Reported issues for OTC Pricing MCP

Pod holds 16 of 36 problems reported by people outside the maintainer team. Issues filed by the project's own owners, members and collaborators are excluded entirely — a maintainer's release checklist is not a warning to a prospective user.

Back to OTC Pricing MCP.

Most discussed

eu-ch2 (Swiss OTC) coverage limitation: upstream Calculator API doesn't expose ECS/EVS/RDS/NAT/ELB/AOM — needs doc + optional patch hook

Summary

The MCP correctly proxies upstream data, but the t-systems Price Calculator API (https://calculator.otc-service.com/en/open-telekom-price-api/) exposes only a subset of services for eu-ch2 (Swiss Open Telekom Cloud). Several core IaaS services (ECS, EVS, RDS, NAT, ELB, AOM) return stats.count = 0 from the upstream for filterBy[region]=eu-ch2 — even though those services are sold in eu-ch2 according to the public T-Systems CH product pages and confirmed by users with i

Read the thread · 2026-05-11 · closed · 4 comments

swiss-otc / eu-ch2 catalog unreachable: productType hardcoded to OTC; no SOTC variant accepted by upstream

Bug: swiss-otc / eu-ch2 catalog unreachable via MCP (productType hardcoded to `OTC`)

Symptom

Queries against the MCP for region=eu-ch2 (Swiss OTC, CHF-priced subset) return empty results for most services. Example:

query_pricing(['evs'], region='eu-ch2')  # → 0 items
query_pricing(['ecs'], region='eu-ch2')  # → 0 items

Discovery.py:10-12 acknowledges the gap:

eu-ch2 (Swiss OTC, CHF) only carries a subset of services (obs, kms, lts, hss, ito, apig, etc.)

…but in pra

Read the thread · 2026-05-24 · closed · 1 comment

security.yml pip-audit blocks every version bump (--strict + editable local project)

