← Back to search

@akutishevsky/lunchmoney-mcp

akutishevsky Scanned 9d ago

Model Context Protocol server for LunchMoney personal finance management

C
67.3 / 100

Versions

2.1.1latest
May 31, 2026
2.1.0
May 19, 2026
2.0.1
Apr 30, 2026
2.0.0
Apr 15, 2026
1.4.3
Mar 20, 2026
+ show 10 moreshow less
1.4.2
Feb 18, 2026
1.4.1
Feb 17, 2026
1.4.0
Feb 15, 2026
1.3.0
Feb 15, 2026
1.2.0
Feb 15, 2026
1.1.1
Feb 15, 2026
1.1.0
Feb 15, 2026
1.0.2
Feb 15, 2026
1.0.1
Jul 27, 2025
1.0.0
Jul 27, 2025
PermissionsTool SafetyAuthAnnotationsCode QualityStabilitySpecVuln HistoryAuthorTransparencyCommunity

Tools 59

get_supported_cryptocurrencies
annotations: verified low

Get the list of cryptocurrencies supported for manual tracking. The `symbol` of an entry here is what must be passed to create_manual_crypto.

readOnlyHint true idempotentHint false
add_supported_cryptocurrency
annotations: mismatch low

Add a new cryptocurrency to the supported manual-crypto list by submitting its CoinGecko coin-page URL. Only needed when get_supported_cryptocurrencies does not already list the symbol you want to track.

readOnlyHint true idempotentHint false
get_all_manual_crypto
annotations: verified low

Get all manually-managed crypto balances associated with the user.

readOnlyHint true
get_single_manual_crypto
annotations: verified low

Get a single manually-managed crypto balance by ID. Call get_all_manual_crypto first to discover ids.

readOnlyHint true idempotentHint false
create_manual_crypto
annotations: verified low

Create a manually-managed crypto asset. The symbol must match one returned by get_supported_cryptocurrencies.

idempotentHint false
update_manual_crypto
annotations: verified low

Update a manually-managed crypto balance. At least one of name, display_name, institution_name, or balance must be supplied. The symbol of an existing balance cannot be changed.

idempotentHint true
delete_manual_crypto
annotations: mismatch low

Delete a manually-managed crypto asset. If the asset has balance history, keep_history must be set explicitly or the API rejects the request. Irreversible.

readOnlyHint true destructiveHint true
get_all_synced_crypto
annotations: verified low

Get all synced crypto accounts (Coinbase, Kraken, Ethereum wallets) and their nested per-symbol balances. Synced accounts are connected in the Lunch Money web app and cannot be created or edited through the API.

readOnlyHint true
get_single_synced_crypto
annotations: verified low

Get a single synced crypto account and all its nested balances by ID.

readOnlyHint true
get_synced_crypto_balance
annotations: verified low

Get a single balance held inside a synced crypto account, looked up by its cryptocurrency symbol.

readOnlyHint true openWorldHint true
refresh_synced_crypto
annotations: verified low

Trigger a balance refresh for a synced crypto account and return the refreshed account. Reaches out to the external crypto provider.

openWorldHint true
get_user
annotations: verified low

Get details on the current user

readOnlyHint true
get_all_manual_accounts
annotations: verified low

Get a list of all manually-managed accounts associated with the user. (Formerly known as `assets` in the v1 API.)

readOnlyHint true
get_single_manual_account
annotations: verified low

Get details of a single manual account by ID.

readOnlyHint true
create_manual_account
annotations: verified low

Create a new manually-managed account. (Formerly `create_asset`.)

idempotentHint false
update_manual_account
annotations: verified low

Update an existing manually-managed account. (Formerly `update_asset`.)

name string subtype string currency string closed_on string display_name string balance_as_of string institution_name string exclude_from_transactions boolean
idempotentHint true
delete_manual_account
annotations: verified low

