Announcing Beacon: Self-improving memory for coding agents
BeaconIntel
2.9K
← All MCP servers
MCP server

io.github.x7even/cloudcostsmcp

mcp:x7even/cloudcostsmcp

Anchor AI FinOps to real, live cloud pricing — AWS, GCP & Azure public and enterprise rates.

awesome-mcp-serversGlamaMCP Registry
Verdict
Inconclusive

The analysis could not cover enough of the artifact to decide.

Analyzed Oct 26, 2026, 13:53 UTC at 4b54d25

Dispute security verdict

If you believe this verdict is incorrect, submit a dispute and we'll review it.

0
findings
—
highest severity
0
threat classes
240
files scanned
2,723/2,723
checks satisfied
0
package advisories

Why this verdict

mcp-server . Inconclusive
  • inconclusive: gap no_dataflow_for_ruby at Formula/opencloudcosts.rb
mcp-server opencloudcosts-go Inconclusive
  • inconclusive: gap no_dataflow_for_go at opencloudcosts-go/cmd/opencloudcosts/main.go
  • inconclusive: gap no_dataflow_for_go at opencloudcosts-go/internal/cache/cache.go
  • inconclusive: gap no_dataflow_for_go at opencloudcosts-go/internal/config/config.go
  • inconclusive: gap no_dataflow_for_go at opencloudcosts-go/internal/models/models.go
  • inconclusive: gap no_dataflow_for_go at opencloudcosts-go/internal/providers/aws/aws.go
  • inconclusive: gap no_dataflow_for_go at opencloudcosts-go/internal/providers/aws/aws_bulk.go
  • inconclusive: gap no_dataflow_for_go at opencloudcosts-go/internal/providers/aws/aws_container.go
  • inconclusive: gap no_dataflow_for_go at opencloudcosts-go/internal/providers/aws/aws_finops.go
  • inconclusive: gap no_dataflow_for_go at opencloudcosts-go/internal/providers/aws/aws_network.go
  • inconclusive: gap no_dataflow_for_go at opencloudcosts-go/internal/providers/aws/aws_pricing.go
  • inconclusive: gap no_dataflow_for_go at opencloudcosts-go/internal/providers/aws/aws_savingsplans.go
  • inconclusive: gap no_dataflow_for_go at opencloudcosts-go/internal/providers/aws/aws_sku_lookup.go
  • inconclusive: gap no_dataflow_for_go at opencloudcosts-go/internal/providers/aws/testhooks.go
  • inconclusive: gap no_dataflow_for_go at opencloudcosts-go/internal/providers/azure/azure.go
  • inconclusive: gap no_dataflow_for_go at opencloudcosts-go/internal/providers/azure/azure_sku_lookup.go
  • inconclusive: gap no_dataflow_for_go at opencloudcosts-go/internal/providers/base.go
  • inconclusive: gap no_dataflow_for_go at opencloudcosts-go/internal/providers/gcp/auth.go
  • inconclusive: gap no_dataflow_for_go at opencloudcosts-go/internal/providers/gcp/gcp.go
  • inconclusive: gap no_dataflow_for_go at opencloudcosts-go/internal/providers/gcp/gcp_ai.go
  • inconclusive: gap no_dataflow_for_go at opencloudcosts-go/internal/providers/gcp/gcp_analytics.go
  • inconclusive: gap no_dataflow_for_go at opencloudcosts-go/internal/providers/gcp/gcp_catalog.go
  • inconclusive: gap no_dataflow_for_go at opencloudcosts-go/internal/providers/gcp/gcp_compute.go
  • inconclusive: gap no_dataflow_for_go at opencloudcosts-go/internal/providers/gcp/gcp_database.go
  • inconclusive: gap no_dataflow_for_go at opencloudcosts-go/internal/providers/gcp/gcp_dns.go
  • inconclusive: gap no_dataflow_for_go at opencloudcosts-go/internal/providers/gcp/gcp_firestore.go
  • inconclusive: gap no_dataflow_for_go at opencloudcosts-go/internal/providers/gcp/gcp_kms.go
  • inconclusive: gap no_dataflow_for_go at opencloudcosts-go/internal/providers/gcp/gcp_networking.go
  • inconclusive: gap no_dataflow_for_go at opencloudcosts-go/internal/providers/gcp/gcp_pubsub.go
  • inconclusive: gap no_dataflow_for_go at opencloudcosts-go/internal/providers/gcp/gcp_sku_lookup.go
  • inconclusive: gap no_dataflow_for_go at opencloudcosts-go/internal/providers/gcp/testhooks.go
  • inconclusive: gap no_dataflow_for_go at opencloudcosts-go/internal/server/server.go
  • inconclusive: gap no_dataflow_for_go at opencloudcosts-go/internal/skulookup/skulookup.go
  • inconclusive: gap no_dataflow_for_go at opencloudcosts-go/internal/tools/availability.go
  • inconclusive: gap no_dataflow_for_go at opencloudcosts-go/internal/tools/bom.go
  • inconclusive: gap no_dataflow_for_go at opencloudcosts-go/internal/tools/cachetool.go
  • inconclusive: gap no_dataflow_for_go at opencloudcosts-go/internal/tools/compare_bom.go
  • inconclusive: gap no_dataflow_for_go at opencloudcosts-go/internal/tools/compare_bom_regions.go
  • inconclusive: gap no_dataflow_for_go at opencloudcosts-go/internal/tools/coverage.go
  • inconclusive: gap no_dataflow_for_go at opencloudcosts-go/internal/tools/lookup.go
  • inconclusive: gap no_dataflow_for_go at opencloudcosts-go/internal/tools/search_pricing.go
  • inconclusive: gap no_dataflow_for_go at opencloudcosts-go/internal/tools/sku_lookup.go
  • inconclusive: gap no_dataflow_for_go at opencloudcosts-go/internal/tools/spot_history.go
  • inconclusive: gap no_dataflow_for_go at opencloudcosts-go/internal/tools/warmcache.go
  • inconclusive: gap no_dataflow_for_go at opencloudcosts-go/internal/utils/baseline.go
  • inconclusive: gap no_dataflow_for_go at opencloudcosts-go/internal/utils/egress_tiers.go
  • inconclusive: gap no_dataflow_for_go at opencloudcosts-go/internal/utils/gcp_specs.go
  • inconclusive: gap no_dataflow_for_go at opencloudcosts-go/internal/utils/http_retry.go
  • inconclusive: gap no_dataflow_for_go at opencloudcosts-go/internal/utils/money.go
  • inconclusive: gap no_dataflow_for_go at opencloudcosts-go/internal/utils/regions.go
  • inconclusive: gap no_dataflow_for_go at opencloudcosts-go/internal/utils/spec_infer.go
  • inconclusive: gap no_dataflow_for_go at opencloudcosts-go/internal/utils/units.go

