Myfinance MCP Server

MyFinance MCP

A remote MCP server for personal finance, an AI expense tracker for Claude, ChatGPT, Codex and Cursor - log expenses by talking, snap receipt photos, import statements from any bank (CSV, PDF or a screenshot), and get budgets, trends and net worth computed for you, in 150+ currencies.

Website: myfinance-mcp.com · Free while in beta · Built by Rteam

Quick Start

Already hosted and ready to use - just connect it to your MCP client:

https://myfinance-mcp.com/mcp

On Claude: Customize → Connectors → + Add → Add custom connector → name it and paste the URL → Continue → Authentication: Sign in now (if the form asks for an OAuth client, keep Use Claude's published identity (Recommended); Register automatically works too) → Add. Never choose "Use your own OAuth client" or fill a Client ID/Secret - that breaks sign-in. Works on every Claude plan (Free allows one custom connector).

On ChatGPT (web): turn on Developer mode (Settings → Apps → Advanced settings), then Plugins → + → Add custom MCP server (older menu: Settings → Apps → Create) → paste the URL → OAuth, client ID/secret empty → create and sign in → type @ in a chat to use it. Per OpenAI's help center, custom MCP servers with write actions (needed for logging) are available on Business, Enterprise and Edu; Pro gets read-only access; the help center does not list Developer mode for Free, Go or Plus, so if you do not see it, use Codex.

On Cursor: Add to Cursor, or add "myfinance": { "url": "https://myfinance-mcp.com/mcp" } under mcpServers in ~/.cursor/mcp.json, then click Connect next to MyFinance in Customize.

On Codex (included in every ChatGPT plan, Free too):

codex mcp add myfinance --url https://myfinance-mcp.com/mcp
codex mcp login myfinance

On first connect you sign in with Google or with a one-time code sent to your email; that first sign-in creates your MyFinance account. Your data persists across reconnections. Step-by-step guides per client: myfinance-mcp.com/install.

Why

• No app, no forms, no spreadsheet. "Spent 24.50 eur on groceries at Lidl" is the whole workflow.
• Every number is computed in SQL. The server owns the data and the math; the AI reads the results, it never guesses arithmetic.
• 150+ currencies. Transactions keep their original currency (ECB and National Bank of Ukraine rates, plus a public daily snapshot for every other ISO currency from March 2024); the FX rate to your base currency is frozen at transaction date, so history never rewrites itself.
• Any bank, by statement. Drop a CSV/PDF export or a screenshot from your banking app; hundreds of rows import in one call with idempotent deduplication, hand-logged twins merged, totals reconciled. ZenMoney users can sync read-only instead.
• Personal vs business. Entity tag on accounts and transactions, filterable everywhere, included in CSV export for your accountant.
• Dashboards in the chat. Budgets, trends, summaries and accounts render as interactive panels (MCP Apps) right in the conversation.

Tech Stack

• Bun - runtime and package manager
• Express - HTTP layer
• MCP SDK - Model Context Protocol over Streamable HTTP (stateless)
• OAuth 2.1 - PKCE, dynamic client registration and client ID metadata documents (Claude's published identity); sign-in with Google or an emailed one-time code (each optional)
• Prisma + PostgreSQL - all money as numeric, all stats as SQL aggregates
• Docker - single container deployment

MCP Tools

Tools merged in 0.18.0 (ping, get_trends, delete_transaction, create_account, update_account, delete_account, merge_accounts, log_balance, export_profile, export_transactions, connect_zenmoney, sync_zenmoney, connect_bank, sync_bank) are no longer listed but still answer under their old names, so a client that kept an older tool list keeps working.

MCP Apps

Three tools return an interactive dashboard (ui://myfinancemcp/dashboard) rendered directly in the chat on clients that support MCP Apps: budget rings (get_budget_progress), category summaries and monthly trends (get_summary) and the accounts/net-worth panel (get_accounts). Light and dark theme aware.

Security & Privacy

• Receipt photos are parsed by YOUR AI client; images never reach this server.
• Amounts, merchants and notes are never written to server logs (blind logs); usage events keep tool names, timings, error classes and coded argument values, keyed to the account and deleted with it.
• OAuth 2.1 with PKCE, rotating refresh tokens (offline_access advertised), rate-limited sign-in.
• All 20 tools carry MCP annotations (read-only and destructive ops flagged, connector tools marked open-world), so clients can gate confirmations correctly.
• Bank access is strictly read-only: ZenMoney via the user's own API token, and, in the closed beta, open banking consent via Enable Banking (the bank authenticates the user; we never see credentials). Session ids and tokens are stored AES-256-GCM encrypted.
• CSV export and instant full deletion are tools, not support tickets.
• Hosted instance: EU data residency (Supabase, eu-central-1), TLS to the database with a pinned CA. Every query is scoped to your account by the server; the database's own API is closed to everyone (row-level security, deny-all).
• 401 automated end-to-end checks (full OAuth flow for public and confidential clients incl. browser binding and audience checks, every tool, import dedup semantics, GDPR deletion) run as a hard deploy gate; CI runs lint and typecheck on every push.

See SECURITY.md for the disclosure policy.

Self-hosting

MIT-licensed; runs anywhere Bun and Postgres run.

The landing page in site/ is set in Switzer, whose free licence does not allow redistribution, so the font file is not in this repository. For the same look, download it from Fontshare and put Switzer-Variable.woff2 in site/fonts/; without it the pages fall back to the system font. The MCP server does not need it.

1. Postgres

Any PostgreSQL 15+ works. Supabase free tier is a good fit: create a project and copy the session pooler connection string (IPv4).

Apply the schema, then close the tables to Supabase's public Data API (Prisma creates tables with row-level security OFF, and Supabase exposes every public table to anyone holding the project's anon key). Re-run the second command after every db push that adds a table:

bun install
bunx prisma db push
psql "$DATABASE_URL" -f prisma/rls.sql

Database TLS: Supabase hosts are verified against Supabase's root CA automatically; for any other host, put sslmode= in DATABASE_URL.

2. Environment variables

Generate the password hash:

bun -e "console.log(await Bun.password.hash(process.argv[1]))" 'your-password'

3. Run

cp .env.example app.env   # docker compose reads app.env, not .env
docker compose up -d      # uses the included Dockerfile, port 8788

Put nginx (or any TLS-terminating proxy) in front and point BASE_URL at your domain. The static landing in site/ is optional - serve it from the same origin if you want one.

Development

bun install
cp .env.example .env   # fill in your values
bun run dev            # hot reload on :8788
bun run e2e            # end-to-end suite (spawns its own server; WRITES to the DATABASE_URL database)
bun run lint

The e2e suite (359 checks) covers the full OAuth flow (discovery, dynamic registration, client ID metadata documents, PKCE, refresh rotation, revocation; public and confidential clients), every tool, statement-import dedup semantics, ZenMoney sync against a stubbed Diff API, and GDPR deletion.

API Endpoints

License

MIT - Rteam FZE LLC