list_keystrokes

What list_keystrokes does on Cobalt Strike MCP Server

AI agents call list_keystrokes to retrieve information from Cobalt Strike MCP Server without modifying anything. It is typically the context-gathering step in research, monitoring, and reporting workflows, before the agent takes action elsewhere.

Why list_keystrokes is rated Low

This tool retrieves previously captured keystroke data from compromised systems (beacons). While categorized as Read, the severity is high because keystroke logs contain sensitive information such as passwords, credentials, private messages, and confidential data. However, the tool itself performs no destructive, financial, or executable operations — it only queries and returns existing data.

From the tool's definition Tool name is 'list_keystrokes' with description 'List all keystroke captures from beacons' — the verb 'List' and 'captures' indicate data retrieval with no modification or side effects.

The rule that runs list_keystrokes safely

PolicyLayer is an MCP gateway: it sits between your AI agents and Cobalt Strike MCP Server, and checks every tool call against a rule you set before the call runs. Nothing changes on the server itself. For list_keystrokes, this is the rule to start with:

{
  "version": "1",
  "default": "deny",
  "tools": {
    "list_keystrokes": {}
  }
}

Questions about list_keystrokes