LAS/LAZ ファイルのメタ情報を返す。
AI agents call pointcloud_info to retrieve information from Pointcloud without modifying anything — typically the context-gathering step in research, monitoring, and reporting workflows, before the agent takes action elsewhere.
This tool retrieves and queries metadata from point cloud files without modifying, deleting, or executing any operations. It is a straightforward read operation with no capability to alter data, execute code, or cause financial impact. The low severity reflects minimal blast radius if misused—an AI could only extract metadata about point cloud files.
From the tool's definition Tool description states it returns 'メタ情報' (metadata) from LAS/LAZ files. The name 'pointcloud_info' and the action of returning metadata are purely informational with no side effects.
Attacks that exploit this kind of access
LAS/LAZ ファイルのメタ情報を返す。. It is categorised as a Read tool in the Pointcloud MCP Server, which means it retrieves data without modifying state.
Register the Pointcloud MCP server in PolicyLayer and add a rule for pointcloud_info: allow, deny, rate-limit, or require approval. Point your MCP client at the PolicyLayer proxy URL and the rule is enforced on every call, before it reaches Pointcloud. Nothing to install.
pointcloud_info is a Read tool with low risk. Read-only tools are generally safe to allow by default.
Yes. Add a rate_limit block to the pointcloud_info rule in your PolicyLayer policy. For example, setting max: 10 and window: 60 limits the tool to 10 calls per minute. Rate limits are tracked per agent session and reset automatically.
Set action: deny in the PolicyLayer policy for pointcloud_info. The AI agent will receive a policy violation error and cannot call the tool. You can also include a reason field to explain why the tool is blocked.
pointcloud_info is provided by the Pointcloud MCP server (jyou-syo/pointcloud-mcp). PolicyLayer sits as a proxy in front of this server to enforce policies before tool calls reach the server.
Every MCP server has a record like this.
Type a name, get the same breakdown: verified identity, auth posture, risk grade, capabilities, recommended policy.
Teams ship this data inside their own products. See what a licence covers →