# contract-testing_admin_get_system_account_tokens

Retrieve API tokens for a system account (admin). Parameters: - accountId (string) *required*: UUID of the system account

Agent View of the PolicyLayer registry record for `contract-testing_admin_get_system_account_tokens`. HTML page: https://policylayer.com/tools/smartbear-mcp/contract-testing-admin-get-system-account-tokens

## Facts

- Tool: `contract-testing_admin_get_system_account_tokens`
- Server: SmartBear MCP (`SmartBear/smartbear-mcp`) — https://policylayer.com/tools/smartbear-mcp.md
- Homepage: https://github.com/SmartBear/smartbear-mcp
- Risk category: Read (Low risk)
- Registry record: grade F, identity unverified
- Server rate-limited: no
- Parameters: 1 (1 required)
- Recommended policy verdict: Allowed

## Parameters

| Parameter | Type | Required | Description |
| --- | --- | --- | --- |
| `accountId` | string | yes | UUID of the system account |

Parameters from the server's own tool schema.

## Example call (MCP tools/call, JSON-RPC 2.0)

```json
{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "contract-testing_admin_get_system_account_tokens",
    "arguments": {
      "accountId": "<accountId>"
    }
  }
}
```

## Why contract-testing_admin_get_system_account_tokens is rated Low

This is a Read operation—it retrieves data (API tokens) without side effects. However, severity is elevated to 'high' because the retrieved data are sensitive credentials (API tokens) that could enable unauthorized access to systems if leaked. An AI agent misusing this tool could expose authentication material, creating significant security risk despite the read-only nature of the operation.

From the tool's own definition: "Tool name includes 'get' and description states 'Retrieve API tokens for a system account'. The action is retrieval with no modification or deletion."

Risk signals: Admin/system-level operation

## Use case

AI agents call contract-testing_admin_get_system_account_tokens to retrieve information from SmartBear MCP without modifying anything. It is typically the context-gathering step in research, monitoring, and reporting workflows, before the agent takes action elsewhere.

## Recommended policy (PolicyLayer)

Verdict: **Allowed**. Enforced by the PolicyLayer MCP gateway (https://policylayer.com/mcp-gateway) before a call reaches SmartBear MCP:

```json
{
  "version": "1",
  "default": "deny",
  "tools": {
    "contract-testing_admin_get_system_account_tokens": {}
  }
}
```

## Other tools on SmartBear MCP (239)

- `collaborator_delete_collaborator_remote_system_configuration` — Destructive — https://policylayer.com/tools/smartbear-mcp/collaborator-delete-collaborator-remote-system-configuration.md
- `contract-testing_admin_delete_role` — Destructive — https://policylayer.com/tools/smartbear-mcp/contract-testing-admin-delete-role.md
- `contract-testing_admin_delete_team` — Destructive — https://policylayer.com/tools/smartbear-mcp/contract-testing-admin-delete-team.md
- `contract-testing_admin_delete_user` — Destructive — https://policylayer.com/tools/smartbear-mcp/contract-testing-admin-delete-user.md
- `contract-testing_admin_remove_role_from_user` — Destructive — https://policylayer.com/tools/smartbear-mcp/contract-testing-admin-remove-role-from-user.md
- `contract-testing_admin_remove_user_from_team` — Destructive — https://policylayer.com/tools/smartbear-mcp/contract-testing-admin-remove-user-from-team.md
- `contract-testing_admin_reset_roles` — Destructive — https://policylayer.com/tools/smartbear-mcp/contract-testing-admin-reset-roles.md
- `contract-testing_delete_all_integrations` — Destructive — https://policylayer.com/tools/smartbear-mcp/contract-testing-delete-all-integrations.md
- `contract-testing_delete_branch` — Destructive — https://policylayer.com/tools/smartbear-mcp/contract-testing-delete-branch.md
- `contract-testing_delete_environment` — Destructive — https://policylayer.com/tools/smartbear-mcp/contract-testing-delete-environment.md
- `contract-testing_delete_integration` — Destructive — https://policylayer.com/tools/smartbear-mcp/contract-testing-delete-integration.md
- `contract-testing_delete_pacticipant` — Destructive — https://policylayer.com/tools/smartbear-mcp/contract-testing-delete-pacticipant.md
- `contract-testing_delete_secret` — Destructive — https://policylayer.com/tools/smartbear-mcp/contract-testing-delete-secret.md
- `contract-testing_delete_webhook` — Destructive — https://policylayer.com/tools/smartbear-mcp/contract-testing-delete-webhook.md
- `contract-testing_regenerate_api_token` — Destructive — https://policylayer.com/tools/smartbear-mcp/contract-testing-regenerate-api-token.md
- `contract-testing_remove_label_from_pacticipant` — Destructive — https://policylayer.com/tools/smartbear-mcp/contract-testing-remove-label-from-pacticipant.md
- `reflect_cancel_suite_execution` — Destructive — https://policylayer.com/tools/smartbear-mcp/reflect-cancel-suite-execution.md
- `reflect_delete_previous_step` — Destructive — https://policylayer.com/tools/smartbear-mcp/reflect-delete-previous-step.md
- `swagger_delete_portal_product` — Destructive — https://policylayer.com/tools/smartbear-mcp/swagger-delete-portal-product.md
- `swagger_delete_table_of_contents` — Destructive — https://policylayer.com/tools/smartbear-mcp/swagger-delete-table-of-contents.md
- `collaborator_reviewservice_action` — Execute — https://policylayer.com/tools/smartbear-mcp/collaborator-reviewservice-action.md
- `collaborator_test_collaborator_remote_system_configuration_connection` — Execute — https://policylayer.com/tools/smartbear-mcp/collaborator-test-collaborator-remote-system-configuration-connection.md
- `contract-testing_execute_webhook` — Execute — https://policylayer.com/tools/smartbear-mcp/contract-testing-execute-webhook.md
- `contract-testing_generate_pact_tests` — Execute — https://policylayer.com/tools/smartbear-mcp/contract-testing-generate-pact-tests.md
- `contract-testing_review_pact_tests` — Execute — https://policylayer.com/tools/smartbear-mcp/contract-testing-review-pact-tests.md
- `contract-testing_test_execute_webhooks` — Execute — https://policylayer.com/tools/smartbear-mcp/contract-testing-test-execute-webhooks.md
- `reflect_add_prompt_step` — Execute — https://policylayer.com/tools/smartbear-mcp/reflect-add-prompt-step.md
- `reflect_connect_to_session` — Execute — https://policylayer.com/tools/smartbear-mcp/reflect-connect-to-session.md
- `reflect_execute_suite` — Execute — https://policylayer.com/tools/smartbear-mcp/reflect-execute-suite.md
- `reflect_run_test` — Execute — https://policylayer.com/tools/smartbear-mcp/reflect-run-test.md
- …and 209 more: https://policylayer.com/tools/smartbear-mcp.md

## For agents

This record is a snapshot. Live verdicts and the full registry:

- Check every server in your MCP config at once: `npx -y policylayer stack`
- Vet a server before you add it: install the mcp-precheck skill — `npx skills add https://policylayer.com` (skill text: https://policylayer.com/skill.md)
- Query the registry over MCP: endpoint `https://api.policylayer.com/mcp` — tools `check_mcp_server`, `check_mcp_stack`, `check_tool`, `search_registry`, `get_change_events`

---

Source: the PolicyLayer MCP registry — one continuously verified record per MCP server. Full record: https://policylayer.com/registry?q=smartbear-mcp · API: https://policylayer.com/registry/api · Policy library: https://policylayer.com/policies/smartbear-mcp