# AI Inventory

> Generated by [ai-surface](https://github.com/apisec-inc/AI-Surface) v1.0.0. Schema 1.0.
> Scan timestamp: `2026-06-17T20:28:35.797094+00:00`

**Production AI surfaces:** 19  ·  **Risk indicators:** 25

**Severity:** 🟠 HIGH 3  ·  🟡 MEDIUM 1

## LLM SDK Call Sites

### Anthropic SDK

**Files:** `src/llm_service.py`

**Models:** `claude-3-5-sonnet-20241022`

**Risk indicators:**

- ⚠️ non-literal data flows into LLM call

[Validate this surface →](https://www.apisec.ai/products?category=llm-sdk&risk=non-literal-data-flow&utm_source=ai-surface&utm_medium=markdown&utm_campaign=oss-funnel)

```
from anthropic import Anthropic
```

### OpenAI SDK

**Files:** `src/llm_service.py`

**Models:** `gpt-4-turbo`

**Risk indicators:**

- ⚠️ non-literal data flows into LLM call

[Validate this surface →](https://www.apisec.ai/products?category=llm-sdk&risk=non-literal-data-flow&utm_source=ai-surface&utm_medium=markdown&utm_campaign=oss-funnel)

```
from openai import OpenAI
```

### AWS Bedrock

**Files:** `src/support_workflow.py`

**Models:** `us.anthropic.claude-sonnet-4-20250514-v1:0`

```
from strands.models import BedrockModel
```


## Agent Frameworks

### AWS Strands Agent: triage_agent (in src/support_workflow.py)

**Files:** `src/support_workflow.py`

**Tools/permissions:** `fetch_customer_profile`, `search_knowledge_base`, `escalate_to_human`

```
triage_agent = Agent(
```

[Validate at runtime: Coming soon: agent validation in APIsec →](https://www.apisec.ai/products?category=agent-framework&utm_source=ai-surface&utm_medium=ui&utm_campaign=oss-funnel)

### 🟠 HIGH LangChain Agent: support_agent (in src/chat_agent.py)

**Files:** `src/chat_agent.py`

**Tools/permissions:** `lookup_order`, `refund_payment`, `cancel_subscription`

**Risk indicators:**

- ⚠️ financial action exposed
- ⚠️ high blast-radius combination

[Validate this surface →](https://www.apisec.ai/products?category=agent-framework&risk=financial-action&utm_source=ai-surface&utm_medium=markdown&utm_campaign=oss-funnel)

**Audit risk flags:**

- 🟠 HIGH **financial-action**: Agent can invoke financial tools (refund_payment)
  - OWASP: `LLM06`
  - Governance: EU AI Act Art. 9
  - Fix: Gate financial tools behind human approval; least-privilege the agent.
- 🟠 HIGH **high-blast-radius**: Agent combines broad read access with financial/destructive actions
  - OWASP: `LLM06`
  - Governance: EU AI Act Art. 9
  - Fix: Split read and write agents; apply least-privilege per agent.
- 🟠 HIGH **no-human-oversight**: High-risk action (financial-action, high-blast-radius) runs with no human approval / in-the-loop gate detected
  - OWASP: `LLM06`, `LLM09`
  - Governance: EU AI Act Art. 14
  - Fix: Put a human-in-the-loop approval step in front of this action (approval gate, confirmation, or a LangGraph interrupt). If approval is enforced elsewhere, confirm the gate sits on this path.

```
support_agent = create_react_agent(llm=llm, tools=tools, prompt="...")
```

[Validate at runtime: Coming soon: agent validation in APIsec →](https://www.apisec.ai/products?category=agent-framework&risk=financial-action&utm_source=ai-surface&utm_medium=ui&utm_campaign=oss-funnel)

### LangChain (used in 1 file)

**Files:** `src/knowledge_base.py`

[Validate at runtime: Coming soon: agent validation in APIsec →](https://www.apisec.ai/products?category=agent-framework&utm_source=ai-surface&utm_medium=ui&utm_campaign=oss-funnel)


## MCP Servers

### 🟡 MEDIUM MCP Server: github-mcp

**Files:** `.mcp.json`

**Tools/permissions:** `repo:read`, `issues:write`, `admin`

**Risk indicators:**

- ⚠️ remote MCP endpoint
- ⚠️ broad permissions

[Validate this surface →](https://www.apisec.ai/products?category=mcp-server&risk=remote-mcp-endpoint&utm_source=ai-surface&utm_medium=markdown&utm_campaign=oss-funnel)

**Audit risk flags:**

- 🟡 MEDIUM **remote-mcp**: MCP connects to a remote server via URL; server security and availability affect trust.
  - OWASP: `LLM03`, `LLM10`
  - Governance: ISO 42001 A.10
  - Fix: Verify the remote server is trusted; require HTTPS and validate certificates.
- 🟡 MEDIUM **broad-permissions**: MCP is granted broad permissions (admin/write/delete/wildcard scopes).
  - OWASP: `LLM06`
  - Fix: Scope permissions to the minimum the workflow requires.

