avenir-mcpSAFE
An unofficial MCP server for YNAB, built for agents: read-only by default, every change previewed, confirmed and undoable.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
[](https://api.ynab.com/#works-with-ynab-third-party) [](https://github.com/mathbeal/avenir-mcp/actions/workflows/ynab-terms.yml)
Self-checked on every change against YNAB's API terms of 2025-05-28 (naming, attribution, YNAB's own image, a personal token for its owner only, the hourly limit); a weekly job turns the badge red when YNAB changes its terms. Listed by YNAB in its Works with YNAB directory, among third-party apps. Not endorsed by YNAB.
Built and tested against YNAB's API v1.87.0. A weekly `YNAB API drift` check compares it with the live specification and fails when YNAB publishes a new version.
[](https://github.com/mathbeal/avenir-mcp/actions/workflows/quality.yml) [](https://github.com/mathbeal/avenir-mcp/actions/workflows/inspector.yml) [](https://avenir-mcp.pages.dev/avenir-mcp/)
[](https://pypi.org/project/avenir-mcp/) [](https://pypi.org/project/avenir-mcp/) [](https://avenir-mcp.pages.dev/avenir-mcp/project/development/#the-checks) [](https://avenir-mcp.pages.dev/avenir-mcp/project/development/#the-checks) [![docstring
8ef6ca8d122dOBSERVED · 2026-10-11Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add avenir-mcp --env YNAB_API_KEY=${YNAB_API_KEY} -- None avenir-mcp==0.6.0Exposed tools (25)
17 read · 7 write · 1 destructive. Blast radius: 1 tool can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.
| Tool | Risk | Description |
|---|---|---|
apply_categories | write | Assign categories to transactions, after the user confirms, and journal it for undo. |
approve_transactions | read | Mark transactions as approved, i.e. reviewed (clears YNAB |
create_category | write | Create a category in a group, after the user confirms. |
create_transactions | write | Create transactions on an account, e.g. ones the bank import missed, after the user confirms. |
find_recurring_charges | read | List the subscriptions and other charges paid every month, with their yearly cost. |
find_transactions | read | Find transactions by date, amount, account, category or payee, categorised or not. |
flag_transactions | destructive | Set or remove the coloured flag of transactions, after the user confirms. |
forecast_balance | write | Project the balance month by month and say when money would run out. |
get_age_of_money | read | YNAB |
get_budget_vs_actual | read | Share of each category |
get_category_balances | read | Budgeted, spent (activity) and available (balance) per category for a month. |
get_monthly_summary | read | A month at a glance: income, budgeted, spent, Ready to Assign, overspent categories. |
get_net_worth_trend | read | Assets, debts and net worth at the end of each month, to see debts go down. |
get_savings_rate | read | How much of the income was kept, month by month: income, spending, saved, rate. |
get_spending_trends | read | Spending per category, month by month, over the last N months. |
get_underfunded_targets | read | The categories whose target still needs money this month, the most urgent first. |
import_transactions | write | Import the latest transactions from the plan |
list_accounts | read | List the plan |
list_category_groups | read | List the category groups a new category can be created in. |
list_plans | read | List all YNAB plans accessible with the current API key; agents read _LIST_PLANS. |
list_scheduled_transactions | read | List the scheduled transactions due between two dates: bills, salary, transfers. |
reconcile_account | read | Compare an account with the balance your bank shows, then reconcile it. |
set_category_budget | write | Set the amount budgeted ( |
split_transaction | read | Split one transaction across categories, e.g. from a receipt, after the user confirms. |
update_category | write | Rename a category and/or move it to another group, after the user confirms. |
Trust audit
SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | PASS |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | WARN |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (1 observation(s))
- Network
- declared (5 observation(s))
- Shell
- none-observed
- Dependencies
- pinned
- Secrets in source
- none-found
Findings (15)
flag_transactions
.pre-commit-config.yaml
.snyk
["x/../../user", "b1/transactions/tx-9?", "..", "", "-flag", "b1 b2", "b1%2F..", "b1#frag"],
Er lauscht auf `http://127.0.0.1:8103/mcp` (Streamable HTTP). Richten Sie Ihren Client
claude mcp add --transport http avenir-mcp http://127.0.0.1:8103/mcp \
Escucha en `http://127.0.0.1:8103/mcp` (HTTP streamable). Apunte su cliente allí con el
claude mcp add --transport http avenir-mcp http://127.0.0.1:8103/mcp \
Il écoute sur `http://127.0.0.1:8103/mcp` (HTTP streamable). Dirigez-y votre client avec
config = json.loads(base64.b64decode(query["config"][0]))
curl -LsSf https://astral.sh/uv/install.sh | sh
curl -LsSf https://astral.sh/uv/install.sh | sh
curl -LsSf https://astral.sh/uv/install.sh | sh
curl -LsSf https://astral.sh/uv/install.sh | sh
curl -LsSf https://astral.sh/uv/install.sh | sh
Gates applied: no_behavioural_pass.
8ef6ca8d122dfull audit observations/trust-audit/mcp-server/mathbeal__avenir-mcp.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-11 | 8ef6ca8d122d | SAFE | B | 89 | first audit |
Questions
What is the avenir-mcp MCP server?
An unofficial MCP server for YNAB, built for agents: read-only by default, every change previewed, confirmed and undoable.
What tools does avenir-mcp expose?
25 in total: 17 read-only, 7 that write, and 1 that can delete or overwrite (flag_transactions). Every one is listed on this page with its risk.
Is avenir-mcp safe to connect to an agent?
The audit found nothing in the source that contradicts what it says it does, and graded it B (89/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean server reads B. Separately from the audit: 1 of its tools can destroy data, so scope the token you give it to what you actually need.
What credentials does avenir-mcp need?
It reads AVENIR_EVAL_API_KEY, AVENIR_EVAL_API_KEY_FILE, AVENIR_MCP_HTTP_TOKEN, YNAB_API_KEY and YNAB_API_KEY_FILE from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does avenir-mcp run?
It speaks stdio and streamable-http, so it runs as a local process your client starts. It is published on npm as avenir-mcp-docs at 0.6.0.
How current is this page?
The grade is for one exact copy of the source (8ef6ca8d122d), read on 2026-10-11. The repository is watched and re-audited when it changes.