# Copilot Money (npm · copilot-money-mcp)

Query and manage Copilot Money personal finances — local reads, opt-in GraphQL writes.

- Trust score: 64/100 (medium)
- Change this week: +56
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-03

> **Malware flagged**: A supply-chain scanner flagged a high-severity malware risk in this package. Treat it as unsafe to install until the finding is cleared.

## Components

- npm · `copilot-money-mcp`: 64/100 (this document), [markdown](https://verifymcp.io/servers/ignaciohermosillacornejo-copilot-money-mcp/copilot-money-mcp.md), [page](https://verifymcp.io/servers/ignaciohermosillacornejo-copilot-money-mcp/copilot-money-mcp)

## Channel facts

- Registry: `npm`
- Package: `copilot-money-mcp`
- Version: `2.3.0`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-03.

- **Supply Chain Security**: 43/100
  - Malware check failed: a supply-chain vendor flagged a high-severity malware risk.
  - Only part of the dependency tree could be resolved (108 of 112), so this covers what we could see, not the whole tree.
  - No install/post-install scripts declared.
  - Only part of the dependency tree could be resolved (108 of 112), so this covers what we could see, not the whole tree.
- **Provenance & Transparency**: 97/100
  - Source repository is publicly reachable at the declared URL.
  - Cryptographically verified build provenance (signed, bound to ignaciohermosillacornejo/copilot-money-mcp).
  - Clear OSI-approved license (MIT).
  - Actively maintained (last published 15 days ago).
  - Disclosure check failed: no security disclosure policy was found in the source repository.
- **Schema Quality & AI Usability**: 62/100
  - AI-judged instruction clarity (good).
  - Context-footprint check failed: tool/resource definitions use about 2885 tokens (~206/item across 14 items; 14 tools + 0 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 27/100
  - Stability observed for 8 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

## Install

### Claude

```bash
claude mcp add ignaciohermosillacornejo-copilot-money-mcp -- npx -y copilot-money-mcp
```

### Codex

```bash
codex mcp add ignaciohermosillacornejo-copilot-money-mcp -- npx -y copilot-money-mcp
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "ignaciohermosillacornejo-copilot-money-mcp": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "copilot-money-mcp"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add ignaciohermosillacornejo-copilot-money-mcp --command npx --arg -y --arg copilot-money-mcp
```

### Hermes

```yaml
mcp_servers:
  ignaciohermosillacornejo-copilot-money-mcp:
    command: "npx"
    args: ["-y", "copilot-money-mcp"]
```

