ADR-097 Phase 3 upstream: report the actual cost of a completed federated call. Fans out to the cost-tracker bus (via the integrator-wired SpendReporter) and the breaker service (so its in-memory rolling buffer is fed). Both targets are optional; calling without either configured is a silent no-op.
AI agents use federation_report_spend to commit financial operations through Claude Flow — usually the final step of a payment, billing, or trading workflow. A call moves real money.
This tool explicitly reports financial spend/cost data to a cost-tracking system. While it appears to be a reporting/telemetry action rather than directly moving money, it commits cost records to a cost-tracker bus and feeds a circuit-breaker service with financial data. The term 'spend' and 'SpendReporter' indicate financial obligations are being recorded.
From the tool's definition 'report the actual cost of a completed federated call', 'fans out to the cost-tracker bus', 'SpendReporter', 'breaker service'
Attacks that exploit this kind of access
ADR-097 Phase 3 upstream: report the actual cost of a completed federated call. Fans out to the cost-tracker bus (via the integrator-wired SpendReporter) and the breaker service (so its in-memory rolling buffer is fed). Both targets are optional; calling without either configured is a silent no-op. It is categorised as a Financial tool in the Claude Flow MCP Server, which means it involves financial transactions. Block by default and require explicit approval.
Register the Claude Flow MCP server in PolicyLayer and add a rule for federation_report_spend: allow, deny, rate-limit, or require approval. Point your MCP client at the PolicyLayer proxy URL and the rule is enforced on every call, before it reaches Claude Flow. Nothing to install.
federation_report_spend is a Financial tool with critical risk. Critical-risk tools should be blocked by default and only enabled with explicit human approval.
Yes. Add a rate_limit block to the federation_report_spend rule in your PolicyLayer policy. For example, setting max: 10 and window: 60 limits the tool to 10 calls per minute. Rate limits are tracked per agent session and reset automatically.
Set action: deny in the PolicyLayer policy for federation_report_spend. The AI agent will receive a policy violation error and cannot call the tool. You can also include a reason field to explain why the tool is blocked.
federation_report_spend is provided by the Claude Flow MCP server (claude-flow). PolicyLayer sits as a proxy in front of this server to enforce policies before tool calls reach the server.