**Trust:** verified (90/100)

```
"github-mcp": {
```

[Validate at runtime: Coming soon: MCP runtime validation in APIsec →](https://www.apisec.ai/products?category=mcp-server&risk=remote-mcp&utm_source=ai-surface&utm_medium=ui&utm_campaign=oss-funnel)

### 🟠 HIGH MCP Server: stripe-mcp

**Files:** `.mcp.json`

**Tools/permissions:** `read_charges`, `refund`, `customer:read`

**Risk indicators:**

- ⚠️ unverified source
- ⚠️ financial action exposed

[Validate this surface →](https://www.apisec.ai/products?category=mcp-server&risk=unverified-source&utm_source=ai-surface&utm_medium=markdown&utm_campaign=oss-funnel)

**Audit risk flags:**

- 🟡 MEDIUM **unverified-source**: MCP is not from a known/verified publisher; its behaviour and security posture are unknown.
  - OWASP: `LLM03`
  - Governance: ISO 42001 A.10
  - Fix: Review the source before use; prefer official/verified MCPs; run unverified MCPs in isolation.
- 🟠 HIGH **financial-action**: MCP exposes financial tools (refund, charge, payout) to the model.
  - OWASP: `LLM06`
  - Governance: EU AI Act Art. 9
  - Fix: Gate financial tools behind human approval.
- 🟠 HIGH **no-human-oversight**: High-risk action (financial-action) runs with no human approval / in-the-loop gate detected
  - OWASP: `LLM06`, `LLM09`
  - Governance: EU AI Act Art. 14
  - Fix: Put a human-in-the-loop approval step in front of this action (approval gate, confirmation, or a LangGraph interrupt). If approval is enforced elsewhere, confirm the gate sits on this path.

**Trust:** verified (90/100)

```
"stripe-mcp": {
```

[Validate at runtime: Coming soon: MCP runtime validation in APIsec →](https://www.apisec.ai/products?category=mcp-server&risk=financial-action&utm_source=ai-surface&utm_medium=ui&utm_campaign=oss-funnel)

### 🟠 HIGH MCP Server (in-house): src/orders_mcp_server.py

**Files:** `src/orders_mcp_server.py`

**Tools/permissions:** `lookup_order`, `refund_payment`, `cancel_order`, `delete_customer`, `update_record`

**Risk indicators:**

- ⚠️ in-house MCP server (custom code, audit recommended)
- ⚠️ unverified source
- ⚠️ financial action exposed

[Validate this surface →](https://www.apisec.ai/products?category=mcp-server&risk=in-house-mcp&utm_source=ai-surface&utm_medium=markdown&utm_campaign=oss-funnel)

**Audit risk flags:**

- 🟡 MEDIUM **unverified-source**: MCP is not from a known/verified publisher; its behaviour and security posture are unknown.
  - OWASP: `LLM03`
  - Governance: ISO 42001 A.10
  - Fix: Review the source before use; prefer official/verified MCPs; run unverified MCPs in isolation.
- 🟠 HIGH **financial-action**: MCP exposes financial tools (refund, charge, payout) to the model.
  - OWASP: `LLM06`
  - Governance: EU AI Act Art. 9
  - Fix: Gate financial tools behind human approval.
- 🟠 HIGH **no-human-oversight**: High-risk action (financial-action) runs with no human approval / in-the-loop gate detected
  - OWASP: `LLM06`, `LLM09`
  - Governance: EU AI Act Art. 14
  - Fix: Put a human-in-the-loop approval step in front of this action (approval gate, confirmation, or a LangGraph interrupt). If approval is enforced elsewhere, confirm the gate sits on this path.

