
Security News
PHP Foundation Says Chainguard Broke Security Embargo Ahead of Emergency Patches
The PHP Foundation says Chainguard broke a security embargo ahead of critical RCE patches, as leaks disrupted the coordinated release.
greenpick
Advanced tools
Design-time sustainability co-pilot (MCP server): greener, cheaper cloud infrastructure decisions with carbon + cost + latency tradeoffs.
Write greener, cheaper cloud infrastructure — before you deploy.
A design-time sustainability co-pilot that runs as an MCP server inside your vibe-coding environment (Cursor / Claude Code / Kiro). Ask it where to deploy, when to run a job, or how to right-size — and it answers with an honest carbon + cost + latency tradeoff, in-editor, in seconds. (It responds when you ask; auto-nudging on infra-code changes is on the roadmap.)
Status: working — 15 tools. Live carbon for US (EIA-930) and EU (ENTSO-E), cross-cloud cost parity (Vantage-refreshed), per-axis R/Y/G ratings, carbon-aware scheduling + day-ahead forecast, GPU-training and LLM-inference carbon, right-sizing, serving-pattern and data-locality/residency checks — all shipped. Falls back to clearly-labelled mock data offline or without API keys.
The same 40-GPU-hour training run emits ~0.7 kg CO₂ in Stockholm vs ~19 kg in Sydney — a ~30× difference from region choice alone. Ask GreenPick and it surfaces that (with the cost and latency tradeoff) while you're still in the editor, before you commit.
▶ See the 5-minute demo — three scenarios with real tool output (training placement, the egress backfire, the forecast).
The same web service emits very different CO₂ depending on which region it runs in, because electricity grids differ in carbon intensity. Existing tools either rank regions in the abstract, or measure carbon after you deploy. GreenPick does it at the moment you choose, and tells you what the greener choice costs you in latency and dollars — so you can accept or reject it with eyes open.
The combination — cross-cloud, carbon + cost + latency, at design time, in the editor, with backfire guards — is the part nothing else puts together.
Roadmap: data-format/engine efficiency advice, sub-national grid zones, CI/CD integration.
See docs/user-questions-backlog.md.
15 tools, grouped by what you're trying to do.
| Tool | What it does |
|---|---|
compare_regions_tri_axis | Rank candidate regions by carbon with cost + latency tradeoffs; recommend a pick, each axis rated R/Y/G. Pass regions to rank only the ones you'd actually consider. |
greener_alternative_to | "You picked X — the greenest region within +N ms latency is Y (−Z% carbon, Δcost)." The core nudge. |
region_carbon_now | Current gCO₂/kWh for a region, with source + timestamp + freshness. |
| Tool | What it does |
|---|---|
cleanest_hours_to_run | Cleanest recent hours to time a deferrable job (ETL, backups, training), + % reduction. Pass window_hours for a job of known duration → cleanest contiguous window to start at. |
cleanest_time_of_day | For a recurring job (nightly batch): the region's cleanest time of day, averaged across recent days. A daily pattern, not a 7-day weekly one. |
carbon_forecast | Forward-looking: which upcoming hours will be cleanest, from the EU day-ahead wind+solar forecast (ENTSO-E). Relative ranking; US/uncovered zones degrade to the recent historical pattern. |
| Tool | What it does |
|---|---|
estimate_workload_carbon | Rough kgCO₂/month for a workload in a region (an estimate, not a measurement). |
estimate_training_carbon | Carbon of a GPU training run (TDP-based energy × live grid), with greener where (region ranking) + when (cleanest hours) — the two levers that compound for portable, deferrable training. |
estimate_inference_carbon | Energy + CO₂ of an LLM inference workload, by model size class × output tokens × requests (× live grid). A low–high band; smaller size class is the big lever. Self-hosted-friendly; not a named-model leaderboard. |
| Tool | What it does |
|---|---|
greener_instance_family | A greener same-size family in the same region via perf-per-watt (newer generation / ARM Graviton-class does the same work on less energy). |
rightsizing_check | Right-sizing (the #1 FinOps win) with a carbon twin: if you're over-provisioned, a smaller size cuts both cost and carbon → the right-sized target with monthly $ and kg CO₂ saving. |
data_locality_egress_check | Warn when running compute away from where your data lives backfires: directional egress $ + coarse transfer carbon, and whether a greener-region move is still a net win. |
serving_pattern_advice | For a user-facing platform: serve from one region or several? Traffic-weighted latency + carbon, with the multi-region data-sync egress and cross-jurisdiction residency catches. |
| Tool | What it does |
|---|---|
carbon_metric_scaffold | Emits paste-in instrumentation (Python) so your app reports its own estimated carbon over time — observable proxies × GreenPick's power model × live grid. Self-tracking, directional; not a runtime meter. |
explain_methodology_and_limits | The assumptions and what GreenPick explicitly does not claim. |
cleanest_hours_to_run from recent hourly history.quality: "mock" so nothing is
mistaken for a real reading. Used wherever a key is missing or a region isn't covered.data/pricing.json), refreshed from live Vantage
pricing via scripts/refresh_pricing.py using one matched method across all three clouds.data/instance_families.json).Set EIA_API_KEY and ENTSOE_TOKEN (both free) for live carbon — see
Turn on live data; GREENPICK_CARBON_SOURCE selects the source (auto routes
US→EIA, EU→ENTSO-E, else mock).
