get_command_history

What get_command_history does on Pengstrike

AI agents call get_command_history to retrieve information from Pengstrike without modifying anything. It is typically the context-gathering step in research, monitoring, and reporting workflows, before the agent takes action elsewhere.

Why get_command_history is rated Low

Command history retrieval is fundamentally a read operation—it queries forensic data on a workstation for analysis. However, severity is elevated to 'medium' rather than 'low' because command history can expose sensitive information (credentials, API keys, internal infrastructure details, attack patterns) that an agent could misuse or exfiltrate.

From the tool's definition Tool name 'get_command_history' indicates retrieval of historical command execution data. The description is empty, limiting specificity, but the name strongly suggests querying existing logs rather than executing new commands or modifying data.

The rule that runs get_command_history safely

PolicyLayer is an MCP gateway: it sits between your AI agents and Pengstrike, and checks every tool call against a rule you set before the call runs. Nothing changes on the server itself. For get_command_history, this is the rule to start with:

{
  "version": "1",
  "default": "deny",
  "tools": {
    "get_command_history": {}
  }
}

Questions about get_command_history