Delete a manually-managed account. Optionally also delete its transactions/rules/recurring items, and/or its balance history. Both deletion options are irreversible.

destructiveHint true
get_all_tags
annotations: verified low

Get a list of all tags associated with the user's account.

readOnlyHint true idempotentHint false
get_single_tag
annotations: verified low

Get details of a single tag by ID.

readOnlyHint true idempotentHint false
create_tag
annotations: verified low

Create a new tag.

idempotentHint false
update_tag
annotations: verified low

Update properties for an existing tag.

name string archived boolean text_color string description string background_color string
idempotentHint true destructiveHint true
delete_tag
annotations: verified low

Delete a tag. By default fails (HTTP 422) with a structured `dependents` payload if the tag is in use by transactions or rules. Set force=true to delete and disassociate from those records.

destructiveHint true
get_all_plaid_accounts
annotations: verified low

Get a list of all Plaid (synced) accounts associated with the user.

readOnlyHint true
get_single_plaid_account
annotations: verified low

Get details of a single Plaid (synced) account by ID.

readOnlyHint true openWorldHint true
trigger_plaid_fetch
annotations: verified low

Trigger a fetch of latest data from Plaid. Optionally scope the fetch to a date range and/or a specific Plaid account ID. Note: Plaid enforces a minimum 60-second delay between fetch requests; fetching may take up to 5 minutes.

openWorldHint true
get_all_categories
annotations: verified low

Get a list of all categories associated with the user's account. Returns categories in alphabetical order.

readOnlyHint true
get_single_category
annotations: verified low

Get details on a single category or category group, including the list of children categories for category groups.

readOnlyHint true
create_category
annotations: verified low

Create a new category or a category group. Set is_group=true to create a category group; supply children as an array of existing category IDs and/or strings (names of new sub-categories to create).

idempotentHint false
update_category
annotations: verified low

Update properties for an existing category or category group. For category groups, supplying children replaces the group's full child list. Cannot be used to convert between category and category group.

archived boolean is_income boolean exclude_from_budget boolean exclude_from_totals boolean
idempotentHint true
delete_category
annotations: verified low

Delete a single category or category group. By default fails (HTTP 422) if dependencies exist, returning a structured `dependents` payload. Set force=true to delete and disassociate from all related budgets, transactions, recurring items, etc. Force delete is irreversible.

destructiveHint true
get_transactions
annotations: none low

Retrieve transactions, optionally filtered by date range, account, category, tag, recurring item, status, and more. Returns at most `limit` transactions (default 1000, max 2000); `has_more` is set on the response when more match the filters. Pending and split-parent / group-child transactions are excluded by default.

get_single_transaction
annotations: verified low

Get details of a specific transaction. The response always includes plaid_metadata, custom_metadata, files, and (for split or group parents) the children array — none of which are returned by default in get_transactions.

readOnlyHint true idempotentHint false
create_transactions
annotations: verified low

Insert one or more transactions (1-500 per call). Returns inserted transactions plus any skipped duplicates.

idempotentHint false
update_transaction
annotations: verified low

Update an existing transaction. Provide any subset of writable fields directly (the v2 API no longer wraps the body in a `transaction` envelope). Cannot modify split or grouped transactions; use the corresponding split/group tools instead.

idempotentHint true destructiveHint true
delete_transaction
annotations: verified low

Delete a single transaction. Fails for split/group transactions and their parents — unsplit/ungroup first. Irreversible.

idempotentHint true destructiveHint true
update_transactions_bulk
annotations: verified low

Update multiple transactions in a single call (1-500). Each entry must include `id` plus at least one writable field. Cannot be used to modify split or grouped transactions.

idempotentHint true destructiveHint true
delete_transactions_bulk
annotations: verified low

Bulk-delete transactions by ID (1-500). Fails if any ID is a split or group parent, or part of a split/group; unsplit or ungroup those first. Irreversible.

