io.github.theluckystrike/cashflow

Est-ce que io.github.theluckystrike/cashflow est sûr ?

Au dernier audit MCP Hub, le serveur MCP « io.github.theluckystrike/cashflow » est classé « Non encore testé ». Référencé dans l'annuaire. Seul le pentest comportemental fait foi, et il n'a pas encore été exécuté sur ce serveur. Le verdict est réévalué en continu ; consultez la fiche pour l'état à jour.

Méthode : MCP Hub analyse la description de chaque outil (couche 1) et, pour le verdict fort, exécute le serveur dans une micro-VM isolée avec leurres et réseau bloqué (couche 2). On publie des noms et des compteurs, jamais le contenu brut renvoyé par un outil.

Les 15 outils

• accounts_list≈ 126 tokens

  List the imported accounts: bank, currencies, transaction count, first and last date, and the closing balance when the file carried one. Start here for the account names transactions_list and statement_export take.

  Paramètres, retour & exemple (0)

  Exemple d'appel

  {"name": "accounts_list", "arguments": {}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• bank_delete_upload≈ 115 tokens

  Delete one statement file stored for your token. The transactions already imported from it are kept; transactions_list and the summary still see them.

  Paramètres, retour & exemple (1)

  Paramètres

  • name · string · requis

  Exemple d'appel

  {"name": "bank_delete_upload", "arguments": {"name": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• bank_files≈ 62 tokens

  List the statement files stored for your token, with their sizes.

  Paramètres, retour & exemple (0)

  Exemple d'appel

  {"name": "bank_files", "arguments": {}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• bank_upload≈ 429 tokens

  Send a bank export to this hosted endpoint. There is no filesystem here, so instead of a path you upload the file once with bank_upload and then pass its name as `path` to statement_import. Give exactly one of content (the export as text, header row included - this is the normal case for a CSV), content_base64 (the file's bytes, which keeps a UTF-16 export from Excel readable) or url. url: fetch a public file instead of pasting base64 (recommended above about 10 KB): the url is fetched here with a 10 second timeout, at most 3 redirects, public http(s) hosts only, and a 1 MB cap; the fetched file has to be delimited text, so a PDF statement is refused rather than stored. Uploads are kept for your token between calls; bank_files lists them and bank_delete_upload removes one. The request body cap is 256 KB, so a large export pasted as text has to be split by month.

  Paramètres, retour & exemple (4)

  Paramètres

  • url · string · optionnel
    url: fetch a public file instead of pasting base64 (recommended above about 10 KB). Public http(s) only; private, link-local and this endpoint's own zone are refused
  • name · string · requis
    Name to refer to this statement by: 1-64 characters of letters, digits, underscore or dash, e.g. "september"
  • content · string · optionnel
    The export as text, including the header row
  • content_base64 · string · optionnel
    The file's bytes, base64-encoded, instead of text

  Exemple d'appel

  {"name": "bank_upload", "arguments": {"name": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• category_rules≈ 339 tokens

  Read the category rules, or pass rules to REPLACE the whole list. A plain match is a substring; a regex compiles only if it cannot backtrack exponentially. An empty match is refused. Free: 5 rules.

  Paramètres, retour & exemple (2)

  Paramètres

  • rules · array · optionnel
    The complete rule list; it replaces the stored one. Omit to list the current rules
  • reapply_all · boolean · optionnel
    Also overwrite categories set by an earlier rule or by hand. Default false: only uncategorised transactions are touched

  Exemple d'appel

  {"name": "category_rules", "arguments": {"rules": [], "reapply_all": true}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• license_activate≈ 167 tokens

  Turn Pro on for this connection with key, an MCPL1.<payload>.<signature> issued at checkout for this server or the bundle. Data under your token stays; a wrong or expired key changes nothing. license_status confirms it.

  Paramètres, retour & exemple (1)

  Paramètres

  • key · string · requis
    License key from checkout, MCPL1.<payload>.<signature>

  Exemple d'appel

  {"name": "license_activate", "arguments": {"key": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• license_status≈ 125 tokens

  Report this endpoint's licence state for your token as JSON: the product, the tier free or pro, why it is not Pro, and the checkout URL. Call it to explain a free-tier refusal. No arguments, nothing changes.

  Paramètres, retour & exemple (0)

  Exemple d'appel

  {"name": "license_status", "arguments": {}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• reconcile_expenses≈ 266 tokens

  Match bank debits against mcp-expense-tracker entries: same currency and amount, date within a few days. Reports matches, unmatched bank lines, expenses never hitting the bank. Read-only. Free: 31 days; Pro: any range.

  Paramètres, retour & exemple (4)

  Paramètres

  • to · string · requis
    ISO date, inclusive
  • from · string · requis
    ISO date, inclusive
  • account · string · optionnel
    Limit to one bank account
  • window_days · integer · optionnel
    Allowed gap between the expense date and the bank date, default 3. A card payment usually settles a day or two after the receipt

  Exemple d'appel

  {"name": "reconcile_expenses", "arguments": {"to": "texte", "from": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• recurring_detect≈ 245 tokens

  Find charges that come back: debits grouped by counterparty and currency with a steady amount and interval, with cadence, typical amount, next due date and annual cost. Free: 3 months, 5 charges.