Severity: MEDIUM — CI workflow blocker

Symptom

After bumping the project version (e.g. 0.1.8 → 0.1.9 in PR #46) the `Dependency Audit (pip-audit)` job in `security.yml` fails with:

``` ERROR:pip_audit._cli:otc-pricing-mcp: Dependency not found on PyPI and could not be audited: otc-pricing-mcp (0.1.9) ```

The same audit in `ci.yml`'s `Security - Dependency Audit (pip-audit)` job passes for the same commit. `security.yml`'s `Security Checks Summary` aggregates the fail

Read the thread · 2026-05-09 · closed · 1 comment

get_otc_doc_section: section="" silently treated as 'no filter'

Severity: LOW — falsy-empty anti-pattern

Reproduce

get_otc_doc_section(url=<valid_page>, section="")
→ all sections returned (same as section=None)

tools/docs.py:233: if section: is falsy on "", so an empty string is silently equivalent to omitting the parameter. A caller that builds the call dynamically and accidentally passes section="" won't see a "no match" — they'll get the entire page.

Expected

Either reject empty string (ValueError) or document the equival

Read the thread · 2026-05-09 · closed · 1 comment

get_otc_doc_section: 'page exists, section missing' is indistinguishable from 'page not found'

Severity: MEDIUM — UX/correctness

Reproduce

# Page does not exist
get_otc_doc_section(url="https://docs.otc.t-systems.com/nonexistent/page.html")
→ {matched: false, sections: [], title: "", service: "", ...}

# Page exists, section filter does not match
get_otc_doc_section(
    url="https://docs.otc.t-systems.com/elastic-cloud-server/umn/service_overview/permissions.html",
    section="this-section-does-not-exist"
)
→ {matched: false, sections: [], title: "", service: "", ...}

Read the thread · 2026-05-09 · closed · 1 comment

search_otc_docs: unknown 'service' filter silently returns []

Severity: MEDIUM — silent-empty anti-pattern (sister of #6, #35)

Reproduce

search_otc_docs(query="VPC", service="nonexistent-service-xyz")
→ {hits: [], total_hits: 0, isError: false}

A typo'd service name returns empty results indistinguishable from a service that exists but has no matches.

Expected

Validate service against the set of services actually indexed (already discoverable: SELECT DISTINCT service FROM docs). Unknown service → ValueError listing valid servic

Read the thread · 2026-05-09 · closed · 1 comment

search_otc_docs: top_k silently clamped (0/-5 → 1, 999 → 50, no warning)

Severity: MEDIUM — silent-clamp anti-pattern (sister of #33)

Reproduce

search_otc_docs(query="VPC", top_k=0)   → returns 1 hit, isError=false
search_otc_docs(query="VPC", top_k=-5)  → returns 1 hit, isError=false
search_otc_docs(query="VPC", top_k=999) → returns 50 hits, isError=false

Root cause

tools/docs.py:138: top_k = max(1, min(50, int(top_k))) clamps without surfacing the change. Caller has no signal that their requested cap was changed.

Expected

`top_k <=

Read the thread · 2026-05-09 · closed · 1 comment

search_otc_docs: empty / whitespace-only query silently returns 0 hits

Severity: HIGH — silent-zero anti-pattern (same family as #4, #6, #31, #33)

Reproduce

search_otc_docs(query="")    → {hits: [], total_hits: 0, isError: false}
search_otc_docs(query="   ") → {hits: [], total_hits: 0, isError: false}

A caller (LLM or human) typoing into an empty string gets no signal that the query was rejected.

Root cause

tools/docs.py:_escape_match returns the empty FTS5 phrase '""' for empty input; the FTS5 syntax-error path then collapses to `rows =

Read the thread · 2026-05-09 · closed · 1 comment

Most recent

[Security Alert] Vulnerabilities detected in nightly scan

⚠️ Security vulnerabilities detected in the nightly security scan

Details

Workflow Run: View Results
Branch: main
Triggered: Nightly security scan
Time: 2026-08-31T08:24:53.992Z

Failed Checks

❌ Container Scan (Trivy)

Please review the workflow results for detailed vulnerability information.

*This issue was auto

Read the thread · 2026-08-17 · open · external user · 0 comments

query_pricing misses memory-optimized ECS (m4/m7n/m9) — v2 API / serviceName=memo not supported

Summary

query_pricing(services=['ecs'], region='eu-de') returns only general-purpose flavors (s2/s3/s7n/s9, RAM ratios .1/.2/.4). Memory-optimized ECS (m4/m7n/m9, ratio .8) is missing — it lives in a separate API endpoint that the MCP does not query.

Root cause

The MCP queries the v1 API (/en/open-telekom-price-api/) with serviceName=ecs. Memory-optimized flavors are only exposed via the v2 API (/en/open-telekom-price-api/v2/) with serviceName=memo.

Direct e

Read the thread · 2026-07-14 · closed · 0 comments

[Security Alert] Vulnerabilities detected in nightly scan

⚠️ Security vulnerabilities detected in the nightly security scan

Details

Workflow Run: View Results
Branch: main
Triggered: Nightly security scan
Time: 2026-08-04T05:19:08.084Z

Failed Checks

❌ Dependency Audit (pip-audit)
❌ Container Scan (Trivy)

Please review the workflow results for detailed vulnerability infor

Read the thread · 2026-05-17 · closed · external user · 0 comments

Ghost eu-ch2 rows in default catalog: misreport CHF prices as EUR

Problem

The default OTC price-calculator catalog (client=1, public T-Cloud) contains 75 entries whose region == "eu-ch2" but currency == "EUR" — these are NOT real Swiss prices. The actual Swiss CHF prices live in client=2 (resolved correctly by #50 / #51 when the caller supplies region="eu-ch2").

Consequence: a caller that queries a service without a region filter today gets a silently misleading mix:

# After PR #51, this works correctly (uses client=2):
query_pricing(

[Read the thread](https://github.com/seaser0/otc-pricing-mcp/issues/52) · 2026-05-12 · closed · 0 comments

### find_compute_flavor: response truncation when broad filters return many flavors + tighten tool description

## Summary
Broad `find_compute_flavor` queries (e.g. "GPU=true, region=eu-de") return so many full-detail flavor entries that the response exceeds the MCP tool-output limit on the consumer side. The result has to be greppe'd from the raw payload instead of read directly.

## Reproduction
Asking Claude to "find OTC ECS flavors with a single A100 GPU" caused `find_compute_flavor` to return enough flavors that the assistant logged:

> OTC-Antwort war zu groß — gegrept aus der Datei.

This happened 

[Read the thread](https://github.com/seaser0/otc-pricing-mcp/issues/49) · 2026-05-10 · closed · 0 comments

### get_otc_doc_section: URL LIKE-prefix matches ALL sections on empty/wildcard input, returns 3.5MB Frankenstein response

**Severity: HIGH** — correctness + token-DoS + LIKE-wildcard injection

## Reproduce (live MCP, 2026-05-09)

get_otc_doc_section(url="") → sections=4714, 3.5MB, isError=false get_otc_doc_section(url="%") → sections=4714, 3.5MB get_otc_doc_section(url="https://") → sections=4714, 3.5MB get_otc_doc_section(url="https://docs.otc.t-systems.com/_______________") → sections=4714, 3.5MB


## Root cause

`src/otc_pricing_mcp/tools/docs.py:231-232`:

