get_task

What get_task does on Cobalt Strike MCP Server

AI agents call get_task to retrieve information from Cobalt Strike MCP Server without modifying anything. It is typically the context-gathering step in research, monitoring, and reporting workflows, before the agent takes action elsewhere.

Why get_task is rated Low

This tool retrieves task details by ID without modifying, deleting, or executing operations. However, the severity is elevated to 'high' because the server context (Cobalt Strike red team operations) indicates this tool provides access to sensitive operational data about beacon activities, command execution results, and attack orchestration—information that could be extremely valuable to an adversary if misused by a…

From the tool's definition Tool name and description indicate retrieval: 'Get detailed information about a specific task by ID'. The verb 'get' and 'information' clearly denote a read operation with no modification.

The rule that runs get_task safely

PolicyLayer is an MCP gateway: it sits between your AI agents and Cobalt Strike MCP Server, and checks every tool call against a rule you set before the call runs. Nothing changes on the server itself. For get_task, this is the rule to start with:

{
  "version": "1",
  "default": "deny",
  "tools": {
    "get_task": {}
  }
}

Questions about get_task