# mittwald_user_api_token_list List all API tokens of the user.. Shows all API tokens belonging to the current user. Agent View of the PolicyLayer registry record for `mittwald_user_api_token_list`. HTML page: https://policylayer.com/tools/mittwald-mcp-server/mittwald-user-api-token-list ## Facts - Tool: `mittwald_user_api_token_list` - Server: Mittwald MCP Server (`mittwald/mcp-server`) — https://policylayer.com/tools/mittwald-mcp-server.md - Homepage: https://github.com/mittwald/mcp-server - Risk category: Read (Low risk) - Registry record: grade F, identity unverified - Server rate-limited: no - Parameters: 0 - Recommended policy verdict: Allowed ## Example call (MCP tools/call, JSON-RPC 2.0) ```json { "jsonrpc": "2.0", "id": 1, "method": "tools/call", "params": { "name": "mittwald_user_api_token_list", "arguments": {} } } ``` ## Why mittwald_user_api_token_list is rated Low This tool queries and retrieves sensitive API tokens but does not modify, delete, or execute operations. However, the severity is elevated from 'low' to 'medium' because exposed API tokens are high-value targets for attackers; if an AI agent misuses this tool or an attacker gains access to it, the tokens could be exfiltrated and used to impersonate the user or access their Mittwald infrastructure. From the tool's own definition: "Tool description states 'List all API tokens of the user' and 'Shows all API tokens belonging to the current user' — this is a retrieval operation with no side effects." ## Use case AI agents call mittwald_user_api_token_list to retrieve information from Mittwald MCP Server without modifying anything. It is typically the context-gathering step in research, monitoring, and reporting workflows, before the agent takes action elsewhere. ## Recommended policy (PolicyLayer) Verdict: **Allowed**. Enforced by the PolicyLayer MCP gateway (https://policylayer.com/mcp-gateway) before a call reaches Mittwald MCP Server: ```json { "version": "1", "default": "deny", "tools": { "mittwald_user_api_token_list": {} } } ``` ## Other tools on Mittwald MCP Server (171) - `mittwald_app_uninstall` — Destructive — https://policylayer.com/tools/mittwald-mcp-server/mittwald-app-uninstall.md - `mittwald_backup_delete` — Destructive — https://policylayer.com/tools/mittwald-mcp-server/mittwald-backup-delete.md - `mittwald_backup_schedule_delete` — Destructive — https://policylayer.com/tools/mittwald-mcp-server/mittwald-backup-schedule-delete.md - `mittwald_container_delete` — Destructive — https://policylayer.com/tools/mittwald-mcp-server/mittwald-container-delete.md - `mittwald_context_reset_session` — Destructive — https://policylayer.com/tools/mittwald-mcp-server/mittwald-context-reset-session.md - `mittwald_cronjob_delete` — Destructive — https://policylayer.com/tools/mittwald-mcp-server/mittwald-cronjob-delete.md - `mittwald_database_mysql_delete` — Destructive — https://policylayer.com/tools/mittwald-mcp-server/mittwald-database-mysql-delete.md - `mittwald_database_mysql_user_delete` — Destructive — https://policylayer.com/tools/mittwald-mcp-server/mittwald-database-mysql-user-delete.md - `mittwald_domain_virtualhost_delete` — Destructive — https://policylayer.com/tools/mittwald-mcp-server/mittwald-domain-virtualhost-delete.md - `mittwald_extension_uninstall` — Destructive — https://policylayer.com/tools/mittwald-mcp-server/mittwald-extension-uninstall.md - `mittwald_mail_address_delete` — Destructive — https://policylayer.com/tools/mittwald-mcp-server/mittwald-mail-address-delete.md - `mittwald_mail_deliverybox_delete` — Destructive — https://policylayer.com/tools/mittwald-mcp-server/mittwald-mail-deliverybox-delete.md - `mittwald_org_delete` — Destructive — https://policylayer.com/tools/mittwald-mcp-server/mittwald-org-delete.md - `mittwald_org_membership_revoke` — Destructive — https://policylayer.com/tools/mittwald-mcp-server/mittwald-org-membership-revoke.md - `mittwald_project_delete` — Destructive — https://policylayer.com/tools/mittwald-mcp-server/mittwald-project-delete.md - `mittwald_registry_delete` — Destructive — https://policylayer.com/tools/mittwald-mcp-server/mittwald-registry-delete.md - `mittwald_sftp_user_delete` — Destructive — https://policylayer.com/tools/mittwald-mcp-server/mittwald-sftp-user-delete.md - `mittwald_ssh_user_delete` — Destructive — https://policylayer.com/tools/mittwald-mcp-server/mittwald-ssh-user-delete.md - `mittwald_stack_delete` — Destructive — https://policylayer.com/tools/mittwald-mcp-server/mittwald-stack-delete.md - `mittwald_user_api_token_revoke` — Destructive — https://policylayer.com/tools/mittwald-mcp-server/mittwald-user-api-token-revoke.md - `mittwald_user_ssh_key_delete` — Destructive — https://policylayer.com/tools/mittwald-mcp-server/mittwald-user-ssh-key-delete.md - `mittwald_volume_delete` — Destructive — https://policylayer.com/tools/mittwald-mcp-server/mittwald-volume-delete.md - `mittwald_app_install_wordpress` — Execute — https://policylayer.com/tools/mittwald-mcp-server/mittwald-app-install-wordpress.md - `mittwald_app_open` — Execute — https://policylayer.com/tools/mittwald-mcp-server/mittwald-app-open.md - `mittwald_app_ssh` — Execute — https://policylayer.com/tools/mittwald-mcp-server/mittwald-app-ssh.md - `mittwald_app_upgrade` — Execute — https://policylayer.com/tools/mittwald-mcp-server/mittwald-app-upgrade.md - `mittwald_container_recreate` — Execute — https://policylayer.com/tools/mittwald-mcp-server/mittwald-container-recreate.md - `mittwald_container_restart` — Execute — https://policylayer.com/tools/mittwald-mcp-server/mittwald-container-restart.md - `mittwald_container_run` — Execute — https://policylayer.com/tools/mittwald-mcp-server/mittwald-container-run.md - `mittwald_container_start` — Execute — https://policylayer.com/tools/mittwald-mcp-server/mittwald-container-start.md - …and 141 more: https://policylayer.com/tools/mittwald-mcp-server.md ## For agents This record is a snapshot. Live verdicts and the full registry: - Check every server in your MCP config at once: `npx -y policylayer stack` - Vet a server before you add it: install the mcp-precheck skill — `npx skills add https://policylayer.com` (skill text: https://policylayer.com/skill.md) - Query the registry over MCP: endpoint `https://api.policylayer.com/mcp` — tools `check_mcp_server`, `check_mcp_stack`, `check_tool`, `search_registry`, `get_change_events` --- Source: the PolicyLayer MCP registry — one continuously verified record per MCP server. Full record: https://policylayer.com/registry?q=mittwald-mcp-server · API: https://policylayer.com/registry/api · Policy library: https://policylayer.com/policies/mittwald-mcp-server