Security findings 0

No individual findings recorded

The inconclusive verdict rests on the coverage gaps below; 2 candidate findings were refuted on review.
Refuted findings 2

Candidates the review stage examined and rejected, kept for transparency.

Tool poisoning

criticalRefutedlow confidence

The estimate_bom tool response embeds a mandatory directive telling the agent to call get_price for each not_included item using a provider-supplied how_to_price command, so tool output steers other tool calls. This is plausibly honest for pricing accuracy, and the provider advisory content is not shown here.

src/opencloudcosts/tools/bom.py:177
REQUIRED: for each item in not_included, call get_price using the
Why it was refuted

The directive only tells the agent to call get_price, a declared, read-only pricing tool on this same server, so costs are not guessed. It is ordinary workflow guidance with no exfiltration, credential access, or hijack, and it matches the tool description, so it is not concealed.

Tool poisoning

highRefutedlow confidence

The estimate_bom tool description imperatively instructs the agent to call get_price for every not_included item before answering, and to prefer this tool over get_price, conditioning how other tools are used.

src/opencloudcosts/tools/bom.py:39
MUST call get_price for each listed item
Why it was refuted

The tool description openly states a pricing workflow, namely to use estimate_bom for multi-resource questions and to call get_price for hidden-cost items. This is documented, benign guidance within the declared core capability, and it steers only to a declared read-only tool. It does not conceal anything or cause harm.

Coverage gaps 52

Parts of the artifact the static analysis could not fully examine.

