# get_screenshot

Get a specific screenshot by ID

Agent View of the PolicyLayer registry record for `get_screenshot`. HTML page: https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/get-screenshot

## Facts

- Tool: `get_screenshot`
- Server: Cobalt Strike MCP Server (`mickeydb/cobalt-strike-mcp`) — https://policylayer.com/tools/mickeydb-cobalt-strike-mcp.md
- Homepage: https://github.com/MickeyDB/Cobalt-Strike-MCP
- Risk category: Read (Low risk)
- Registry record: grade F, identity unverified
- Server rate-limited: no
- Parameters: 0
- Recommended policy verdict: Allowed

## Example call (MCP tools/call, JSON-RPC 2.0)

```json
{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "get_screenshot",
    "arguments": {}
  }
}
```

## Why get_screenshot is rated Low

This tool retrieves an existing screenshot without altering, executing, or destroying anything. It is a Read operation. However, the severity is high because screenshots from a compromised system contain sensitive information (screen contents, credentials visible on screen, confidential documents, etc.) that could be misused by an AI agent to exfiltrate data or inform further attacks.

From the tool's own definition: "Tool name 'get_screenshot' and description 'Get a specific screenshot by ID' indicate a retrieval operation with no modification or deletion of data."

## Use case

AI agents call get_screenshot to retrieve information from Cobalt Strike MCP Server without modifying anything. It is typically the context-gathering step in research, monitoring, and reporting workflows, before the agent takes action elsewhere.

## Recommended policy (PolicyLayer)

Verdict: **Allowed**. Enforced by the PolicyLayer MCP gateway (https://policylayer.com/mcp-gateway) before a call reaches Cobalt Strike MCP Server:

```json
{
  "version": "1",
  "default": "deny",
  "tools": {
    "get_screenshot": {}
  }
}
```

## Other tools on Cobalt Strike MCP Server (219)

- `beacon_delete_file` — Destructive — https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/beacon-delete-file.md
- `clear_beacon_command_queue` — Destructive — https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/clear-beacon-command-queue.md
- `delete_credential` — Destructive — https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/delete-credential.md
- `delete_listener` — Destructive — https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/delete-listener.md
- `delete_listener_dns` — Destructive — https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/delete-listener-dns.md
- `delete_listener_externalC2` — Destructive — https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/delete-listener-externalc2.md
- `delete_listener_foreignHttp` — Destructive — https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/delete-listener-foreignhttp.md
- `delete_listener_foreignHttps` — Destructive — https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/delete-listener-foreignhttps.md
- `delete_listener_http` — Destructive — https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/delete-listener-http.md
- `delete_listener_https` — Destructive — https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/delete-listener-https.md
- `delete_listener_smb` — Destructive — https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/delete-listener-smb.md
- `delete_listener_tcp` — Destructive — https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/delete-listener-tcp.md
- `delete_listener_userDefinedC2` — Destructive — https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/delete-listener-userdefinedc2.md
- `execute_kerberos_ticket_purge` — Destructive — https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/execute-kerberos-ticket-purge.md
- `execute_socks_stop_all` — Destructive — https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/execute-socks-stop-all.md
- `execute_tokenStore_remove` — Destructive — https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/execute-tokenstore-remove.md
- `execute_tokenStore_removeAll` — Destructive — https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/execute-tokenstore-removeall.md
- `kill_beacon` — Destructive — https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/kill-beacon.md
- `reset_data` — Destructive — https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/reset-data.md
- `beacon_change_directory` — Execute — https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/beacon-change-directory.md
- `beacon_copy_file` — Execute — https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/beacon-copy-file.md
- `create_listener` — Execute — https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/create-listener.md
- `create_listener_dns` — Execute — https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/create-listener-dns.md
- `create_listener_externalC2` — Execute — https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/create-listener-externalc2.md
- `create_listener_foreignHttp` — Execute — https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/create-listener-foreignhttp.md
- `create_listener_foreignHttps` — Execute — https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/create-listener-foreignhttps.md
- `create_listener_http` — Execute — https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/create-listener-http.md
- `create_listener_https` — Execute — https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/create-listener-https.md
- `create_listener_smb` — Execute — https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/create-listener-smb.md
- `create_listener_tcp` — Execute — https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/create-listener-tcp.md
- …and 189 more: https://policylayer.com/tools/mickeydb-cobalt-strike-mcp.md

## For agents

This record is a snapshot. Live verdicts and the full registry:

- Check every server in your MCP config at once: `npx -y policylayer stack`
- Vet a server before you add it: install the mcp-precheck skill — `npx skills add https://policylayer.com` (skill text: https://policylayer.com/skill.md)
- Query the registry over MCP: endpoint `https://api.policylayer.com/mcp` — tools `check_mcp_server`, `check_mcp_stack`, `check_tool`, `search_registry`, `get_change_events`

---

Source: the PolicyLayer MCP registry — one continuously verified record per MCP server. Full record: https://policylayer.com/registry?q=mickeydb-cobalt-strike-mcp · API: https://policylayer.com/registry/api · Policy library: https://policylayer.com/policies/mickeydb-cobalt-strike-mcp