claude_code_list_api_keys

What claude_code_list_api_keys does on Sage MCP

AI agents call claude_code_list_api_keys to retrieve information from Sage MCP without modifying anything. It is typically the context-gathering step in research, monitoring, and reporting workflows, before the agent takes action elsewhere.

Why claude_code_list_api_keys is rated Low

This tool retrieves sensitive API keys without modifying them, placing it in the Read category. However, severity is elevated to high because API keys are high-value secrets whose exposure could grant an attacker broad access to the organization's systems and integrations. An AI agent with access to this tool could exfiltrate credentials if exploited or tricked into listing and transmitting keys.

From the tool's definition Tool name contains 'list' and description states 'List API keys for the organization' — a retrieval operation with no modification.

The rule that runs claude_code_list_api_keys safely

PolicyLayer is an MCP gateway: it sits between your AI agents and Sage MCP, and checks every tool call against a rule you set before the call runs. Nothing changes on the server itself. For claude_code_list_api_keys, this is the rule to start with:

{
  "version": "1",
  "default": "deny",
  "tools": {
    "claude_code_list_api_keys": {}
  }
}

Questions about claude_code_list_api_keys