Back to Home
trek-boldly-go icon

actual-budget-mcp-server

Verified Safe

by trek-boldly-go

Overview

A Model Context Protocol (MCP) HTTP server that exposes Actual Budget API functionality as streamable tools and resources for AI agents.

Installation

Run Command
ACTUAL_SERVER_URL=https://your-actual ACTUAL_PASSWORD=your-actual-password ACTUAL_SYNC_ID=your-sync-id npm run dev

Environment Variables

  • MCP_PORT
  • MCP_PUBLIC_URL
  • MCP_AUTH_MODE
  • MCP_BEARER_TOKEN
  • MCP_OAUTH_INTERNAL_ISSUER_URL
  • MCP_OAUTH_ISSUER_URL
  • MCP_OAUTH_PUBLIC_ISSUER_URL
  • MCP_OAUTH_CLIENT_ID
  • MCP_OAUTH_CLIENT_SECRET
  • MCP_OAUTH_INTROSPECTION_URL
  • MCP_OAUTH_AUDIENCE
  • MCP_OAUTH_DISCOVERY_RETRIES
  • MCP_OAUTH_DISCOVERY_RETRY_DELAY_MS
  • MCP_DANGEROUSLY_ALLOW_INSECURE_ISSUER_URL
  • ACTUAL_SERVER_URL
  • ACTUAL_PASSWORD
  • ACTUAL_SYNC_ID
  • ACTUAL_DATA_DIR
  • ACTUAL_ENCRYPTION_PASS
  • LOG_LEVEL

Security Notes

The server correctly uses environment variables for sensitive credentials (e.g., Actual API details, OAuth client secrets, bearer tokens). OAuth token introspection is implemented using standard methods. A `MCP_DANGEROUSLY_ALLOW_INSECURE_ISSUER_URL` flag exists to permit HTTP OAuth issuers, but it's explicitly marked for dev-only use and logs a warning. The primary security risks stem from misconfiguration (e.g., weak bearer tokens, disabling authentication, or using insecure OAuth settings in production) rather than inherent vulnerabilities in the provided source code. No 'eval' or obfuscation found. External dependencies (Actual server, Keycloak) security is critical but outside this scope.

Similar Servers

Stats

Interest Score33
Security Score8
Cost ClassLow
Avg Tokens500
Stars1
Forks0
Last Update2025-12-14

Tags

MCP ServerActual BudgetHTTP APIStreamingFinancial ManagementOAuth