### Other

```json
{
  "mcpServers": {
    "ignaciohermosillacornejo-copilot-money-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "copilot-money-mcp"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-03 (score 64, +1)

No change was recorded against any check on this day. Stability & Change Management went from 23 to 27. That category is still filling its 30-day observation window: 7 days of observed history at the previous scan, 8 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-08-02 (score 63, +45)

- [security regression] Malware scan: unverified → fail
- [security improvement] Known CVEs: unverified → partial
- [security improvement] Install scripts: unverified → pass
- [security improvement] Provenance: unverified → pass
- [security] The attested source repository moved: ignaciohermosillacornejo/copilot-money-mcp
- [functional regression] Security disclosure: fail → unverified
- [functional regression] Tool coverage: 100 → unverified
- [functional improvement] Schema quality: unverified → good
- [functional improvement] Stability: unverified → 0.23
- [functional improvement] MCP protocol: unverified → pass
- [functional improvement] Maintenance: unverified → pass
- [functional improvement] Dependency health: unverified → partial
- [functional improvement] License: unverified → pass
- [functional] Licence: MIT

### 2026-08-01 (score 18, +13)

- [functional improvement] Tool coverage: unverified → 100

### 2026-07-31 (score 5, −20)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-30 (score 25, −2)

- [security regression] Malware scan: fail → unverified
- [security improvement] Malware indicator gptMalware:Qnf7zr-42MEeHIdSagz9DbhdMCdqD9aVfUjv-bvYchxY cleared
- [security improvement] Malware indicator gptMalware:QDdJwghUApMVXSQlBXPOPDPlt8mnpKnJuqcaGbUeqfMA cleared

### 2026-07-28 (score 27, +19)

- [functional improvement] Tool coverage: unverified → 100
- [functional] First check of Schema quality: fail
- [functional] First check of Tool coverage: 100
- [functional] First check of Schema quality: unverified
- [functional] First check of Schema quality: fail

### 2026-07-27 (score 8)

First indexed and scored.

## MCP tools (14)

### `get_transactions` (~666 tokens)

Reads from the local LevelDB cache, which may lag behind Copilot's server if the macOS app hasn't synced recently. For real-time data use --live-reads with `get_transactions_live`. Unified transaction retrieval tool. Supports multiple modes: (1) Filter-based: Use period, date range, category, merchant, amount filters. (2) Single lookup: Provide transaction_id to get one transaction. (3) Text search: Use query for free-text merchant search. (4) Special types: Use transaction_type for foreign, refunds, credits, duplicates, hsa_eligible, tagged. (5) Location-based: Use city or lat/lon with radius_km. (6) Tag filter: Use tag to find transactions with a specific tag. Returns human-readable category names and normalized merchant names.

Input parameters:

- `account_id` (string): Filter by account ID
- `category` (string): Filter by category (case-insensitive substring)
- `city` (string): Filter by city name (partial match)
- `country` (string): Filter by country code (e.g., US, CL)
- `end_date` (string): End date (YYYY-MM-DD)
- `exclude_deleted` (boolean): Exclude deleted transactions marked by Plaid (default: true)
- `exclude_excluded` (boolean): Exclude user-excluded transactions (default: true)
- `exclude_split_parents` (boolean): Exclude split-transaction parents (docs with children_transaction_ids). The children already carry the real categorized amounts — returning the parent would double-count the spend. Default: true.
- `exclude_transfers` (boolean): Exclude transfers between accounts and credit card payments (default: true)
- `lat` (number): Latitude for proximity search (use with lon and radius_km)
- `limit` (integer): Maximum number of results (default: 100)
- `lon` (number): Longitude for proximity search (use with lat and radius_km)
- `max_amount` (number): Maximum transaction amount
- `merchant` (string): Filter by merchant name (case-insensitive substring)
- `min_amount` (number): Minimum transaction amount
- `offset` (integer): Number of results to skip for pagination (default: 0)
- `pending` (boolean): Filter by pending status (true for pending only, false for settled only)
- `period` (string): Period shorthand: this_month, last_month, last_7_days, last_30_days, last_90_days, ytd, this_year, last_year
- `query` (string): Free-text search in merchant/transaction names
- `radius_km` (number): Search radius in kilometers (default: 10)
- `region` (string): Filter by region/city (case-insensitive substring)
- `start_date` (string): Start date (YYYY-MM-DD)
- `tag` (string): Filter by tag name (e.g. "vacation")
- `transaction_id` (string): Get a single transaction by ID (ignores other filters)
- `transaction_type` (string): Filter by special type: foreign (international), refunds, credits (cashback/rewards), duplicates (potential duplicate transactions), hsa_eligible (medical expenses), tagged (has tags)

