io.github.alexpota/cloudscope
NPM · CLOUDSCOPE-MCP · SCANNED SEP 20
Azure + GCP cost management: spending, forecasts, anomalies, budgets, idle resources, and tags.
Available components
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security89
- No malware found by supply-chain analysis.Pass
- CVE check failed: a known high-severity CVE affects uuid 8.3.2, reached via @azure/arm-resourcegraph > @azure/ms-rest-js > uuid. A fixed version is available. View diagnostics → Fail
- No install/post-install scripts declared.Pass
- 87 of 267 dependencies flagged as unhealthy (5 deprecated). View diagnostics → Partial
Provenance & Transparency100
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Cryptographically verified build provenance (signed, bound to alexpota/cloudscope-mcp). View diagnostics → Pass
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 113 days ago).Pass
- Publishes a security disclosure policy (SECURITY.md).Pass
Schema Quality & AI Usability84
- 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Pass
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 1941 tokens (~129/item across 15 items; 15 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management83
- Stability observed for 25 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- We read all 15 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
- An AI judge read all 16 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
How do I install the io.github.alexpota/cloudscope MCP server?
io.github.alexpota/cloudscope runs locally as an npm package, launched with npx -y cloudscope-mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
npm · cloudscope-mcp
claude mcp add alexpota-cloudscope -- npx -y cloudscope-mcp
{
"mcpServers": {
"alexpota-cloudscope": {
"command": "npx",
"args": [
"-y",
"cloudscope-mcp"
]
}
}
} {
"servers": {
"alexpota-cloudscope": {
"command": "npx",
"args": [
"-y",
"cloudscope-mcp"
]
}
}
} codex mcp add alexpota-cloudscope -- npx -y cloudscope-mcp
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"alexpota-cloudscope": {
"type": "local",
"command": [
"npx",
"-y",
"cloudscope-mcp"
],
"enabled": true
}
}
} openclaw mcp add alexpota-cloudscope --command npx --arg -y --arg cloudscope-mcp
mcp_servers:
alexpota-cloudscope:
command: "npx"
args: ["-y", "cloudscope-mcp"] {
"McpServers": {
"alexpota-cloudscope": {
"Transport": "stdio",
"Command": "npx",
"Arguments": [
"-y",
"cloudscope-mcp"
]
}
}
} assistant mcp add alexpota-cloudscope -t stdio -c npx -a -y cloudscope-mcp
{
"mcpServers": {
"alexpota-cloudscope": {
"command": "npx",
"args": [
"-y",
"cloudscope-mcp"
]
}
}
} Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 19 Sept 26 −3
- Stability: pass → 0.80 functional
- 18 Sept 26 +1
- Stability: 0.97 → pass security
- 16 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 90 to 93. That category is still filling its 30-day observation window: 27 days of observed history at the previous scan, 28 at this one. The score rises as the window fills, whether or not the server changes.
- 14 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 83 to 87. That category is still filling its 30-day observation window: 25 days of observed history at the previous scan, 26 at this one. The score rises as the window fills, whether or not the server changes.
- 12 Sept 26 −3
- Stability: pass → 0.80 functional
- 11 Sept 26 +1
- Stability: 0.97 → pass security
- 9 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 90 to 93. That category is still filling its 30-day observation window: 27 days of observed history at the previous scan, 28 at this one. The score rises as the window fills, whether or not the server changes.
- 7 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 83 to 87. That category is still filling its 30-day observation window: 25 days of observed history at the previous scan, 26 at this one. The score rises as the window fills, whether or not the server changes.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 20 Sept 2026 · Analysed npm/cloudscope-mcp@0.3.3
Provenance Verified
A signed build attestation was found and verified, binding this exact artifact to the source repository it claims to come from.
| Result | Verified |
|---|---|
| Ecosystem | npm |
| Reason | Verified |
| Discovered via | Registry attestation endpoint |
| Source repo | alexpota/cloudscope-mcp |
| Certificate issuer | https://token.actions.githubusercontent.com |
| Certificate SAN | https://github.com/alexpota/cloudscope-mcp/.github/workflows/publish.yml@refs/tags/v0.3.3 |
| Rekor log index | 1671483399 |
| Predicate type | https://slsa.dev/provenance/v1 |
| Subject digest | sha512:d768be3e528ab72941d25ffc4f50b56e6e6d4612111dca18d387ed255155dc627da397d39c07d7aafe7d857ac239cc88a0a09f30d0bfba54c96db455e |
Background: How many MCP packages publish verified provenance →
Vulnerabilities 1 finding
| ID | CVE | Severity | Vector | Fix available |
|---|---|---|---|---|
| GHSA-w5hq-g745-h8pq | CVE-2026-41907 | high | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N | yes |
Background: What a vulnerability scan can and cannot prove →
Dependencies 267 packages
| Packages resolved | 267 |
|---|---|
| Deprecated | 5 |
| Stale | 84 |
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
check_budgets Budget Status ~61
Check budget status: current spend vs limit, percentage used, forecast, and overage risk. For GCP, requires GCP_BILLING_ACCOUNT_ID to be set.
| Name | Type | Req | Description |
|---|---|---|---|
| provider | string | – | Cloud provider to query (azure or gcp) |
No output schema declared.
