ADR-097 Phase 3 upstream: report the actual cost of a completed federated call. Fans out to the cost-tracker bus (via the integrator-wired SpendReporter) and the breaker service (so its in-memory rolling buffer is fed). Both targets are optional; calling without either configured is a silent no-op.
AI agents use federation_report_spend to commit financial operations through Ruflo — usually the final step of a payment, billing, or trading workflow. A call moves real money.
This tool reports financial spend/cost data to a cost-tracking system. While it appears to be reporting/recording costs rather than directly moving money, it commits financial obligation records that feed into cost trackers and circuit breakers, placing it in the Financial category. Severity is medium because misuse could corrupt cost accounting or trigger breakers, but it's not directly authorizing payments.
From the tool's definition 'report the actual cost of a completed federated call', 'fans out to the cost-tracker bus', 'SpendReporter', 'breaker service'
Attacks that exploit this kind of access
ADR-097 Phase 3 upstream: report the actual cost of a completed federated call. Fans out to the cost-tracker bus (via the integrator-wired SpendReporter) and the breaker service (so its in-memory rolling buffer is fed). Both targets are optional; calling without either configured is a silent no-op. It is categorised as a Financial tool in the Ruflo MCP Server, which means it involves financial transactions. Block by default and require explicit approval.
Register the Ruflo MCP server in PolicyLayer and add a rule for federation_report_spend: allow, deny, rate-limit, or require approval. Point your MCP client at the PolicyLayer proxy URL and the rule is enforced on every call, before it reaches Ruflo. Nothing to install.
federation_report_spend is a Financial tool with critical risk. Critical-risk tools should be blocked by default and only enabled with explicit human approval.
Yes. Add a rate_limit block to the federation_report_spend rule in your PolicyLayer policy. For example, setting max: 10 and window: 60 limits the tool to 10 calls per minute. Rate limits are tracked per agent session and reset automatically.
Set action: deny in the PolicyLayer policy for federation_report_spend. The AI agent will receive a policy violation error and cannot call the tool. You can also include a reason field to explain why the tool is blocked.
federation_report_spend is provided by the Ruflo MCP server (ruvnet/ruflo). PolicyLayer sits as a proxy in front of this server to enforce policies before tool calls reach the server.
federation_report_spend is one line of Ruflo's registry record.
The record carries the whole server: verified identity, auth posture, risk grade, every tool classified, recommended policy — re-checked continuously.
Teams ship this data inside their own products. See what a licence covers →