destructiveHint true
create_transaction_group
annotations: verified low

Create a transaction group from 2-500 existing transactions. Source transactions are hidden from get_transactions and accessible via the new group's `children` (set include_children=true on get_single_transaction). Cannot include split or recurring transactions.

notes string
idempotentHint false
delete_transaction_group
annotations: verified low

Delete (ungroup) a transaction group. The original child transactions remain and revert to normal ungrouped transactions.

idempotentHint false destructiveHint true
split_transaction
annotations: verified low

Split an existing transaction into 2-500 child transactions. The sum of child amounts must equal the parent's amount. After splitting, the parent is hidden from get_transactions and accessible via get_single_transaction (returns the parent with `children`).

idempotentHint false destructiveHint true
unsplit_transaction
annotations: verified low

Unsplit a previously split transaction by deleting its children and restoring the parent. Pass the parent (split_parent_id) — not a child — as the path id.

destructiveHint true
attach_file_to_transaction
annotations: verified low

Attach a local image or PDF receipt (max 10MB) to a transaction. Allowed types: image/jpeg, image/png, image/heic, image/heif, application/pdf. The file is read from the local filesystem of the host running this MCP server, and its type is determined from its actual contents — files that are not a real image or PDF are rejected. If LUNCHMONEY_ATTACHMENTS_DIR is set on the host, only files inside that directory can be attached.

idempotentHint false
get_transaction_attachment_url
annotations: mismatch low

Get a short-lived signed download URL for a transaction file attachment. The response includes the URL and an `expires_at` timestamp.

readOnlyHint true destructiveHint true
delete_transaction_attachment
annotations: verified low

Delete a transaction file attachment. Irreversible.

destructiveHint true
get_budget_summary
annotations: verified low

Get a summary of the user's budget for a specified date range. Returns per-category totals (other_activity, recurring_activity, budgeted, available, recurring_remaining, recurring_expected). Set include_occurrences=true for a per-period breakdown matching the account's budget periodicity. (Backed by the v2 GET /summary endpoint.)

readOnlyHint true
get_budget_settings
annotations: verified low

Get budget period and display settings for the account (granularity, period length, anchor date, hide-no-activity preference, income option, rollover-left-to-budget setting).

readOnlyHint true idempotentHint true
upsert_budget
annotations: verified low

Create or update a budget for a category and budget period. The start_date must be a valid budget period start for the account (see get_budget_settings).

idempotentHint true destructiveHint true
remove_budget
annotations: verified low

Remove the budget for a specific category and period. The request is idempotent — succeeds even if no budget exists for the period.

destructiveHint true
get_recurring_items
annotations: verified low

Retrieve a list of recurring items expected for a specified date range. The `matches` object on each item is populated based on the requested range.

readOnlyHint true
get_single_recurring_item
annotations: verified low

Retrieve a single recurring item by ID. Optional date range populates the `matches` object.

readOnlyHint true
get_balance_history
annotations: verified low

Get monthly account balance history across all accounts — the data behind the Net Worth views in the LunchMoney app. History is monthly. With no month range, returns all available history plus an ephemeral `current` entry for the current month, which is calculated on demand and may change between requests. Only months with data are included.

readOnlyHint true
get_account_balance_history
annotations: verified low

Get monthly balance history for a single account. Call get_all_manual_accounts, get_all_plaid_accounts, or get_all_manual_crypto first to discover ids. For synced crypto holdings use get_crypto_synced_balance_history instead.

readOnlyHint true idempotentHint true
upsert_account_balance_history
annotations: verified low

Create or update monthly balance history entries for a single account. Every month must be a past calendar month — the current month is calculated on demand and cannot be written. The request is all-or-nothing: if any entry fails validation, none are applied. The response contains only the entries submitted, not the account's full history.

idempotentHint true destructiveHint true
delete_account_balance_history
annotations: mismatch low

Delete ALL historical balance entries for a single account. This is irreversible and affects the Net Worth views. To remove a single month, use delete_balance_history_entry instead.