No examples provided.
compare_periods Compare Cost Periods ~125
Compare costs between two date ranges, showing per-service absolute and percentage changes.
| Name | Type | Req | Description |
|---|---|---|---|
| group_by | string | – | How to group costs: service or resource_group |
| period_a_end | string | yes | Period A end date (YYYY-MM-DD) |
| period_a_start | string | yes | Period A start date (YYYY-MM-DD) |
| period_b_end | string | yes | Period B end date (YYYY-MM-DD) |
| period_b_start | string | yes | Period B start date (YYYY-MM-DD) |
| provider | string | – | Cloud provider to query (azure or gcp) |
No output schema declared.
No examples provided.
detect_anomalies Detect Cost Anomalies ~150
Compares daily spending over the last N days against the prior N days to find cost spikes. Returns a list of services where spending increased above the threshold percentage, sorted by increase amount. Each entry includes service name, previous cost, current cost, percentage change, and absolute change in USD. Returns an empty list if no anomalies found. Use this when the user asks about unexpected cost increases, billing surprises, or wants to know if anything changed recently.
| Name | Type | Req | Description |
|---|---|---|---|
| days | number | – | Number of days to compare (default: 7) |
| provider | string | – | Cloud provider to query (azure or gcp) |
| threshold | number | – | Minimum percentage increase to flag (default: 20) |
No output schema declared.
No examples provided.
find_idle_resources Find Idle Resources ~123
Finds cloud resources that are provisioned but not actively used — unattached disks, orphaned network interfaces, unused IPs, idle VMs, and empty compute plans. Returns each resource with its name, type, resource group/project, reason it is idle, and estimated monthly cost in USD. Returns an empty list if no idle resources are found. Use this when the user asks about waste, idle or unused resources, cleanup opportunities, or wants to find resources to delete to reduce costs.
| Name | Type | Req | Description |
|---|---|---|---|
| provider | string | – | Cloud provider to query (azure or gcp) |
No output schema declared.
No examples provided.
find_untagged_resources Find Untagged Resources ~111
Finds resources that have no tags or labels applied. Returns each resource with its name, type, resource group/project, and location. Untagged resources cannot be attributed to teams or projects, making cost allocation and chargeback impossible. Returns an empty list if all resources are tagged. Use this when the user asks about tagging compliance, governance, cost attribution gaps, or wants to identify resources that need tags or labels.
| Name | Type | Req | Description |
|---|---|---|---|
| provider | string | – | Cloud provider to query (azure or gcp) |
No output schema declared.
No examples provided.
get_cost_by_tag Cost by Tag ~183
Breaks down costs by a specific tag or label key such as team, environment, or project. Returns a sorted table with each tag value, cost in USD, and percentage of total. Includes a total row and daily average. Returns an error if the date range is invalid or no tagged costs exist. Use this when the user asks about costs per team, per environment, cost allocation, chargeback, or wants to understand spending by any custom tag or label.
| Name | Type | Req | Description |
|---|---|---|---|
| end_date | string | – | End date (YYYY-MM-DD). Defaults to today. |
| provider | string | – | Cloud provider to query (azure or gcp) |
| start_date | string | – | Start date (YYYY-MM-DD). Defaults to first of current month. |
| tag_key | string | yes | Tag/label key to group costs by (e.g. team, environment, project) |
No output schema declared.
No examples provided.
get_cost_forecast Cost Forecast ~131
Projects future cloud spending for the next N days using a linear trend based on the last 30 days of actual costs. Returns the forecast period dates, projected total cost in USD, average daily projected cost, and the confidence basis (number of historical days used). Use this when the user asks "how much will I spend this month", wants to predict upcoming bills, or needs to plan budgets. Returns an error if insufficient historical data exists.
| Name | Type | Req | Description |
|---|---|---|---|
| days | number | – | Number of days to forecast (default: 30) |
| provider | string | – | Cloud provider to query (azure or gcp) |
No output schema declared.
No examples provided.
get_cost_summary Cloud Cost Summary ~200
Returns a cost breakdown for a date range grouped by service, resource group, tag, or region. Defaults to current month if dates are omitted. Output includes a sorted table with each group name, cost in USD, and percentage of total. Includes a total row, daily average, and collapses groups beyond the top 10 into an "Other" row. Returns an error if the date range is invalid. Use this when the user asks "how much am I spending", "what costs the most", "show me my cloud bill", or wants a spending overview.
| Name | Type | Req | Description |
|---|---|---|---|
| end_date | string | – | End date (YYYY-MM-DD). Defaults to today. |
| group_by | string | – | How to group costs: service, resource_group, tag, or region |
| provider | string | – | Cloud provider to query (azure or gcp) |
| start_date | string | – | Start date (YYYY-MM-DD). Defaults to first of current month. |
No output schema declared.
