stateset_list_users

What stateset_list_users does on Stateset

AI agents call stateset_list_users to retrieve information from Stateset without modifying anything. It is typically the context-gathering step in research, monitoring, and reporting workflows, before the agent takes action elsewhere.

Why stateset_list_users is rated Low

This tool retrieves user data (names, roles, permissions) without modifying or deleting information. It falls squarely into the Read category. Severity is medium rather than low because user lists reveal organizational structure and access control information that could inform privilege escalation attacks if exposed to an untrusted agent.

From the tool's definition Tool description states 'Lists all users' and 'Returns user details including roles and permissions', which is a retrieval operation. The verb 'Lists' and action 'Returns' confirm data query functionality with no modification.

Risk signalsBulk/mass operation — affects multiple targets

The rule that runs stateset_list_users safely

PolicyLayer is an MCP gateway: it sits between your AI agents and Stateset, and checks every tool call against a rule you set before the call runs. Nothing changes on the server itself. For stateset_list_users, this is the rule to start with:

{
  "version": "1",
  "default": "deny",
  "tools": {
    "stateset_list_users": {}
  }
}

Questions about stateset_list_users