readOnlyHint true destructiveHint true
get_crypto_synced_balance_history
annotations: verified low

Get monthly balance history for a synced crypto holding, identified by its account id and ticker symbol. Synced crypto is scoped per symbol, so it is not available through get_account_balance_history.

readOnlyHint true idempotentHint true
upsert_crypto_synced_balance_history
annotations: verified low

Create or update monthly balance history entries for a synced crypto holding. Every month must be a past calendar month. If an entry sets `symbol`, it must match the symbol argument. The request is all-or-nothing.

idempotentHint true destructiveHint true
delete_crypto_synced_balance_history
annotations: verified low

Delete ALL historical balance entries for a synced crypto holding. This is irreversible and affects the Net Worth views.

destructiveHint true
delete_balance_history_entry
annotations: verified low

Delete a single historical balance entry by its id. The id must come from an entry with type=historical in a balance history response; ephemeral `current` entries have no id and cannot be deleted.

destructiveHint true
update_deleted_account_details
annotations: verified low

Update the display details shown for a deleted account in the Net Worth views. Applies to all historical entries for that deleted source. At least one field must be provided; pass null to clear a field.

idempotentHint true

Permissions 3

network medium
Server uses network capabilities via: fetch()
shell high
Server uses shell capabilities via: child_process
env_vars low
Server uses env_vars capabilities via: process.env