```python
sql_parts = ["ur

[Read the thread](https://github.com/seaser0/otc-pricing-mcp/issues/40) · 2026-05-09 · closed · 0 comments

### get_service_schema returns the same generic catalog schema for every service

## Observation

Calling `get_service_schema` for `ecs`, `evs`, `obs` (and presumably others) returns **identical** column metadata — the upstream OTC API serves the union of all possible columns, not a per-service projection.

get_service_schema(ecs).columns == get_service_schema(evs).columns == get_service_schema(obs).columns == {"id": "ID", "productId": "Service ID", ..., "vCpu": "vCpu", "ram": "RAM", "storageType": "Storage type", "storageVolume": "Storage volume", "R12": "Reserve

Read the thread · 2026-05-08 · closed · 1 comment

estimate_monthly_cost accepts negative quantity, returns negative totals

Symptom

tools/call estimate_monthly_cost {"items":[{"id":"OTC_S3M1_LI","quantity":-1}]}

→ total_payg: -37.35775
  items[0].quantity: -1.0
  items[0].payg: -37.35775
isError: false

Negative quantity is accepted and produces a negative-cost "estimate". Same shape with very large quantities (999999 → ~37 M EUR, no upper sanity bound).

Why it matters

LLMs assemble these calls from natural language and sometimes mis-extract a number. Reporting "-€37" for a workload makes a budg

Read the thread · 2026-05-08 · closed · 1 comment

The remaining reports are on the project's issue tracker.

Reported issues for OTC Pricing MCP

Most discussed

eu-ch2 (Swiss OTC) coverage limitation: upstream Calculator API doesn't expose ECS/EVS/RDS/NAT/ELB/AOM — needs doc + optional patch hook

Summary

swiss-otc / eu-ch2 catalog unreachable: productType hardcoded to OTC; no SOTC variant accepted by upstream

Bug: swiss-otc / eu-ch2 catalog unreachable via MCP (productType hardcoded to OTC)

Symptom

security.yml pip-audit blocks every version bump (--strict + editable local project)

Symptom

get_otc_doc_section: section="" silently treated as 'no filter'

Reproduce

Expected

get_otc_doc_section: 'page exists, section missing' is indistinguishable from 'page not found'

Reproduce

search_otc_docs: unknown 'service' filter silently returns []

Reproduce

Expected

search_otc_docs: top_k silently clamped (0/-5 → 1, 999 → 50, no warning)

Reproduce

Root cause

Expected

search_otc_docs: empty / whitespace-only query silently returns 0 hits

Reproduce

Root cause

Most recent

[Security Alert] Vulnerabilities detected in nightly scan

Details

Failed Checks

query_pricing misses memory-optimized ECS (m4/m7n/m9) — v2 API / serviceName=memo not supported

Summary

Root cause

[Security Alert] Vulnerabilities detected in nightly scan

Details

Failed Checks

Ghost eu-ch2 rows in default catalog: misreport CHF prices as EUR

Problem

estimate_monthly_cost accepts negative quantity, returns negative totals

Symptom

Why it matters

Bug: swiss-otc / eu-ch2 catalog unreachable via MCP (productType hardcoded to `OTC`)