todo_list

What todo_list does on Ruflo

AI agents call todo_list to retrieve information from Ruflo without modifying anything. It is typically the context-gathering step in research, monitoring, and reporting workflows, before the agent takes action elsewhere.

Why todo_list is rated Low

The tool performs a simple data retrieval function (listing pending tasks) without any capability to modify, delete, execute code, or commit financial transactions. The blast radius of misuse is minimal—an AI agent could only view task information, not alter system state or trigger unintended operations. This is a straightforward Read category tool with low severity.

From the tool's definition Tool name 'todo_list' and description 'List all pending tasks' indicate a retrieval operation with no side effects. This is a query/list operation that reads data without modifying, deleting, or executing external actions.

The rule that runs todo_list safely

PolicyLayer is an MCP gateway: it sits between your AI agents and Ruflo, and checks every tool call against a rule you set before the call runs. Nothing changes on the server itself. For todo_list, this is the rule to start with:

{
  "version": "1",
  "default": "deny",
  "tools": {
    "todo_list": {}
  }
}

Questions about todo_list