← Back to search

creditkarma-mcp

GitHub Actions Scanned 2d ago

MCP server for Credit Karma — natural-language access to your transactions, spending, and accounts

? Not scanned yet

Versions

2.3.2latest
Jul 30, 2026
2.3.0
Jul 13, 2026
2.2.5
Jul 7, 2026
2.2.4
Jun 15, 2026
2.2.3
Jun 13, 2026
+ show 23 moreshow less
2.2.2
Jun 4, 2026
2.2.1
May 29, 2026
2.2.0
May 28, 2026
2.1.4
May 26, 2026
2.0.10
May 21, 2026
2.0.9
May 20, 2026
2.0.8
May 20, 2026
2.0.7
May 16, 2026
2.0.6
May 16, 2026
2.0.5
May 16, 2026
2.0.4
May 4, 2026
2.0.3
Apr 14, 2026
2.0.2
Apr 14, 2026
2.0.1
Apr 12, 2026
2.0.0
Apr 3, 2026
1.2.1
Mar 25, 2026
1.2.0
Mar 24, 2026
1.1.0
Mar 21, 2026
1.0.5
Mar 18, 2026
1.0.3
Mar 18, 2026
1.0.2
Mar 18, 2026
1.0.1
Mar 18, 2026
1.0.0
Mar 18, 2026

Tools 10

ck_list_transactions
annotations: verified low

List transactions with optional filters. Paginated.

readOnlyHint true openWorldHint false
ck_get_recent_transactions
annotations: verified low

Return the N most recent transactions. Convenience shortcut for ck_list_transactions.

readOnlyHint true openWorldHint false
ck_get_spending_by_category
annotations: verified low

Group debit transactions by category and return totals.

readOnlyHint true openWorldHint false
ck_get_spending_by_merchant
annotations: verified low

Return top merchants by total debit spend.

readOnlyHint true openWorldHint false
ck_get_account_summary
annotations: verified low

Return per-account debit, credit, and net totals.

readOnlyHint true openWorldHint false
ck_set_session
annotations: verified low

Store a Credit Karma session to enable automatic token refresh. Pass the full Cookie header from a signed-in creditkarma.com request (Chrome DevTools \u2192 Network \u2192 any creditkarma.com request \u2192 Request Headers \u2192 right-click the `cookie` header \u2192 Copy value). For most users the easier onboarding path is to install the ContextMint Bridge extension and sign into creditkarma.com \u2014 the MCP reads the cookies automatically.

readOnlyHint false openWorldHint false idempotentHint true destructiveHint false
ck_forget_session
annotations: verified low

Forget the Credit Karma session on this machine: delete the saved-session file (~/.creditkarma-mcp/session, or

readOnlyHint false openWorldHint false idempotentHint true destructiveHint true
ck_get_account_balances
annotations: verified low

Current balance of every account: institution, type, last 4, current balance, available

readOnlyHint false openWorldHint true idempotentHint true destructiveHint false
ck_query_sql
annotations: verified low

Execute a raw SQL SELECT query (CTEs via WITH ... SELECT are supported) against the transactions database.

readOnlyHint true openWorldHint false
ck_sync_transactions
annotations: verified low

Sync Credit Karma transactions into the local SQLite database, then refresh account

readOnlyHint false openWorldHint true idempotentHint true destructiveHint false

Permissions 4

network medium
Server uses network capabilities via: fetch()
filesystem low
Server uses filesystem capabilities via: fs
shell high
Server uses shell capabilities via: child_process, spawn()
env_vars low
Server uses env_vars capabilities via: process.env

Scan Findings 39

info
Tool 'ck_list_transactions' annotations are consistent annotation_checker · 80%
info
Tool 'ck_get_recent_transactions' annotations are consistent annotation_checker · 80%
info
Tool 'ck_get_spending_by_category' annotations are consistent annotation_checker · 80%
info
Tool 'ck_get_spending_by_merchant' annotations are consistent annotation_checker · 80%
info
Tool 'ck_get_account_summary' annotations are consistent annotation_checker · 80%
info
Tool 'ck_set_session' annotations are consistent annotation_checker · 80%
info
Tool 'ck_forget_session' annotations are consistent annotation_checker · 80%
info
Tool 'ck_get_account_balances' annotations are consistent annotation_checker · 80%
info
Tool 'ck_query_sql' annotations are consistent annotation_checker · 80%
info
Tool 'ck_sync_transactions' annotations are consistent annotation_checker · 80%
info
Sandbox failed to start for behavioral verification behavioral_verifier · 100%
medium
Vulnerable dependency: esbuild@0.28.0 (GHSA-g7r4-m6w7-qqqr) dependency_analyzer · 95%
medium
Hex string literal (>50 chars) in chrischall-creditkarma-mcp-3211f3b/tests/no-query-found.test.ts:144 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in chrischall-creditkarma-mcp-3211f3b/tests/no-query-found.test.ts:154 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in chrischall-creditkarma-mcp-3211f3b/tests/queryHash.test.ts:22 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in chrischall-creditkarma-mcp-3211f3b/tests/queryHash.test.ts:23 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in chrischall-creditkarma-mcp-3211f3b/src/client.ts:74 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in chrischall-creditkarma-mcp-3211f3b/src/client.ts:114 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in chrischall-creditkarma-mcp-3211f3b/src/client.ts:122 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in chrischall-creditkarma-mcp-3211f3b/src/client.ts:130 entropy_analyzer · 70%
info
package.json metadata manifest_parser · 100%
info
Tool: ck_list_transactions manifest_parser · 85%
info
Tool: ck_get_recent_transactions manifest_parser · 85%
info
Tool: ck_get_spending_by_category manifest_parser · 85%
info
Tool: ck_get_spending_by_merchant manifest_parser · 85%
info
Tool: ck_get_account_summary manifest_parser · 85%
info
Tool: ck_set_session manifest_parser · 85%
info
Tool: ck_forget_session manifest_parser · 85%
info
Tool: ck_get_account_balances manifest_parser · 85%
info
Tool: ck_query_sql manifest_parser · 85%
info
Tool: ck_sync_transactions manifest_parser · 85%
info
Required env vars (6) manifest_parser · 80%
info
Sandbox failed to start for output poisoning scan output_poisoning · 100%
medium
Permission: network access detected permission_analyzer · 70%
low
Permission: filesystem access detected permission_analyzer · 90%
high
Permission: shell access detected permission_analyzer · 95%
low
Permission: env_vars access detected permission_analyzer · 90%
info
SBOM generated: 143 components sbom_generator · 100%
medium
No build provenance detected (SLSA L0) slsa_assessor · 90%