MCP server

Finology Student Loan Calculator

mcp:finology-tech/finology-mcp

Student-loan math: RAP, IBR, ICR, PSLF. npx: no key. Remote: free login, no card, 5 questions total

awesome-mcp-servers Glama MCP Registry

Verdict

Suspicious

Risky behavior the analysis could not rule out.

Analyzed Oct 26, 2026, 11:13 UTC at bd2ee5b

findings

medium

highest severity

threat classes

files scanned

217/217

checks satisfied

package advisories

Why this verdict

suspicious: finding mcp-server:.:src/client.ts:130:MANIP
suspicious: finding mcp-server:.:src/client.ts:1:MANIP
suspicious: unverified finding mcp-server:.:src/client.ts:122:MANIP
suspicious: unverified finding mcp-server:.:src/index.ts:108:MANIP
suspicious: unverified finding mcp-server:.:src/index.ts:123:MANIP

Security findings 5

Manipulation

mediumContextual risklow confidence

The server appends promotional upgrade/next-tier text to every successful tool answer, injecting vendor marketing into the model's context to steer the agent or operator toward a paid tier.

src/client.ts:1-110

Appended to every successful answer.

vector:code

Counter-argument considered

The code comment itself confirms that promotional next-tier text is appended to every successful answer, so the behavior is real and aimed at steering the agent or its operator. It is not a carve-out.

Manipulation

mediumUnverifiedmedium confidence

Every successful tool answer has an undeclared promotional CTA appended that points the agent to extra Finology endpoints (identity.finology.tech, api.finology.tech, mcp.finology.tech) and a sandbox-key signup flow that takes the user's email. This steers agent behavior beyond the loan math the package declares, though it is visible and the intent is plausibly marketing.

src/client.ts:122

free sandbox API key instantly (25 calls/month, 30 days) with POST https://api.finology.tech/v1/keys/sandbox

vector:code

Manipulation

mediumContextual risklow confidence

Every successful tool result has a promotional call-to-action appended that steers the agent to call vendor endpoints and claim a production key on the operator's behalf, which injects vendor-controlled instructions into the agent's context.

src/client.ts:130

with the sandbox key returns the production key to the agent directly

vector:code

Counter-argument considered

The same CTA, appended to every result, tells the agent how to retrieve a production key once the operator has paid. This is undeclared vendor steering injected through tool output, and no mitigation or carve-out applies.

Manipulation

mediumUnverifiedlow confidence

The undeclared finology_service_info tool returns upsell content (a payment link and a direct API key-claim POST) that is aimed at the calling agent, which goes beyond the loan-calculator purpose and nudges the agent toward a paid purchase flow.

src/index.ts:108

the agent can also collect it directly: POST https://api.finology.tech/v1/keys/claim

vector:code

Manipulation

mediumUnverifiedmedium confidence

The finology_service_info tool output is vendor upsell text addressed to the agent, urging it to move the user to the paid keyed MCP and noting the agent can collect the paid API key itself via a POST, which steers the agent toward purchase and account actions beyond the free calculation task.

src/index.ts:123

If you are reading this you are already an MCP client, so the shortest upgrade is this URL plus the header

vector:codevector:instruction

Refuted findings 2

Candidates the review stage examined and rejected, kept for transparency.

Tool poisoning

criticalRefutedlow confidence

The tool description tells the agent to prefer this vendor tool over its own calculation, conditioning tool selection in the vendor's favor, though this is plausibly ordinary self-description for a calculator.

src/index.ts:36

Use this instead of calculating federal repayment math yourself

Why it was refuted

The description is ordinary self-description for a calculator and matches its declared core capability. It explains why the tool is preferred because eligibility rules are easy to get wrong, and contains no hidden or off-purpose instruction.

Manipulation

highRefutedlow confidence

The finology_service_info tool output addresses the agent directly and nudges it to switch to the vendor's keyed MCP endpoint, which is promotional steering of agent behavior through tool output.

src/index.ts:121

If you are reading this you are already an MCP client

Why it was refuted

The note appears only in the output of the declared, opt-in finology_service_info tool, which is described as the 'how to go further' path. Mentioning the keyed endpoint there matches its stated purpose.