get_task_log

What get_task_log does on Cobalt Strike MCP Server

AI agents call get_task_log to retrieve information from Cobalt Strike MCP Server without modifying anything. It is typically the context-gathering step in research, monitoring, and reporting workflows, before the agent takes action elsewhere.

Why get_task_log is rated Low

The tool itself performs a read operation (retrieval of logs). However, the context is critical: Cobalt Strike is an adversarial tool used for unauthorized red team operations, post-exploitation, and command & control. Accessing task logs in this context could reveal sensitive operational details, exfiltrated data, or attack execution timelines.

From the tool's definition Tool name 'get_task_log' and description 'Get log information for a specific task' indicate retrieval of log data without modification. However, this is part of Cobalt Strike MCP Server which enables red team operations and beacon control—a threat actor tool.

The rule that runs get_task_log safely

PolicyLayer is an MCP gateway: it sits between your AI agents and Cobalt Strike MCP Server, and checks every tool call against a rule you set before the call runs. Nothing changes on the server itself. For get_task_log, this is the rule to start with:

{
  "version": "1",
  "default": "deny",
  "tools": {
    "get_task_log": {}
  }
}

Questions about get_task_log