get_project_info

What get_project_info does on Sbox

AI agents call get_project_info to retrieve information from Sbox without modifying anything. It is typically the context-gathering step in research, monitoring, and reporting workflows, before the agent takes action elsewhere.

Why get_project_info is rated Low

This tool only queries and returns project metadata. It performs no write operations, executions, destructive actions, or financial transactions. The blast radius of misuse is minimal—an AI agent could only learn about the project structure, which poses no security risk beyond information disclosure of what is already part of the project context.

From the tool's definition Tool description states it retrieves information about the current s&box project (path, name, game type, dependencies, and configuration). The verb 'get' and 'information about' indicate data retrieval with no modification or side effects.

The rule that runs get_project_info safely

PolicyLayer is an MCP gateway: it sits between your AI agents and Sbox, and checks every tool call against a rule you set before the call runs. Nothing changes on the server itself. For get_project_info, this is the rule to start with:

{
  "version": "1",
  "default": "deny",
  "tools": {
    "get_project_info": {}
  }
}

Questions about get_project_info