
Security News
Re-Enabled GitHub Actions Expose Thousands of Repositories to Mini Shai-Hulud
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.
@finology/mcp-server
Advanced tools
Deterministic 2026 federal student loan math for AI agents. RAP, IBR, ICR, PSLF payments, plan eligibility, and the married-filing-jointly vs separately trade-off, from Finology Software's parity-verified engine, so assistants stop guessing at federal rep
Language models guess at federal student loan rules. This doesn't.
@finology/mcp-server connects Claude, Cursor, or any MCP client directly to
Finology Software's parity-verified federal repayment engine. Every
number is computed server-side against current federal rules and returned with a
parityVerified flag. No formulas are approximated, and none are hardcoded into this package.
Federal repayment eligibility is not arithmetic, it is regulation, and it is the part models get wrong most confidently:
compare_federal_student_loan_repayment_plansCompares a balance across every plan the borrower is actually eligible for — RAP, IBR, ICR, PAYE, SAVE, Graduated, Extended, tiered Standard — returning monthly payment, lifetime cost, projected forgiveness and tax on forgiveness for each, plus the plans that are excluded and the eligibility rule that excludes them.
compare_married_filing_jointly_vs_separately_student_loansFor a married borrower, prices the filing-status decision. Filing separately removes the spouse's income from the income-driven payment calculation, which routinely moves the lifetime loan cost by tens of thousands of dollars.
It answers half the question on purpose, and says so. The engine models the loan side exactly and does not model the tax cost of filing separately — lost credits, worse brackets, community-property splits — which is often large enough to reverse the answer. Returning only the favourable half as if it were the whole decision would be the same confident half-truth this server exists to replace.
estimate_rap_monthly_paymentThe RAP monthly payment alone, for the common case. Requires the borrower's AGI and refuses to proceed without it — an assumed zero returns the $10/month RAP floor, which reads exactly like a real answer.
Claude Desktop — add to claude_desktop_config.json:
{
"mcpServers": {
"finology": {
"command": "npx",
"args": ["-y", "@finology/mcp-server"]
}
}
}
No API key. No account. The calculation endpoints are public.
Not here, deliberately: the RAP/OBBB formulas, income-driven payment math, forgiveness and tax-bomb projection, plan-eligibility rules, and NSLDS parsing. Those run on Finology's servers.
That is not only about protecting the engine. Federal repayment rules move every year — poverty guidelines, tax brackets, RAP/OBBB implementation guidance, court challenges. A formula copied into an npm package is wrong within months and cannot be corrected in the installs that already exist. Calling a maintained endpoint is the only shape of this tool that stays true.
Here: the input schemas, the HTTP call, and error handling that passes the API's own field-level messages through to the model instead of flattening them into "request failed."
These tools return figures. They do not produce client-facing deliverables, save borrower records, parse NSLDS files, or track PSLF qualifying payments over time. For those, and for a book of borrowers kept current as the rules change: finology.tech
Rate-limited per IP. Not financial advice.
MIT
FAQs
Deterministic 2026 federal student loan math for AI agents. RAP, IBR, ICR, PSLF payments, plan eligibility, and the married-filing-jointly vs separately trade-off, from Finology Software's parity-verified engine, so assistants stop guessing at federal rep
The npm package @finology/mcp-server receives a total of 67 weekly downloads. As such, @finology/mcp-server popularity was classified as not popular.
We found that @finology/mcp-server demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.

Research
/Security News
A malicious Firefox extension fetches its payload after installation to evade detection, steal Google session cookies, and automate account takeover.

Research
/Security News
The compromise affects MemTensor's MemOS, an open source memory framework for large language models (LLMs) and AI agents. Both npm package @memtensor/memos-cloud-openclaw-plugin and the PyPI package MemoryOS are compromised. They drop cross-platform Go binaries that exfiltrate developer secrets.