security: review commerce tools for payment data exposure #29

New issue

Open

opened 2026-02-21 01:03:15 +00:00 by Clotho · 0 comments

Clotho commented

2026-02-21 01:03:15 +00:00

Member

Summary

Four commerce tools exist (CreateCoupon, ListInvoices, GetBillingStatus, UpgradePlan) that interact with billing systems. These require a dedicated security review.

Concerns

CreateCoupon — could enable discount abuse if not properly authorised
ListInvoices — must not expose invoices across workspaces/tenants
GetBillingStatus — leaking plan details could enable enumeration attacks
UpgradePlan — must require explicit user confirmation, not AI-autonomous execution

Required Review

Verify all tools enforce workspace/tenant isolation
Check that UpgradePlan requires explicit user confirmation
Verify CreateCoupon requires admin-level permissions
Check ListInvoices scoping (does it return only current workspace invoices?)
Ensure no billing amounts are calculated client-side
Review integration with payment provider API for credential handling

Files

src/Mcp/Tools/Commerce/ (all files)

## Summary Four commerce tools exist (`CreateCoupon`, `ListInvoices`, `GetBillingStatus`, `UpgradePlan`) that interact with billing systems. These require a dedicated security review. ## Concerns - `CreateCoupon` — could enable discount abuse if not properly authorised - `ListInvoices` — must not expose invoices across workspaces/tenants - `GetBillingStatus` — leaking plan details could enable enumeration attacks - `UpgradePlan` — must require explicit user confirmation, not AI-autonomous execution ## Required Review - [ ] Verify all tools enforce workspace/tenant isolation - [ ] Check that `UpgradePlan` requires explicit user confirmation - [ ] Verify `CreateCoupon` requires admin-level permissions - [ ] Check `ListInvoices` scoping (does it return only current workspace invoices?) - [ ] Ensure no billing amounts are calculated client-side - [ ] Review integration with payment provider API for credential handling ## Files - `src/Mcp/Tools/Commerce/` (all files)