**Trust:** unknown

```
`,   `destructive action exposed`, `database write exposed` """ from __future__ import annotations  from mcp.server.fastmcp import FastMCP   mcp = FastMCP("orders-mcp")   @mcp.tool() def lookup_order(
```

[Validate at runtime: Coming soon: MCP runtime validation in APIsec →](https://www.apisec.ai/products?category=mcp-server&risk=financial-action&utm_source=ai-surface&utm_medium=ui&utm_campaign=oss-funnel)


## Model Gateways

### Model Gateway: LiteLLM

**Files:** `litellm.config.yaml`

**Tools/permissions:** `claude-sonnet-4`, `gpt-4`, `bedrock-claude`

**Risk indicators:**

- ⚠️ multi-model routing layer (production traffic flows through this)

[Validate this surface →](https://www.apisec.ai/products?category=model-gateway&risk=multi-model-routing&utm_source=ai-surface&utm_medium=markdown&utm_campaign=oss-funnel)

```
model_list:
```


## AI Infrastructure

### K8s AI Workload: vllm (in deploy/vllm-embeddings.yaml)

**Files:** `deploy/vllm-embeddings.yaml`

**Risk indicators:**

- ⚠️ self-hosted LLM runtime (operational responsibility on the team)

[Validate this surface →](https://www.apisec.ai/products?category=ai-infra&risk=self-hosted-llm&utm_source=ai-surface&utm_medium=markdown&utm_campaign=oss-funnel)

```
image: vllm/vllm-openai:latest
```

### Bedrock provisioned throughput: anthropic.claude-sonnet-4-20250514-v1:0

**Files:** `deploy/bedrock.tf`

**Risk indicators:**

- ⚠️ high-cost AI infrastructure (billing exposure)

[Validate this surface →](https://www.apisec.ai/products?category=ai-infra&risk=high-cost-ai-infra&utm_source=ai-surface&utm_medium=markdown&utm_campaign=oss-funnel)

```
resource "aws_bedrock_provisioned_model_throughput" "support_claude" {
```


## AI Provider API Keys (env)

### AI Provider API Keys

**Files:** `.env.example`

**Risk indicators:**

- ⚠️ multiple AI provider keys present
- ⚠️ observability/tracing key present (production telemetry to third party)

[Validate this surface →](https://www.apisec.ai/products?category=env-key&risk=multiple-providers&utm_source=ai-surface&utm_medium=markdown&utm_campaign=oss-funnel)

```
OPENAI_API_KEY=<redacted>
```


## API Endpoints

### REST API: GET /health

**Endpoint:** `GET /health`

**Framework:** `fastapi`  ·  **Auth:** `unknown`

**Files:** `src/api.py`

```
@app.get("/health")
```

[Validate at runtime: Onboard this API for outside-in runtime testing in APIsec →](https://www.apisec.ai/products?utm_source=ai-surface&utm_medium=ui&utm_campaign=oss-funnel)

### REST API: GET /orders/{order_id}

**Endpoint:** `GET /orders/{order_id}`

**Framework:** `fastapi`  ·  **Auth:** `unknown`

**Files:** `src/api.py`

**Risk indicators:**

- ⚠️ object-id in path (BOLA candidate)

[Validate this surface →](https://www.apisec.ai/products?category=api&risk=object-id-in-path-bola-candidate&utm_source=ai-surface&utm_medium=markdown&utm_campaign=oss-funnel)

```
@app.get("/orders/{order_id}")
```

[Validate at runtime: Onboard this API for outside-in runtime testing in APIsec →](https://www.apisec.ai/products?utm_source=ai-surface&utm_medium=ui&utm_campaign=oss-funnel)

### REST API: GET /customers/{customer_id}

**Endpoint:** `GET /customers/{customer_id}`

**Framework:** `fastapi`  ·  **Auth:** `unknown`

**Files:** `src/api.py`

**Risk indicators:**

- ⚠️ object-id in path (BOLA candidate)

[Validate this surface →](https://www.apisec.ai/products?category=api&risk=object-id-in-path-bola-candidate&utm_source=ai-surface&utm_medium=markdown&utm_campaign=oss-funnel)

```
@app.get("/customers/{customer_id}")
```

[Validate at runtime: Onboard this API for outside-in runtime testing in APIsec →](https://www.apisec.ai/products?utm_source=ai-surface&utm_medium=ui&utm_campaign=oss-funnel)

### REST API: PATCH /customers/{customer_id}

**Endpoint:** `PATCH /customers/{customer_id}`

**Framework:** `fastapi`  ·  **Auth:** `unknown`

**Files:** `src/api.py`

**Risk indicators:**

- ⚠️ object-id in path (BOLA candidate)

