Skills/npm/actual-mcp-server

actual-mcp-server@0.29.0

CAUTION· startup only

Publisher claims: "MCP server with 85 tools for AI-driven financial management with Actual Budget. HTTP and stdio transports for LibreChat, Claude Desktop, Cursor, VS Code, Gemini CLI" Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry npm (MCP server)Publisher agigante80 · publishing for 212 daysInstalls 6,480Last detonated 23 h ago
What would fix thisWatchDispute verdict

Coverage

Startup only; authenticated tool behavior not tested.
Tested
server startup over stdio (initialize sent) · every file read, file written and host contacted by what ran
Not tested
the tool list (the server exited before answering) · what the tools do when called with real credentials

What this means for the label: Caution here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.

Before you give it your token

It will ask for
ACTUAL_BUDGET_PASSWORDAUTH_PROVIDERMCP_ALLOW_UNAUTHENTICATEDMCP_SSE_AUTHORIZATIONMCP_STATIC_TOKENSMIN_TOKEN_LENGTHConfiguration, not credentials: ALLOW_INSECURE_UPSTREAM, BUDGET_DEFAULT_NAME, HTTP_PATH, LOG_FORMAT, MCP_BRIDGE_BIND_HOST, MCP_BRIDGE_DATA_DIR, MCP_BRIDGE_DEBUG_TRANSPORT, MCP_BRIDGE_HTTP_PATH, MCP_BRIDGE_LOG_DIR, MCP_BRIDGE_LOG_LEVEL, MCP_BRIDGE_MAX_FILES, MCP_BRIDGE_MAX_LOG_SIZE, MCP_BRIDGE_PORT, MCP_BRIDGE_PUBLIC_HOST, MCP_BRIDGE_PUBLIC_SCHEME, MCP_BRIDGE_ROTATE_DATEPATTERN, MCP_BRIDGE_STORE_LOGS, MCP_BRIDGE_USE_TLS, MCP_ENABLE_HTTPS, MCP_HTTP_PATH, MCP_HTTPS_CERT, MCP_HTTPS_KEY, MCP_SERVICE_NAME, MCP_STDIO_MODE, OIDC_ISSUER, USE_CONNECTION_POOL, VERSION
Where it talks to
actualbudget.org (its own)Also nas.lan — not the publisher's domain; check what for before connecting.
What the honeypot saw
no credential files read · no network
What we could not test
the tool list (the server exited before answering) · what the tools do when called with real credentials

Connect it with a scoped credential, under the guard, and read the third-party hosts first. The code names nas.lan as well as its own vendor. The guard injects ACTUAL_BUDGET_PASSWORD, AUTH_PROVIDER, MCP_ALLOW_UNAUTHENTICATED, MCP_SSE_AUTHORIZATION, MCP_STATIC_TOKENS, MIN_TOKEN_LENGTH only into requests to actualbudget.org (and its subdomains) and refuses the rest.

$vet-skills run --secrets ACTUAL_BUDGET_PASSWORD=actualbudget.org,AUTH_PROVIDER=actualbudget.org,MCP_ALLOW_UNAUTHENTICATED=actualbudget.org,MCP_SSE_AUTHORIZATION=actualbudget.org,MCP_STATIC_TOKENS=actualbudget.org,MIN_TOKEN_LENGTH=actualbudget.org -- npx -y actual-mcp-server

Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios; startup only; authenticated tool behavior not tested) on 2026-11-13 and scored it 74/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Access to sensitive file paths; Access to sensitive file paths; Access to sensitive file paths. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 42 s · 2 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
22sprocessdependency install exit 0
42sclaimedstartup only: exited (0) before answering · code: 'ERR_MODULE_NOT_FOUND', url: 'file:///tmp/ks-detonate-Vsm2v8/task/home/work/acme-api/.claude/skills/actual-mcp-server/dist/src/lib/node-version-guard.js' } Node.js v22.23.5
42sprocessscript backend runs setup only
42sprocessno install scripts to re-run