No examples provided.
get_cross_project_costs Cross-Project Cost Summary ~143
Returns a combined cost breakdown across multiple GCP projects sorted by total spend. Each project shows its name, total cost in USD, and percentage of the combined total. Use this when the user asks about costs across all GCP projects, wants to compare project spending, or needs an organization-wide cost overview.
| Name | Type | Req | Description |
|---|---|---|---|
| end_date | string | – | End date (YYYY-MM-DD). Defaults to today. |
| project_ids | array | – | Project IDs to include. Defaults to all known projects. |
| provider | string | yes | Cloud provider (GCP-only tool) |
| start_date | string | – | Start date (YYYY-MM-DD). Defaults to first of current month. |
No output schema declared.
No examples provided.
get_cross_subscription_costs Cross-Subscription Cost Summary ~159
Returns a combined cost breakdown across multiple Azure subscriptions sorted by total spend. Each subscription shows its name, total cost in USD, and percentage of the combined total. Handles partial failures gracefully — if some subscriptions are inaccessible, returns results for the rest with a warning. Use this when the user asks about costs across all subscriptions, wants to compare subscription spending, or needs an organization-wide cost overview.
| Name | Type | Req | Description |
|---|---|---|---|
| end_date | string | – | End date (YYYY-MM-DD). Defaults to today. |
| provider | string | yes | Cloud provider (Azure-only tool) |
| start_date | string | – | Start date (YYYY-MM-DD). Defaults to first of current month. |
| subscription_ids | array | – | Subscription IDs to include. Defaults to all enabled subscriptions. |
No output schema declared.
No examples provided.
get_current_date Current Date ~27
Returns today's date and the start/end of current and previous months in YYYY-MM-DD format
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
list_projects List GCP Projects ~76
Returns all GCP projects the current credential can access, with name, ID, and state. Shows which project is currently active. Use this when the user has multiple GCP projects and wants to see which ones are available, or before calling get_cross_project_costs.
| Name | Type | Req | Description |
|---|---|---|---|
| provider | string | yes | Cloud provider (GCP-only tool) |
No output schema declared.
No examples provided.
list_recommendations Cost Optimization Recommendations ~125
Fetches cost-saving recommendations filtered by category. Returns a list of recommendations each containing: title, category, impact level (high/medium/low), estimated annual savings in USD, affected resource ID, and a short description of the suggested action. Returns an empty list if no recommendations exist for the selected category. Use this when the user wants to reduce costs, find waste, or optimize resource usage.
| Name | Type | Req | Description |
|---|---|---|---|
| category | string | – | Filter by category: all, compute, storage, or networking |
| provider | string | – | Cloud provider to query (azure or gcp) |
No output schema declared.
No examples provided.
list_subscriptions List Azure Subscriptions ~73
Returns all Azure subscriptions the current credential can access, with name, ID, and state. Shows which subscription is currently active. Use this when the user has multiple subscriptions and wants to see which ones are available, or to confirm which subscription is being queried.
| Name | Type | Req | Description |
|---|---|---|---|
| provider | string | yes | Cloud provider (Azure-only tool) |
No output schema declared.
No examples provided.
top_spending_resources Top Spending Resources ~87
Find the N most expensive individual resources over a time period. On GCP, requires the detailed billing export for resource-level data.
| Name | Type | Req | Description |
|---|---|---|---|
| days | number | – | Number of days to look back (default: 30) |
| limit | number | – | Number of resources to return (default: 10) |
| provider | string | – | Cloud provider to query (azure or gcp) |
No output schema declared.
No examples provided.
What is the io.github.alexpota/cloudscope MCP server?
io.github.alexpota/cloudscope is an MCP server listed in the public MCP registry as io.github.alexpota/cloudscope. Azure + GCP cost management: spending, forecasts, anomalies, budgets, idle resources, and tags. This page covers its npm package (cloudscope-mcp).
Is the io.github.alexpota/cloudscope MCP server safe to use?
io.github.alexpota/cloudscope scores 91 out of 100 on VerifyMCP. We recorded 1 known advisory against it as of 20 September 2026. It declares no install or post-install scripts. Its build provenance is signed and verified. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the io.github.alexpota/cloudscope MCP server expose?
io.github.alexpota/cloudscope exposes 15 tools: get_cost_summary, detect_anomalies, list_recommendations, get_cost_forecast, check_budgets, and 10 more. Their descriptions and schemas cost roughly 1,774 tokens of context every time the server is loaded.
Is the io.github.alexpota/cloudscope MCP server still maintained?
io.github.alexpota/cloudscope is still listed as active in the MCP registry. We last reached this channel on 20 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the io.github.alexpota/cloudscope MCP server under?
io.github.alexpota/cloudscope declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.