  Paramètres, retour & exemple (3)

  Paramètres

  • months · integer · optionnel
    How far back to look, default 3. Two occurrences are enough to see a cadence, three make it certain
  • account · string · optionnel
    Limit to one account
  • min_occurrences · integer · optionnel
    Occurrences required before a charge counts as recurring, default 2

  Exemple d'appel

  {"name": "recurring_detect", "arguments": {"months": 1, "account": "texte", "min_occurrences": 1}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• statement_export≈ 314 tokens

  Export the BANK transactions of a date range (a month, a quarter, a year) as .csv or .json and return a download link valid for one hour. This is the tool for "export September" once a statement has been imported. Nothing partial is ever written.

  Paramètres, retour & exemple (6)

  Paramètres

  • to · string · requis
    ISO date, inclusive
  • from · string · requis
    ISO date, inclusive
  • path · string · requis
    Name for the downloaded file, e.g. september. It comes back as a download link valid for one hour
  • format · string · requis · csv | json
    csv for a spreadsheet, json for a program
  • account · string · optionnel
    Limit to one account
  • category · string · optionnel
    Limit to one category

  Exemple d'appel

  {"name": "statement_export", "arguments": {"to": "texte", "from": "texte", "path": "texte", "format": "csv"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• statement_import≈ 393 tokens

  Call this tool to read a bank CSV into the local ledger. Columns detected from headers (date, description, amount, currency, balance); amounts use the file's locale; stored lines skipped. Returns detected/stored/skipped.

  Paramètres, retour & exemple (5)

  Paramètres

  • bank · string · optionnel · auto | revolut | wise | mbank | pko | ing | n26 | generic
    Bank profile. Default "auto": the headers decide. "generic" skips profile detection and uses the header heuristics alone
  • path · string · requis
    Name of a statement uploaded with bank_upload
  • account · string · optionnel
    Name for this account, e.g. "business EUR". Default: the file name without its extension. Later imports of the same account are deduplicated against it
  • currency · string · optionnel
    Currency for rows where the file names none. Defaults to the shared business profile's default_currency, else EUR; the response says which it used
  • overwrite · boolean · optionnel
    Delete every transaction already stored for this account before importing, instead of merging. Use it when the bank reissued a corrected export

  Exemple d'appel

  {"name": "statement_import", "arguments": {"path": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• statement_summary≈ 286 tokens

  What was spent/received in a date range per the BANK ACCOUNT, grouped by category, month, account or counterparty. For "what did I spend in August" once imported. Totals are per currency, never summed or converted.

  Paramètres, retour & exemple (5)

  Paramètres

  • to · string · optionnel
    ISO date, inclusive. Default: today
  • top · integer · optionnel
    Groups returned per currency, largest net first. Default 25
  • from · string · optionnel
    ISO date, inclusive. Default: the start of the current month
  • account · string · optionnel
    Limit the summary to one account
  • group_by · string · optionnel · category | month | account | counterparty
    Default category

  Exemple d'appel

  {"name": "statement_summary", "arguments": {"to": "texte", "top": 1, "from": "texte", "account": "texte", "group_by": "category"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• transaction_categorize≈ 219 tokens

  Set or clear the category on transactions by id, for a one-off no rule is worth writing for. Every id is checked first, so one unknown id refuses the whole call. category_rules matches by text instead.

  Paramètres, retour & exemple (2)

  Paramètres

  • ids · array · requis
    Transaction ids, as returned by transactions_list or transactions_search
  • category · string · requis
    Category to set. Pass an empty string to clear it

  Exemple d'appel

  {"name": "transaction_categorize", "arguments": {"ids": [], "category": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• transactions_list≈ 304 tokens

  List stored transactions in a date range, optionally for one account or category, or only the ones no rule has categorised yet. Totals are reported per currency and never added across currencies.

  Paramètres, retour & exemple (6)

  Paramètres

  • to · string · optionnel
    ISO date YYYY-MM-DD, inclusive. Default: today
  • from · string · optionnel
    ISO date YYYY-MM-DD, inclusive. Default: the start of the current month
  • limit · integer · optionnel
    Rows returned, default 200. Totals always cover the whole range
  • account · string · optionnel
    Limit to one account, as named at import
  • category · string · optionnel
    Only transactions in this category
  • uncategorized · boolean · optionnel
    Only transactions with no category yet

  Exemple d'appel

  {"name": "transactions_list", "arguments": {"to": "texte", "from": "texte", "limit": 1, "account": "texte", "category": "texte", "uncategorized": true}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• transactions_search≈ 232 tokens

  Find transactions whose description, counterparty, category or account contains the query. Case-insensitive substring search, never a regex, so a query with brackets in it cannot hang the server.

  Paramètres, retour & exemple (4)

  Paramètres

  • to · string · optionnel
    ISO date, inclusive
  • from · string · optionnel
    ISO date, inclusive
  • limit · integer · optionnel
    Rows returned, default 100
  • query · string · requis
    Text to look for, e.g. "spotify" or "acme"

  Exemple d'appel

  {"name": "transactions_search", "arguments": {"query": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

C'est votre serveur ?

Revendiquez-le sur l'espace créateur (preuve GitHub, domaine ou npm) pour afficher le badge « propriétaire vérifié » et lancer un pentest comportemental à la demande afin d'obtenir le badge « Vérifié ».

Créer un compte / revendiquer →

Source

https://mcp.zovo.one/mcp/cashflow