Scan Findings 133

info
Tool 'get_supported_cryptocurrencies' annotations are consistent annotation_checker · 80%
medium
Tool 'add_supported_cryptocurrency' claims readOnly but name implies write operation annotation_checker · 80%
info
Tool 'get_all_manual_crypto' annotations are consistent annotation_checker · 80%
info
Tool 'get_single_manual_crypto' annotations are consistent annotation_checker · 80%
info
Tool 'create_manual_crypto' annotations are consistent annotation_checker · 80%
info
Tool 'update_manual_crypto' annotations are consistent annotation_checker · 80%
high
Tool 'delete_manual_crypto' claims readOnly but name implies destructive operation annotation_checker · 80%
info
Tool 'get_all_synced_crypto' annotations are consistent annotation_checker · 80%
info
Tool 'get_single_synced_crypto' annotations are consistent annotation_checker · 80%
info
Tool 'get_synced_crypto_balance' annotations are consistent annotation_checker · 80%
info
Tool 'refresh_synced_crypto' annotations are consistent annotation_checker · 80%
info
Tool 'get_user' annotations are consistent annotation_checker · 80%
info
Tool 'get_all_manual_accounts' annotations are consistent annotation_checker · 80%
info
Tool 'get_single_manual_account' annotations are consistent annotation_checker · 80%
info
Tool 'create_manual_account' annotations are consistent annotation_checker · 80%
info
Tool 'update_manual_account' annotations are consistent annotation_checker · 80%
info
Tool 'delete_manual_account' annotations are consistent annotation_checker · 80%
info
Tool 'get_all_tags' annotations are consistent annotation_checker · 80%
info
Tool 'get_single_tag' annotations are consistent annotation_checker · 80%
info
Tool 'create_tag' annotations are consistent annotation_checker · 80%
info
Tool 'update_tag' annotations are consistent annotation_checker · 80%
info
Tool 'delete_tag' annotations are consistent annotation_checker · 80%
info
Tool 'get_all_plaid_accounts' annotations are consistent annotation_checker · 80%
info
Tool 'get_single_plaid_account' annotations are consistent annotation_checker · 80%
info
Tool 'trigger_plaid_fetch' annotations are consistent annotation_checker · 80%
info
Tool 'get_all_categories' annotations are consistent annotation_checker · 80%
info
Tool 'get_single_category' annotations are consistent annotation_checker · 80%
info
Tool 'create_category' annotations are consistent annotation_checker · 80%
info
Tool 'update_category' annotations are consistent annotation_checker · 80%
info
Tool 'delete_category' annotations are consistent annotation_checker · 80%
low
Tool 'get_transactions' has no annotations annotation_checker · 100%
info
Tool 'get_single_transaction' annotations are consistent annotation_checker · 80%
info
Tool 'create_transactions' annotations are consistent annotation_checker · 80%
info
Tool 'update_transaction' annotations are consistent annotation_checker · 80%
info
Tool 'delete_transaction' annotations are consistent annotation_checker · 80%
info
Tool 'update_transactions_bulk' annotations are consistent annotation_checker · 80%
info
Tool 'delete_transactions_bulk' annotations are consistent annotation_checker · 80%
info
Tool 'create_transaction_group' annotations are consistent annotation_checker · 80%
info
Tool 'delete_transaction_group' annotations are consistent annotation_checker · 80%
info
Tool 'split_transaction' annotations are consistent annotation_checker · 80%
info
Tool 'unsplit_transaction' annotations are consistent annotation_checker · 80%
info
Tool 'attach_file_to_transaction' annotations are consistent annotation_checker · 80%
medium
Tool 'get_transaction_attachment_url' claims destructive but name implies read-only operation annotation_checker · 80%
info
Tool 'delete_transaction_attachment' annotations are consistent annotation_checker · 80%
info
Tool 'get_budget_summary' annotations are consistent annotation_checker · 80%
info
Tool 'get_budget_settings' annotations are consistent annotation_checker · 80%
info
Tool 'upsert_budget' annotations are consistent annotation_checker · 80%
info
Tool 'remove_budget' annotations are consistent annotation_checker · 80%
info
Tool 'get_recurring_items' annotations are consistent annotation_checker · 80%
info
Tool 'get_single_recurring_item' annotations are consistent annotation_checker · 80%
info
Tool 'get_balance_history' annotations are consistent annotation_checker · 80%
info
Tool 'get_account_balance_history' annotations are consistent annotation_checker · 80%
info
Tool 'upsert_account_balance_history' annotations are consistent annotation_checker · 80%
high
Tool 'delete_account_balance_history' claims readOnly but name implies destructive operation annotation_checker · 80%
info
Tool 'get_crypto_synced_balance_history' annotations are consistent annotation_checker · 80%
