Skills/npm/lunchmoney-mcp

lunchmoney-mcp@4.0.1

VERIFIED

Publisher claims: "Model Context Protocol server for LunchMoney personal finance management" Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry npm (MCP server)Publisher akutishevsky · publishing for 475 daysInstalls 1,904Last detonated 5d ago
$claude mcp add lunchmoney-mcp -- npx -y @akutishevsky/lunchmoney-mcp
WatchReport an issue

Coverage

Started with a decoy LUNCHMONEY_API_TOKEN; tool list observed. Tool calls with a real credential not tested.
Tested
server startup with a tagged decoy in LUNCHMONEY_API_TOKEN · MCP initialize and tools/list · every tool description, for hidden instructions · where the decoy credential went · every file read, file written and host contacted by what ran
Not tested
what the tools do when called with a real credential
Needs
LUNCHMONEY_API_TOKEN — give it to the server where it runs, through vet-skills run --secrets, so the value never enters the server's environment. Never paste a credential into a chat, a ticket or a report.

Before you give it your token

It will ask for
LUNCHMONEY_API_TOKENConfiguration, not credentials: LUNCHMONEY_ATTACHMENTS_DIR, LUNCHMONEY_DEBUG
Where it talks to
no vendor host named in the codeAlso lunchmoney.app, lunchmoney.dev, coingecko.com — not the publisher's domain; check what for before connecting.
What the honeypot saw
no credential files read · no network
What we could not test
what the tools do when called with a real credential

Connect it with a scoped credential, under the guard, and read the third-party hosts first. The code names lunchmoney.app, lunchmoney.dev, coingecko.com as well as its own vendor. The guard injects LUNCHMONEY_API_TOKEN only into requests to the host you bind (and its subdomains) and refuses the rest.

$vet-skills run --net declared -- npx -y @akutishevsky/lunchmoney-mcp

Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios) on 2026-11-09 and scored it 84/100 (Verified). It did what it claims and nothing else we could detect: no undeclared network egress, no credential reads, no persistent instruction writes. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 50 s · 2 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
9.4sprocessdependency install exit 0
29sprocessrelaunched with a decoy LUNCHMONEY_API_TOKEN (tagged; nothing real)
49sclaimed65 tools with a decoy LUNCHMONEY_API_TOKEN: get_user, get_account_settings, update_account_settings, get_user_settings, update_user_settings, get_user_account_settings, update_user_account_settings, get_all_categories, get_single_category, create_category, update_category, delete_category, get_all_tags, get_single_tag, create_tag, update_tag, delete_tag, get_transactions, get_single_transaction, create_transactions, update_transaction, delete_transaction, update_transactions_bulk, delete_transactions_bulk, create_transaction_group
49sprocessscript backend runs setup only
49sprocessno install scripts to re-run

Static findings

HIGH
Collapsed <details> block carrying instructionsREADME.md:86 · Collapsed <details> block carrying instructions<summary><strong>Claude Code CLI</strong></summary> Add the LunchMoney MCP server to Claude Code: ```bash claude mcp add lunchmoney --transport stdio -e LUNCHMOFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
MEDIUM
File permission modification commandpackage.json:31 · File permission modification command — agent changes file ownership/permissions"build": "tsc && chmod 755 build/index.js",Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
HIGH
Collapsed <details> block carrying instructionsREADME.md:112 · Collapsed <details> block carrying instructions<summary><strong>Codex CLI</strong></summary> Add the LunchMoney MCP server to Codex: ```bash codex mcp add lunchmoney --env LUNCHMONEY_API_TOKEN=your-api-tokenFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
HIGH
Access to sensitive file pathsbuild/attachments.js:62 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files// credentials, `/etc/passwd` — do not contain this marker, so the widerFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05

Cost to the agent

Instructions loaded
≈58 tok
1 file · 44 in bundle
Tool list per prompt
≈21,296 tok
65 tools · 328 per tool
Handshake
1522 ms
launch to tools/list, stdio
Undocumented tools
1
description under 20 chars · avg 180

Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.

Known vulnerabilities

No advisories in OSV for @akutishevsky/lunchmoney-mcp@4.0.1 as of 5d ago. This is the package itself, not its dependencies.