test various Graph API queries to discover hidden properties or endpoints for folder/group organization in Microsoft To Do. It is categorised as a Execute tool in the My MCP MCP Server, which means it can trigger actions or run processes. Use rate limits and argument validation.

How do I enforce a policy on test-graph-api-exploration? +

Register the My MCP server in PolicyLayer and add a rule for test-graph-api-exploration: allow, deny, rate-limit, or require approval. Point your MCP client at the PolicyLayer proxy URL and the rule is enforced on every call, before it reaches My MCP. Nothing to install.

What risk level is test-graph-api-exploration? +

test-graph-api-exploration is a Execute tool with high risk. Execute tools should be rate-limited and have argument validation enabled.

Can I rate-limit test-graph-api-exploration? +

Yes. Add a rate_limit block to the test-graph-api-exploration rule in your PolicyLayer policy. For example, setting max: 10 and window: 60 limits the tool to 10 calls per minute. Rate limits are tracked per agent session and reset automatically.

How do I block test-graph-api-exploration completely? +

Set action: deny in the PolicyLayer policy for test-graph-api-exploration. The AI agent will receive a policy violation error and cannot call the tool. You can also include a reason field to explain why the tool is blocked.

What MCP server provides test-graph-api-exploration? +

test-graph-api-exploration is provided by the My MCP server (jordanburke/microsoft-todo-mcp-server). PolicyLayer sits as a proxy in front of this server to enforce policies before tool calls reach the server.

Enforce policy on every My MCP tool call.

Start from My MCP, add the rest of your stack, and see everything your agents can call. Then put policy on all of it.

CHECK YOUR STACK →