get_listener_foreignHttps

What get_listener_foreignHttps does on Cobalt Strike MCP Server

AI agents call get_listener_foreignHttps to retrieve information from Cobalt Strike MCP Server without modifying anything. It is typically the context-gathering step in research, monitoring, and reporting workflows, before the agent takes action elsewhere.

Why get_listener_foreignHttps is rated Low

This tool retrieves information about a Foreign HTTPS listener configuration in Cobalt Strike. While categorized as Read (no side effects), the severity is high because: (1) Cobalt Strike is an adversarial red team tool, (2) listener details may expose operational infrastructure, targeting information, or C2 communication parameters that could be misused to compromise systems or evade detection, and (3) an AI agent…

From the tool's definition Tool name 'get_listener_foreignHttps' and description 'Get Foreign HTTPS listener details' indicate retrieval/query of listener configuration data without modification or execution.

The rule that runs get_listener_foreignHttps safely

PolicyLayer is an MCP gateway: it sits between your AI agents and Cobalt Strike MCP Server, and checks every tool call against a rule you set before the call runs. Nothing changes on the server itself. For get_listener_foreignHttps, this is the rule to start with:

{
  "version": "1",
  "default": "deny",
  "tools": {
    "get_listener_foreignHttps": {}
  }
}

Questions about get_listener_foreignHttps