FinOps MCP Server Lets AI Query Cloud Bills Safely With Read-Only Access

·1 views

A Model Context Protocol (MCP) server designed for FinOps enables AI assistants like Claude and Cursor to query real cloud cost data instead of generating inaccurate, model-hallucinated figures. The architecture enforces a strict read-only contract, meaning the assistant can retrieve cost breakdowns, idle resource findings, and spending trends but cannot modify any infrastructure. Write operations are blocked at the protocol layer itself — not through prompt instructions or token restrictions — making the restriction structural rather than trust-based. Every tool call is logged with caller identity and arguments, ensuring full auditability of what the assistant accessed. Developers are cautioned against adding even a single write tool, as doing so opens the door to prompt-injection attacks that could trigger unintended mutations across production systems.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Why MCP Protocol Cannot Enforce Business Logic or Authorization Decisions

The Model Context Protocol (MCP) provides a standardized way for AI agents to discover and invoke tools across systems, solving a real interoperability problem in connecting applications to APIs and databases. However, MCP's design does not address whether a requested business action is actually authorized under organizational policy — only whether the technical connection and input schema are valid. In a practical example, an agent executing an employee offboarding request may successfully call the correct tool with valid arguments, yet still act prematurely if it cannot verify who holds authority over the termination time. Production workflows typically involve multiple distinct identities — requester, actor, subject, and approver — and collapsing these roles leads to misleading audit trails regardless of whether OAuth tokens are used correctly. Business rules, policy enforcement, and multi-party authorization must therefore be layered on top of MCP by the surrounding system, not assumed to be handled by the protocol itself.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How Hibernate's L1 Cache Can Make Failing Spring Data Tests Appear Green

A technical deep-dive from the Evolutionary Architecture series explains how Spring Data's @DataJpaTest can produce false-positive results due to Hibernate's first-level cache. When a test saves an entity and immediately retrieves it using findById(), Hibernate returns the cached in-memory object rather than querying the database, meaning no real persistence round-trip occurs. This behavior masks bugs such as missing column constraints or broken entity mappings, which only surface in production. The article identifies the find()/findById() lookup path as the specific vulnerability, noting that custom JPQL or native queries do force a real database round-trip. The proposed fix involves explicitly flushing Hibernate's write-behind queue and clearing the persistence context before any read assertion, ensuring tests validate actual database persistence rather than in-memory state.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

10GB Home Lab Networks: High Cost, Limited Gains for Most Users

Tech enthusiasts continue to debate whether upgrading to a 10GB network is genuinely necessary for home lab setups. For most users, existing 1GB or 2.5GB configurations comfortably handle tasks like 4K streaming, NAS management, and smart home devices. The real bottleneck typically lies with ISP speed limits, which a faster local network cannot overcome. Upgrading to 10GB also demands costly hardware changes — including Cat6a cabling, new switches, and compatible NICs — adding significant financial and logistical burden. Analysts conclude that unless a user has specific high-demand needs like large-scale data transfers or professional media production, the investment is unlikely to deliver proportionate returns.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

SolonCode Web's Rerun and Continue Buttons Serve Distinct Roles in AI Chats

SolonCode's web interface includes two action buttons — Rerun and Continue — displayed alongside every AI response to address the two most common problems in AI-assisted coding sessions. The Rerun button discards the AI's last response and any subsequent messages, then replays the original user prompt from scratch, allowing the agent to take a fresh approach. In contrast, the Continue button preserves the existing response and resumes generation from where the agent stopped, appending new content to the same output bubble. Under the hood, each button triggers a distinct backend command — /rerun and /continue — that manipulates the session's message history or internal execution trace differently. Developers can use Rerun when an answer is incorrect or took the wrong direction, and Continue when a response was cut short before completion.

0 comments Read more at DEV Community