Static findings

MEDIUM
npx invocation of non-well-known packagepackage.json:36 · npx invocation of non-well-known package — may execute untrusted code"test:e2e": "npx playwright test",Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Access to sensitive file pathsdist/src/lib/config-registry.js:67 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files* one. `.env.example` documents example members (BUDGET_1_*, BUDGET_2_*, ...); theFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsdist/src/index.js:125 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files// by behaviour), and path keeps the cwd-relative .envFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
MCP server using network transport (SSE/HTTP)dist/src/index.js:83 · MCP server using network transport (SSE/HTTP) — data sent over network' actual-mcp-server --http # HTTP server (LibreChat / LobeChat / multi-user)\n' +Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04
HIGH
Access to sensitive file pathsdist/src/lib/authPosture.js:45 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files* #611: example values shipped in our docs and .env.example. A token equal to oneFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsdist/src/lib/config-registry.js:32 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files{ name: 'MCP_STDIO_MODE', reason: 'mirrors the --stdio CLI flag, set in-process before the logger import; not a .env knob', readSite: 'logger.ts:345, index.ts', documented: false },Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
npx invocation of non-well-known packagebin/actual-mcp-server.js:2 · npx invocation of non-well-known package — may execute untrusted code// Entry point for npx actual-mcp-server. Delegates to the compiled dist.Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
MCP server using network transport (SSE/HTTP)dist/src/index.js:97 · MCP server using network transport (SSE/HTTP) — data sent over networkUsage: actual-mcp-server [--http | --stdio | --test-actual-connection] [--debug] [--help]Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04
LOW
Instructs the agent to modify its persistent memory or instruction filesdist/src/tools/rules_delete.js:20 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction file* for a future caller to reach for. See "Where a read-then-write guard belongs" in CLAUDE.md.Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
HIGH
Access to sensitive file pathsdist/src/lib/constants.js:70 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files* published image, .env.example, and every deployment guide.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
CRITICAL
HTML comment carrying imperative instructions to the agentREADME.md:32 · HTML comment carrying imperative instructions to the agentrunnable: env-tokenFix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST01
HIGH
Credential pass-through configurationdist/src/lib/budget-registry.js:30 · Credential pass-through configuration — agent relays sensitive credentials* (a reverse-proxy credential), path and query are dropped. Never throws; an unparseable URLFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST02
HIGH
Access to sensitive file pathsdist/src/config.js:488 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files`Set them in a .env file in the current directory, or export them before running.\n` +Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsdist/src/lib/config-registry.js:89 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files* (.env.example and docs/reference/configuration.md): every schema key, plus every allowlistFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
CRITICAL
HTML comment carrying imperative instructions to the agentREADME.md:105 · HTML comment carrying imperative instructions to the agentGenerated from dist/src/lib/toolsets.js by `npm run docs:gen`. Do not edit.Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST01
HIGH
Access to sensitive file pathsdist/src/config.js:396 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files// Anyone who followed that advice has `sub` pinned in their .env, where it wouldFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
CRITICAL
HTML comment carrying imperative instructions to the agentREADME.md:52 · HTML comment carrying imperative instructions to the agentrunnable: docker-runFix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST01
HIGH
Access to sensitive file pathsdist/src/index.js:133 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filespath: path.resolve(process.cwd(), '.env'),Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
LOW
Instructs the agent to modify its persistent memory or instruction filesdist/src/lib/actual-adapter.js:2930 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction file* tool had already fixed. See "Where a read-then-write guard belongs" in CLAUDE.md.Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01

Cost to the agent

Instructions loaded
≈80 tok
1 file · 81 in bundle
Tool list per prompt
≈0 tok
0 tools · 0 per tool
Handshake
no reply
launch to tools/list, stdio
Undocumented tools
0
description under 20 chars · avg 0

Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.

Known vulnerabilities

No advisories in OSV for actual-mcp-server@0.29.0 as of 22 h ago. This is the package itself, not its dependencies.

What would make this Verified

6 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Unclaimed publisher≈ +8 on the totalClaim agigante80: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  2. Hidden instructions≈ +6 on the totalRemove HTML comments, zero-width characters and white-on-white text that carry instructions. Everything the agent is meant to read should be visible to the person reading the file.
  3. Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  4. Credential pass-through configuration≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  5. npx invocation of non-well-known package≈ +2 on the totalPin versions and sources; vendor anything fetched at install time.
  6. MCP server using network transport (SSE/HTTP)≈ +2 on the totalNamespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
Publish a new version to npm, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim agigante80Propose a patch to the maintainer