Skip to content

fix(mcp): reject negative mock_balance in FinStripe get_account_balance - #564

Open
Deez-Automations wants to merge 2 commits into
GenAI-Security-Project:mainfrom
Deez-Automations:fix/finstripe-negative-balance-329
Open

fix(mcp): reject negative mock_balance in FinStripe get_account_balance#564
Deez-Automations wants to merge 2 commits into
GenAI-Security-Project:mainfrom
Deez-Automations:fix/finstripe-negative-balance-329

Conversation

@Deez-Automations

Copy link
Copy Markdown

Summary

Fixes #329.

get_account_balance read mock_balance straight from server_config with no validation at all — a negative value was returned as-is as the account's available_balance. Agents (e.g. the Payments Agent) reason over this value when deciding whether a payment is affordable, so a poisoned config with a negative balance could confuse those decisions.

Fix

Rejects negative balances with a clear error. Zero and ordinary positive balances are unaffected.

Test plan

  • New test file tests/unit/mcp/test_finstripe.py — reproduces the exact issue repro steps (server_config={'mock_balance': -5000}) against the unfixed code first, then confirms the fix
  • Covers the zero-balance edge case explicitly (legitimate value, must not be rejected)
  • Regression test confirms the default positive balance is unaffected
  • pytest tests/unit/mcp/test_finstripe.py — 3/3 passing

…ce (GenAI-Security-Project#329)

mock_balance was read straight from server_config with no validation --
a negative value was returned as-is as the account's available_balance.
Agents (e.g. PaymentsAgent) reason over this value when deciding whether
a payment is affordable, so a poisoned config with a negative balance
could confuse those decisions.

Rejects negative balances with a clear error. Zero and ordinary positive
balances are unaffected.

Fixes GenAI-Security-Project#329
Copilot AI lite review requested due to automatic review settings August 11, 2026 15:31

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR fixes FinStripe MCP’s get_account_balance so a negative mock_balance from server_config is rejected instead of being returned as available_balance, addressing issue #329 where agents could make incorrect affordability decisions.

Changes:

  • Add a negative-balance guard in finbot/mcp/servers/finstripe/server.py:get_account_balance.
  • Add unit tests covering negative, zero, and default positive mock_balance behaviors.

Reviewed changes

Copilot reviewed 2 out of 3 changed files in this pull request and generated 2 comments.

File Description
finbot/mcp/servers/finstripe/server.py Rejects negative mock_balance values returned by get_account_balance.
tests/unit/mcp/test_finstripe.py Adds regression/edge-case tests for mock_balance validation behavior.

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

Comment on lines 122 to +124
mock_balance = config.get("mock_balance", DEFAULT_CONFIG["mock_balance"])
if mock_balance < 0:
return {"error": "mock_balance is invalid: balance cannot be negative"}
Comment thread tests/unit/mcp/test_finstripe.py Outdated
Comment on lines +10 to +12
Verified against source before writing anything: finbot/mcp/servers/
finstripe/server.py's get_account_balance (create_finstripe_server) has
no bounds check on mock_balance at all.
…enAI-Security-Project#329)

mock_balance < 0 would raise an unhandled TypeError if mock_balance were
None or a non-numeric type -- server_config is user-controllable JSON,
so this was reachable, not theoretical. Caught by Copilot's review on
PR GenAI-Security-Project#564. Added a type guard (excluding bool, since it's a bool subclass
of int in Python) before the comparison, returning a clear error instead
of crashing. Also fixed a docstring tense inconsistency Copilot flagged.
@Deez-Automations

Copy link
Copy Markdown
Author

Addressed the Copilot review feedback:

  • Type safety: real catch — mock_balance < 0 would raise an unhandled TypeError if mock_balance were None or non-numeric. server_config is user-controllable JSON, so this was genuinely reachable, not theoretical. Added a type guard (excluding bool, since it's a subclass of int in Python) before the comparison, returning a clear error for invalid types too. Added tests for both None and a non-numeric string.
  • Docstring tense: fixed — updated to past tense now that the check exists.

5/5 tests passing after both changes.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Bug_120_MUST_FIX: Test Case MCP-BAL-005: Negative mock_balance accepted from config without validation — agents make incorrect payment decisions

2 participants