get_detected_flags

What get_detected_flags does on Kali Security MCP

AI agents call get_detected_flags to retrieve information from Kali Security MCP without modifying anything. It is typically the context-gathering step in research, monitoring, and reporting workflows, before the agent takes action elsewhere.

Why get_detected_flags is rated Low

This tool retrieves flag data that has already been detected, consistent with Read category operations (search, list, get, fetch). There are no side effects, data modifications, code execution, deletions, or financial transactions. In a CTF/penetration testing context, flags are typically read-only artifacts to be discovered and reported.

From the tool's definition Tool name 'get_detected_flags' and description '获取所有检测到的Flag' (get all detected flags) indicate a retrieval/query operation. The verb 'get' and the passive 'detected' suggest reading already-identified flags without modifying state.

The rule that runs get_detected_flags safely

PolicyLayer is an MCP gateway: it sits between your AI agents and Kali Security MCP, and checks every tool call against a rule you set before the call runs. Nothing changes on the server itself. For get_detected_flags, this is the rule to start with:

{
  "version": "1",
  "default": "deny",
  "tools": {
    "get_detected_flags": {}
  }
}

Questions about get_detected_flags