no_dataflow_for_ruby ruby file: string-literal extraction only
Formula/opencloudcosts.rb
no_dataflow_for_go go file: string-literal extraction only
opencloudcosts-go/cmd/opencloudcosts/main.go
no_dataflow_for_go go file: string-literal extraction only
opencloudcosts-go/internal/cache/cache.go
no_dataflow_for_go go file: string-literal extraction only
opencloudcosts-go/internal/config/config.go
no_dataflow_for_go go file: string-literal extraction only
opencloudcosts-go/internal/models/models.go
no_dataflow_for_go go file: string-literal extraction only
opencloudcosts-go/internal/providers/aws/aws.go
no_dataflow_for_go go file: string-literal extraction only
opencloudcosts-go/internal/providers/aws/aws_bulk.go
no_dataflow_for_go go file: string-literal extraction only
opencloudcosts-go/internal/providers/aws/aws_container.go
no_dataflow_for_go go file: string-literal extraction only
opencloudcosts-go/internal/providers/aws/aws_finops.go
no_dataflow_for_go go file: string-literal extraction only
opencloudcosts-go/internal/providers/aws/aws_network.go
no_dataflow_for_go go file: string-literal extraction only
opencloudcosts-go/internal/providers/aws/aws_pricing.go
no_dataflow_for_go go file: string-literal extraction only
opencloudcosts-go/internal/providers/aws/aws_savingsplans.go
no_dataflow_for_go go file: string-literal extraction only
opencloudcosts-go/internal/providers/aws/aws_sku_lookup.go
no_dataflow_for_go go file: string-literal extraction only
opencloudcosts-go/internal/providers/aws/testhooks.go
no_dataflow_for_go go file: string-literal extraction only
opencloudcosts-go/internal/providers/azure/azure.go
no_dataflow_for_go go file: string-literal extraction only
opencloudcosts-go/internal/providers/azure/azure_sku_lookup.go
no_dataflow_for_go go file: string-literal extraction only
opencloudcosts-go/internal/providers/base.go
no_dataflow_for_go go file: string-literal extraction only
opencloudcosts-go/internal/providers/gcp/auth.go
no_dataflow_for_go go file: string-literal extraction only
opencloudcosts-go/internal/providers/gcp/gcp.go
no_dataflow_for_go go file: string-literal extraction only
opencloudcosts-go/internal/providers/gcp/gcp_ai.go
no_dataflow_for_go go file: string-literal extraction only
opencloudcosts-go/internal/providers/gcp/gcp_analytics.go
no_dataflow_for_go go file: string-literal extraction only
opencloudcosts-go/internal/providers/gcp/gcp_catalog.go
no_dataflow_for_go go file: string-literal extraction only
opencloudcosts-go/internal/providers/gcp/gcp_compute.go
no_dataflow_for_go go file: string-literal extraction only
opencloudcosts-go/internal/providers/gcp/gcp_database.go
no_dataflow_for_go go file: string-literal extraction only
opencloudcosts-go/internal/providers/gcp/gcp_dns.go
no_dataflow_for_go go file: string-literal extraction only
opencloudcosts-go/internal/providers/gcp/gcp_firestore.go
no_dataflow_for_go go file: string-literal extraction only
opencloudcosts-go/internal/providers/gcp/gcp_kms.go
no_dataflow_for_go go file: string-literal extraction only
opencloudcosts-go/internal/providers/gcp/gcp_networking.go
no_dataflow_for_go go file: string-literal extraction only
opencloudcosts-go/internal/providers/gcp/gcp_pubsub.go
no_dataflow_for_go go file: string-literal extraction only
opencloudcosts-go/internal/providers/gcp/gcp_sku_lookup.go
no_dataflow_for_go go file: string-literal extraction only
opencloudcosts-go/internal/providers/gcp/testhooks.go
no_dataflow_for_go go file: string-literal extraction only
opencloudcosts-go/internal/server/server.go
no_dataflow_for_go go file: string-literal extraction only
opencloudcosts-go/internal/skulookup/skulookup.go
no_dataflow_for_go go file: string-literal extraction only
opencloudcosts-go/internal/tools/availability.go
no_dataflow_for_go go file: string-literal extraction only
opencloudcosts-go/internal/tools/bom.go
no_dataflow_for_go go file: string-literal extraction only
opencloudcosts-go/internal/tools/cachetool.go
no_dataflow_for_go go file: string-literal extraction only
opencloudcosts-go/internal/tools/compare_bom.go
no_dataflow_for_go go file: string-literal extraction only
opencloudcosts-go/internal/tools/compare_bom_regions.go
no_dataflow_for_go go file: string-literal extraction only
opencloudcosts-go/internal/tools/coverage.go
no_dataflow_for_go go file: string-literal extraction only
opencloudcosts-go/internal/tools/lookup.go
no_dataflow_for_go go file: string-literal extraction only
opencloudcosts-go/internal/tools/search_pricing.go
no_dataflow_for_go go file: string-literal extraction only
opencloudcosts-go/internal/tools/sku_lookup.go
no_dataflow_for_go go file: string-literal extraction only
opencloudcosts-go/internal/tools/spot_history.go
no_dataflow_for_go go file: string-literal extraction only
opencloudcosts-go/internal/tools/warmcache.go
no_dataflow_for_go go file: string-literal extraction only
opencloudcosts-go/internal/utils/baseline.go
no_dataflow_for_go go file: string-literal extraction only
opencloudcosts-go/internal/utils/egress_tiers.go
no_dataflow_for_go go file: string-literal extraction only
opencloudcosts-go/internal/utils/gcp_specs.go
no_dataflow_for_go go file: string-literal extraction only
opencloudcosts-go/internal/utils/http_retry.go
no_dataflow_for_go go file: string-literal extraction only
opencloudcosts-go/internal/utils/money.go
no_dataflow_for_go go file: string-literal extraction only
opencloudcosts-go/internal/utils/regions.go
no_dataflow_for_go go file: string-literal extraction only
opencloudcosts-go/internal/utils/spec_infer.go
no_dataflow_for_go go file: string-literal extraction only
opencloudcosts-go/internal/utils/units.go