custom_get_user_by_id

What custom_get_user_by_id does on Marketo MCP Server

AI agents call custom_get_user_by_id to retrieve information from Marketo MCP Server without modifying anything. It is typically the context-gathering step in research, monitoring, and reporting workflows, before the agent takes action elsewhere.

Why custom_get_user_by_id is rated Low

The 'get' verb and '_by_id' suffix indicate this retrieves/queries user information without modifying or deleting data. This is a Read operation. However, severity is medium rather than low because: (1) it accesses user/contact data which is sensitive in a marketing automation platform, and (2) the custom implementation bypassing Adobe's native MCP could pose integration or security risks if not properly validated.

From the tool's definition Tool name contains 'get_user_by_id' indicating retrieval of user data. Description states it 'Calls the Marketo REST API directly', which is a query/fetch operation without stated side effects.

The rule that runs custom_get_user_by_id safely

PolicyLayer is an MCP gateway: it sits between your AI agents and Marketo MCP Server, and checks every tool call against a rule you set before the call runs. Nothing changes on the server itself. For custom_get_user_by_id, this is the rule to start with:

{
  "version": "1",
  "default": "deny",
  "tools": {
    "custom_get_user_by_id": {}
  }
}

Questions about custom_get_user_by_id