← Back to search

@runcycles/mcp-server

GitHub Actions Scanned 7d ago

MCP server for Cycles — runtime budget authority for autonomous agents

? Not scanned yet

Versions

0.6.1latest
Jul 27, 2026
0.6.0
Jul 22, 2026
0.5.0
Jul 22, 2026
0.4.1
Jul 21, 2026
0.4.0
Jul 21, 2026
+ show 7 moreshow less
0.3.0
Jul 21, 2026
0.2.4
May 3, 2026
0.2.2
Apr 20, 2026
0.2.1
Apr 20, 2026
0.2.0
Mar 24, 2026
0.1.1
Mar 19, 2026
0.1.0
Mar 19, 2026

Tools 9

cycles_get_reservation
annotations: none low

Get details of a specific reservation by ID. Returns status, subject, action, reserved amount, timestamps, and affected scopes. Useful for debugging and monitoring long-running operations.

cycles_check_balance
annotations: none low

Check current budget balance for a scope. Returns remaining, reserved, spent, allocated, and debt amounts. At least one subject filter (tenant, workspace, app, workflow, agent, or toolset) is required. Do not use as a substitute for cycles_reserve — balances can change between check and action.

cycles_release
annotations: none low

Release a reservation without committing. Use when an operation is cancelled, skipped, or fails before execution. Returns the released budget amount back to the pool.

cycles_decide
annotations: none low

Lightweight preflight check — ask whether an action would be allowed without reserving budget. Does not create a reservation. Use at workflow start to decide strategy. For concurrency-safe budget locking, use cycles_reserve instead.

cycles_create_event
annotations: none low

Record a usage event directly without the reserve/commit lifecycle. Use for fire-and-forget metering of completed operations where pre-estimation is not available. The event is applied atomically to all derived scopes.

cycles_commit
annotations: none low

Commit actual usage after an operation completes. Always call this after cycles_reserve whether the operation succeeded or failed. Finalizes the budget charge and releases any unused reserved amount back to the pool.

cycles_list_reservations
annotations: none low

List reservations, optionally filtered by status (ACTIVE, COMMITTED, RELEASED, EXPIRED) or subject fields. Useful for debugging stuck reservations or auditing budget usage.

cycles_reserve
annotations: none low

Reserve budget before a costly operation (LLM call, tool invocation, external action). Returns a reservation_id to commit or release later. If decision is not ALLOW, do not proceed with the operation. For lightweight preflight checks without reserving, use cycles_decide instead.

cycles_extend
annotations: none low

Extend the TTL of an active reservation. Use as a heartbeat for long-running operations to prevent the reservation from expiring. Does not change the reserved amount.

Permissions 3

network medium
Server uses network capabilities via: fetch()
shell high
Server uses shell capabilities via: child_process, execSync()
env_vars low
Server uses env_vars capabilities via: process.env

Scan Findings 33

low
Tool 'cycles_get_reservation' has no annotations annotation_checker · 100%
low
Tool 'cycles_check_balance' has no annotations annotation_checker · 100%
low
Tool 'cycles_release' has no annotations annotation_checker · 100%
low
Tool 'cycles_decide' has no annotations annotation_checker · 100%
low
Tool 'cycles_create_event' has no annotations annotation_checker · 100%
low
Tool 'cycles_commit' has no annotations annotation_checker · 100%
low
Tool 'cycles_list_reservations' has no annotations annotation_checker · 100%
low
Tool 'cycles_reserve' has no annotations annotation_checker · 100%
low
Tool 'cycles_extend' has no annotations annotation_checker · 100%
info
Sandbox failed to start for behavioral verification behavioral_verifier · 100%
medium
Vulnerable dependency: @modelcontextprotocol/sdk@1.12.1 (GHSA-345p-7cg4-v4c7) dependency_analyzer · 95%
medium
Vulnerable dependency: @modelcontextprotocol/sdk@1.12.1 (GHSA-8r9q-7v3j-jr4g) dependency_analyzer · 95%
medium
Vulnerable dependency: @modelcontextprotocol/sdk@1.12.1 (GHSA-w48q-cv73-mx4w) dependency_analyzer · 95%
info
package.json metadata manifest_parser · 100%
info
Tool: cycles_get_reservation manifest_parser · 85%
info
Tool: cycles_check_balance manifest_parser · 85%
info
Tool: cycles_release manifest_parser · 85%
info
Tool: cycles_decide manifest_parser · 85%
info
Tool: cycles_create_event manifest_parser · 85%
info
Tool: cycles_commit manifest_parser · 85%
info
Tool: cycles_list_reservations manifest_parser · 85%
info
Tool: cycles_reserve manifest_parser · 85%
info
Tool: cycles_extend manifest_parser · 85%
info
Transport: stdio manifest_parser · 90%
info
Required env vars (5) manifest_parser · 80%
info
Sandbox failed to start for output poisoning scan output_poisoning · 100%
medium
Permission: network access detected permission_analyzer · 70%
high
Permission: shell access detected permission_analyzer · 95%
low
Permission: env_vars access detected permission_analyzer · 90%
critical
Tool poisoning in 'cycles_commit': Directive language: 'always' poisoning · 85%
critical
Tool poisoning in 'cycles_commit': Cross-tool sequencing directive poisoning · 85%
info
SBOM generated: 352 components sbom_generator · 100%
medium
No build provenance detected (SLSA L0) slsa_assessor · 90%