VantageBLOCK
MCP Server to fetch costs and usage data from your Vantage account.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
Use natural language to explore your organization's cloud costs via MCP clients, like Claude, Cursor, and others. Ask questions about your organization's previous and current cloud cost spend, cost tagging, provider integrations, and more.
About
The Vantage MCP Server exposes tools for listing, querying, and creating Vantage resources. Tools are defined in /src/tools; see the Vantage MCP documentation for the full tool list, prompting examples, and product details.
This repository supports two deployment modes:
Start with the hosted MCP unless you have a specific reason to self-host.
Setup Instructions
General
The hosted MCP server uses Streamable HTTP with OAuth 2.1. After connecting a client, a browser window prompts you to sign in to Vantage — the same account you use at console.vantage.sh.
Server URL: https://mcp.vantage.sh/mcp
Legacy SSE connections: The /sse endpoint is deprecated and remains available during the 60-day migration window, ending on November 30, 2026, when the legac
fdfc555c22a8OBSERVED · 2026-10-07Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add vantage-mcp-server --env VANTAGE_TOKEN=${VANTAGE_TOKEN} -- npx -y vantage-mcp-server{
"mcpServers": {
"vantage-mcp-server": {
"command": "npx",
"args": [
"-y",
"vantage-mcp-server"
],
"env": {
"VANTAGE_TOKEN": "${VANTAGE_TOKEN}"
}
}
}
}Exposed tools (13)
10 read · 2 write · 1 destructive. Blast radius: 1 tool can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.
| Tool | Risk | Description |
|---|---|---|
Platform | read | Platform engineering |
arg-tool | read | A tool that returns its arguments and context |
connection-check | read | |
create-saved-filter | write | Create a Saved Filter for reuse across Cost Reports. The filter uses VQL syntax. |
delete-saved-filter | destructive | Delete a Saved Filter by token. |
error-tool | read | A tool that throws an MCPUserError |
get-saved-filter | read | Get a Saved Filter by token, including its VQL filter and associated Cost Report tokens. |
invalid-output-tool | read | A tool that returns an invalid output |
list-saved-filters | read | List Saved Filters that can be applied to Cost Reports, optionally searching by title or Workspace. |
test-tool | read | A test tool |
throw-tool | read | A tool that throws a generic error |
update-saved-filter | write | Update a Saved Filter |
valid-output-tool | read | A tool that returns a valid output |
Trust audit
BLOCKgrade F · trust 51/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | FAIL |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | WARN |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (6 observation(s))
- Network
- declared (6 observation(s))
- Shell
- declared (4 observation(s))
- Dependencies
- not all pinned
- Secrets in source
- found
Findings (25)
exec(input?: (string | URLPatternInit), baseURL?: string): URLPatternResult | null;
exec(query: string): Promise<D1ExecResult>;
if (/[\u0000-\u001f\u007f---]/.test(name)) {callback_url: env.SELF_CALLBACK_URL,
if (/[\u0000-\u001f\u007f---]/.test(name)) {token: "accss_plcy_c40f15062b6d5c37",
token: "accss_plcy_c40f15062b6d5c37",
token: "accss_plcy_c40f15062b6d5c37",
token: "accss_plcy_c40f15062b6d5c37",
expect(res).toEqual({ token: "bllng_rule_fb27faa25ef5ea72" });delete-saved-filter
.dev.vars.example
.git-blame-ignore-revs
import "../../src/tools";
import { getRegisteredTool } from "../../src/tools/structure/registerTool";import "../../src/tools";
import { getRegisteredToolNames } from "../../src/tools/structure/registerTool";import { buildToolCases } from "../../_lib/buildCases";[{ client_name: "Local", redirect_uris: ["http://127.0.0.1:3000/callback"] }],it.each(["http://localhost:3000/cb", "http://127.0.0.1/cb", "http://[::1]:8080/cb"])("accepts %s", (uri) => {const auth0AuthRequest = JSON.parse(atob(auth0AuthRequestCookie)) as Auth0AuthRequest;
const auth0AuthRequest = JSON.parse(atob(auth0AuthRequestCookie)) as Auth0AuthRequest;
atob(data: string): string;
declare function atob(data: string): string;
[{ client_name: "Claude", redirect_uris: ["https://example.com/cb"] }],Gates applied: no_behavioural_pass.
fdfc555c22a8full audit observations/trust-audit/mcp-server/vantage-sh__vantage.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-07 | fdfc555c22a8 | BLOCK | F | 51 | first audit |
Questions
What is the Vantage MCP server?
MCP Server to fetch costs and usage data from your Vantage account.
What tools does Vantage expose?
13 in total: 10 read-only, 2 that write, and 1 that can delete or overwrite (delete-saved-filter). Every one is listed on this page with its risk.
Is Vantage safe to connect to an agent?
No — not without reading the findings first. The audit graded it F (51/100) and found 3 critical or high issues in the source. Each one is listed on this page with the file and line it is on. Separately from the audit: 1 of its tools can destroy data, so scope the token you give it to what you actually need.
What credentials does Vantage need?
It reads VANTAGE_TOKEN from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does Vantage run?
It speaks stdio and streamable-http, so it runs as a local process your client starts. It is published on npm as vantage-mcp-server.
How current is this page?
The grade is for one exact copy of the source (fdfc555c22a8), read on 2026-10-07. The repository is watched and re-audited when it changes.