[Validate this surface →](https://www.apisec.ai/products?category=api&risk=object-id-in-path-bola-candidate&utm_source=ai-surface&utm_medium=markdown&utm_campaign=oss-funnel)

```
@app.patch("/customers/{customer_id}")
```

[Validate at runtime: Onboard this API for outside-in runtime testing in APIsec →](https://www.apisec.ai/products?utm_source=ai-surface&utm_medium=ui&utm_campaign=oss-funnel)


## Vector Store

### Vector store: pgvector

**Files:** `src/knowledge_base.py`

**Risk indicators:**

- ⚠️ retrieved content reaches the model (retrieval-augmented generation)
- ⚠️ application data embedded for retrieval
- ⚠️ ingests external content (RAG poisoning surface)

[Validate this surface →](https://www.apisec.ai/products?category=vector-store&risk=retrieved-content-reaches-the-model-retrieval-augmented-gene&utm_source=ai-surface&utm_medium=markdown&utm_campaign=oss-funnel)

```
from langchain_postgres.vectorstores import PGVector
```

### RAG pipeline: LangChain

**Files:** `src/knowledge_base.py`

**Risk indicators:**

- ⚠️ retrieved content reaches the model (retrieval-augmented generation)
- ⚠️ application data embedded for retrieval
- ⚠️ ingests external content (RAG poisoning surface)

[Validate this surface →](https://www.apisec.ai/products?category=vector-store&risk=retrieved-content-reaches-the-model-retrieval-augmented-gene&utm_source=ai-surface&utm_medium=markdown&utm_campaign=oss-funnel)

```
from langchain_postgres.vectorstores import PGVector
```


## Risk Indicator Summary

- ⚠️ MCP Server: github-mcp: remote MCP endpoint
- ⚠️ MCP Server: github-mcp: broad permissions
- ⚠️ MCP Server: stripe-mcp: unverified source
- ⚠️ MCP Server: stripe-mcp: financial action exposed
- ⚠️ MCP Server (in-house): src/orders_mcp_server.py: in-house MCP server (custom code, audit recommended)
- ⚠️ MCP Server (in-house): src/orders_mcp_server.py: unverified source
- ⚠️ MCP Server (in-house): src/orders_mcp_server.py: financial action exposed
- ⚠️ Anthropic SDK: non-literal data flows into LLM call
- ⚠️ OpenAI SDK: non-literal data flows into LLM call
- ⚠️ LangChain Agent: support_agent (in src/chat_agent.py): financial action exposed
- ⚠️ LangChain Agent: support_agent (in src/chat_agent.py): high blast-radius combination
- ⚠️ AI Provider API Keys: multiple AI provider keys present
- ⚠️ AI Provider API Keys: observability/tracing key present (production telemetry to third party)
- ⚠️ Model Gateway: LiteLLM: multi-model routing layer (production traffic flows through this)
- ⚠️ K8s AI Workload: vllm (in deploy/vllm-embeddings.yaml): self-hosted LLM runtime (operational responsibility on the team)
- ⚠️ Bedrock provisioned throughput: anthropic.claude-sonnet-4-20250514-v1:0: high-cost AI infrastructure (billing exposure)
- ⚠️ REST API: GET /orders/{order_id}: object-id in path (BOLA candidate)
- ⚠️ REST API: GET /customers/{customer_id}: object-id in path (BOLA candidate)
- ⚠️ REST API: PATCH /customers/{customer_id}: object-id in path (BOLA candidate)
- ⚠️ Vector store: pgvector: retrieved content reaches the model (retrieval-augmented generation)
- ⚠️ Vector store: pgvector: application data embedded for retrieval
- ⚠️ Vector store: pgvector: ingests external content (RAG poisoning surface)
- ⚠️ RAG pipeline: LangChain: retrieved content reaches the model (retrieval-augmented generation)
- ⚠️ RAG pipeline: LangChain: application data embedded for retrieval
- ⚠️ RAG pipeline: LangChain: ingests external content (RAG poisoning surface)

---

- For source-level analysis of mcp servers (shell injection, etc.): [mcp-audit](https://github.com/apisec-inc/mcp-audit)

Validate which of these surfaces are exploitable in a running application: [apisec.ai/products](https://www.apisec.ai/products?category=mcp-server&risk=in-house-mcp&utm_source=ai-surface&utm_medium=markdown&utm_campaign=oss-funnel)

### Validate at runtime in APIsec

Runtime validation routes available from this scan: `mcp-runtime`, `agent-validation`, `api-runtime`