The data layer is a swappable repository (MOCK by default, works offline). Nothing here invents
numbers: the LLM writes the rationale, the code supplies the figures.
Directional, not audited. Region→grid-zone mapping is approximate. Carbon is point-in-time, not flow-traced consumption. Cost is a ballpark, not a quote. Latency is a geographic estimate. "Greener" assumes grid intensity dominates and ignores embodied/hardware carbon and provider RECs.
# Python 3.11+
pip install greenpick # from PyPI
python -m greenpick # run the MCP server (stdio)
Or from source, for development (editable install + tests):
git clone https://github.com/bithug01/greenpick.git
cd greenpick
pip install -e ".[dev]"
cp .env.example .env # defaults to mock data — works offline
python -m greenpick # run the MCP server (stdio)
pytest # run tests
Connect it to an MCP client (e.g. Kiro / Claude Code / Cursor) by pointing the client at
python -m greenpick in this directory. See .env.example for switching the data source.
GreenPick runs on labelled mock data until you give it two free keys:
EIA (US grid) and
ENTSO-E (EU grid). Pass them as environment variables.
(A .env file works for a source checkout; if you installed with pip install greenpick, use one
of the options below.)
In an MCP client (Kiro, Claude Desktop, Cursor…), add an env block to the server entry:
{
"mcpServers": {
"greenpick": {
"command": "python",
"args": ["-m", "greenpick"],
"env": {
"GREENPICK_CARBON_SOURCE": "auto",
"EIA_API_KEY": "your-eia-key",
"ENTSOE_TOKEN": "your-entsoe-token"
}
}
}
}
In a Jupyter notebook or Python script, set them before you start (or import) the server:
import os
os.environ["GREENPICK_CARBON_SOURCE"] = "auto"
os.environ["EIA_API_KEY"] = "your-eia-key"
os.environ["ENTSOE_TOKEN"] = "your-entsoe-token"
Every carbon figure includes a quality field: live means real grid data, mock means a
fallback value. Check it to confirm live data is on.
Do I need API keys? No — GreenPick runs on clearly-labelled mock data out of the box. For live
carbon, set two free keys (EIA_API_KEY for US, ENTSOE_TOKEN for EU) and
GREENPICK_CARBON_SOURCE=auto — see Turn on live data. Without them it still
works; it just says quality: "mock".
Why "directional" and not audited numbers? Because it's for a design-time decision, not a compliance report. "Stockholm is ~30× cleaner than Sydney" is what you need to pick a region in seconds — a certified figure is a different job for a different tool (Electricity Maps, WattTime). GreenPick is for decisions, not disclosures, and says so in every tool's limitations.
My cloud says this region is already 100% renewable — so does region even matter? That's market-based accounting (the provider matches usage with renewable certificates/PPAs over a year). GreenPick uses location-based accounting — the actual carbon intensity of the grid you physically draw from, hour to hour. Both are legitimate (the GHG Protocol asks for both), and they answer different questions: market-based is about procurement claims; location-based is about the real grid your workload leans on right now. GreenPick is deliberately location-based because that's what a placement/timing decision actually affects — you can't change the provider's annual REC portfolio, but you can choose a cleaner grid or a cleaner hour. We ignore RECs by design, not oversight.
What happens for a region with no live data? It falls back to the recent historical pattern or to mock, and labels which — it never presents a fallback as a live reading. Forecast likewise degrades to historical (labelled) where no day-ahead feed exists (e.g. US).
Can it rank Claude vs GPT vs Llama for carbon? No, by design. estimate_inference_carbon works by
model size class (self-hosted-friendly), not a named-model leaderboard — vendors don't disclose the
serving details that would make such a ranking honest.
How do I ask it something? You don't call tools directly — you talk to your MCP client in plain language ("where's the greenest region to run this?") and it invokes the right tool. See the demo for the kinds of questions that trigger each one.
Contributions of any kind are welcome — a bug report, a data-source correction, a sharper caveat, or code. See CONTRIBUTING.md for the short version. The one thing GreenPick asks: keep it honest and directional — no invented numbers, no precision the data can't back (that discipline is the whole point).
MIT — see LICENSE. © 2026 Data Science Advisers, LLC.
FAQs
Design-time sustainability co-pilot (MCP server): greener, cheaper cloud infrastructure decisions with carbon + cost + latency tradeoffs.
We found that greenpick demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
The PHP Foundation says Chainguard broke a security embargo ahead of critical RCE patches, as leaks disrupted the coordinated release.

Security News
PHP releases emergency patches for two critical RCE vulnerabilities as agencies urge organizations to take unpatched sites offline.

Threat Research
/Security News
A supply chain attack compromised LiteLLM 1.107.0 on PyPI and Docker, spreading malware that steals cloud credentials, developer secrets, and AI provider keys.