info
Tool 'upsert_crypto_synced_balance_history' annotations are consistent annotation_checker · 80%
info
Tool 'delete_crypto_synced_balance_history' annotations are consistent annotation_checker · 80%
info
Tool 'delete_balance_history_entry' annotations are consistent annotation_checker · 80%
info
Tool 'update_deleted_account_details' annotations are consistent annotation_checker · 80%
info
Sandbox failed to start for behavioral verification behavioral_verifier · 100%
medium
Vulnerable dependency: @modelcontextprotocol/sdk@1.17.0 (GHSA-345p-7cg4-v4c7) dependency_analyzer · 95%
medium
Vulnerable dependency: @modelcontextprotocol/sdk@1.17.0 (GHSA-6qxp-vccf-f47h) dependency_analyzer · 95%
medium
Vulnerable dependency: @modelcontextprotocol/sdk@1.17.0 (GHSA-8r9q-7v3j-jr4g) dependency_analyzer · 95%
medium
Vulnerable dependency: @modelcontextprotocol/sdk@1.17.0 (GHSA-w48q-cv73-mx4w) dependency_analyzer · 95%
medium
Vulnerable dependency: @toon-format/toon@2.1.0 (GHSA-p95v-992w-h6c3) dependency_analyzer · 95%
info
package.json metadata manifest_parser · 100%
info
Tool: get_supported_cryptocurrencies manifest_parser · 85%
info
Tool: add_supported_cryptocurrency manifest_parser · 85%
info
Tool: get_all_manual_crypto manifest_parser · 85%
info
Tool: get_single_manual_crypto manifest_parser · 85%
info
Tool: create_manual_crypto manifest_parser · 85%
info
Tool: update_manual_crypto manifest_parser · 85%
info
Tool: delete_manual_crypto manifest_parser · 85%
info
Tool: get_all_synced_crypto manifest_parser · 85%
info
Tool: get_single_synced_crypto manifest_parser · 85%
info
Tool: get_synced_crypto_balance manifest_parser · 85%
info
Tool: refresh_synced_crypto manifest_parser · 85%
info
Tool: get_user manifest_parser · 85%
info
Tool: get_all_manual_accounts manifest_parser · 85%
info
Tool: get_single_manual_account manifest_parser · 85%
info
Tool: create_manual_account manifest_parser · 85%
info
Tool: update_manual_account manifest_parser · 85%
info
Tool: delete_manual_account manifest_parser · 85%
info
Tool: get_all_tags manifest_parser · 85%
info
Tool: get_single_tag manifest_parser · 85%
info
Tool: create_tag manifest_parser · 85%
info
Tool: update_tag manifest_parser · 85%
info
Tool: delete_tag manifest_parser · 85%
info
Tool: get_all_plaid_accounts manifest_parser · 85%
info
Tool: get_single_plaid_account manifest_parser · 85%
info
Tool: trigger_plaid_fetch manifest_parser · 85%
info
Tool: get_all_categories manifest_parser · 85%
info
Tool: get_single_category manifest_parser · 85%
info
Tool: create_category manifest_parser · 85%
info
Tool: update_category manifest_parser · 85%
info
Tool: delete_category manifest_parser · 85%
info
Tool: get_transactions manifest_parser · 85%
info
Tool: get_single_transaction manifest_parser · 85%
info
Tool: create_transactions manifest_parser · 85%
info
Tool: update_transaction manifest_parser · 85%
info
Tool: delete_transaction manifest_parser · 85%
info
Tool: update_transactions_bulk manifest_parser · 85%
info
Tool: delete_transactions_bulk manifest_parser · 85%
info
Tool: create_transaction_group manifest_parser · 85%
info
Tool: delete_transaction_group manifest_parser · 85%
info
Tool: split_transaction manifest_parser · 85%
info
Tool: unsplit_transaction manifest_parser · 85%
info
Tool: attach_file_to_transaction manifest_parser · 85%
info
Tool: get_transaction_attachment_url manifest_parser · 85%
info
Tool: delete_transaction_attachment manifest_parser · 85%
info
Tool: get_budget_summary manifest_parser · 85%
info
Tool: get_budget_settings manifest_parser · 85%
info
Tool: upsert_budget manifest_parser · 85%
info
Tool: remove_budget manifest_parser · 85%
info
Tool: get_recurring_items manifest_parser · 85%
info
Tool: get_single_recurring_item manifest_parser · 85%
info
Tool: get_balance_history manifest_parser · 85%
info
Tool: get_account_balance_history manifest_parser · 85%
info
Tool: upsert_account_balance_history manifest_parser · 85%
info
Tool: delete_account_balance_history manifest_parser · 85%
info
Tool: get_crypto_synced_balance_history manifest_parser · 85%
info
Tool: upsert_crypto_synced_balance_history manifest_parser · 85%
info
Tool: delete_crypto_synced_balance_history manifest_parser · 85%
info
Tool: delete_balance_history_entry manifest_parser · 85%
info
Tool: update_deleted_account_details manifest_parser · 85%
info
Transport: stdio manifest_parser · 90%
info
Required env vars (3) manifest_parser · 80%
info
Sandbox failed to start for output poisoning scan output_poisoning · 100%
medium
Permission: network access detected permission_analyzer · 70%
high
Permission: shell access detected permission_analyzer · 95%
low
Permission: env_vars access detected permission_analyzer · 90%
info
SBOM generated: 213 components sbom_generator · 100%
medium
No build provenance detected (SLSA L0) slsa_assessor · 90%