### `get_cache_info` (~86 tokens)

Get information about the local data cache, including the date range of cached transactions and total count. Useful for understanding data availability before running historical queries. This tool reads from a local cache that may not contain your complete transaction history. Also reports decode_health: per-collection counts of documents dropped on schema validation failure (a "degraded" status means some cached documents are missing from results).

### `refresh_database` (~71 tokens)

Refresh the in-memory cache by reloading data from the local Copilot Money database. Use this when the user has recently synced new transactions in the Copilot Money app, or when you suspect the cached data is stale. The cache also auto-refreshes every 5 minutes. Returns the updated cache info after refresh.

### `get_accounts` (~146 tokens)

Get all accounts with balances, plus summary fields: total_balance (net worth = assets minus liabilities), total_assets, and total_liabilities. Optionally filter by account type (checking, savings, credit, investment). Checks both account_type and subtype fields for better filtering (e.g., finds checking accounts even when account_type is 'depository'). By default, hidden accounts are excluded.

Input parameters:

- `account_type` (string): Filter by account type (checking, savings, credit, loan, investment, depository). Note: summary totals (total_assets, total_liabilities, total_balance) reflect only the filtered subset.
- `include_hidden` (boolean): Include hidden accounts (default: false)

### `get_connection_status` (~123 tokens)

Get connection status for all linked financial institutions. Shows per-institution sync health including last successful update timestamps for transactions and investments, login requirements, and error states. Use this to check when accounts were last synced or to identify connections needing attention. Also reports decode_health: per-collection counts of cached documents dropped on schema validation failure (a "degraded" status means some documents are missing from results). Also reports scheduled_smoke: the last scheduled API-drift check (pass / fail / auth-missing with timestamp), or null if the weekly job is not installed.

### `get_categories` (~238 tokens)

Unified category retrieval tool. Supports multiple views: list (default) - user categories with transaction counts/amounts for a time period; tree - user categories as hierarchical tree; search - search user categories by keyword. Use parent_id to get subcategories. For list view, use period (e.g., "this_month") or start_date/end_date to filter by date. Includes all categories, even those with $0 spent (matching UI behavior).

Input parameters:

- `end_date` (string): End date for list view (YYYY-MM-DD format)
- `parent_id` (string): Get subcategories of this parent category ID
- `period` (string): Time period for list view (e.g., 'this_month', 'last_month', 'last_30_days', 'this_year'). Takes precedence over start_date/end_date if provided.
- `query` (string): Search query (required for 'search' view)
- `start_date` (string): Start date for list view (YYYY-MM-DD format)
- `view` (string): View mode: list (categories with spend totals), tree (parent/child hierarchy), search (find by keyword)

### `get_recurring_transactions` (~295 tokens)

Identify recurring/subscription charges. Combines two data sources: (1) Pattern analysis - finds transactions from same merchant with similar amounts, returns estimated frequency, confidence score, and next expected date. (2) Copilot's native subscription tracking - returns user-confirmed subscriptions stored in the app. Both sources are included by default for comprehensive coverage.

Input parameters:

- `end_date` (string): End date (YYYY-MM-DD)
- `include_copilot_subscriptions` (boolean): Include Copilot's native subscription tracking data (default: true). Returns copilot_subscriptions array with user-confirmed subscriptions.
- `min_occurrences` (integer): Minimum number of occurrences to qualify as recurring (default: 2)
- `name` (string): Filter by name (case-insensitive partial match). When filtering, returns detailed view with additional fields like min_amount, max_amount, match_string, account info, and transaction history.
- `period` (string): Period to analyze (default: last_90_days). Options: this_month, last_month, last_7_days, last_30_days, last_90_days, ytd, this_year, last_year
- `recurring_id` (string): Filter by exact recurring ID. When filtering, returns detailed view with additional fields like min_amount, max_amount, match_string, account info, and transaction history.
- `start_date` (string): Start date (YYYY-MM-DD)

### `get_budgets` (~99 tokens)

Get budgets from Copilot's native budget tracking. Returns the current-month effective budget per category plus the full `amounts` map of per-month overrides for history lookups. For parent categories, the returned `amount` is the resolved total (children + rollovers) that Copilot displays in the Budgets view. Totals use the current-month effective amount.

Input parameters:

- `active_only` (boolean): Only return active budgets (default: false)

### `get_goals` (~128 tokens)

Get financial goals from Copilot's native goal tracking. Retrieves user-defined savings goals, debt payoff targets, and investment goals. Returns goal details including target amounts, monthly contributions, status (active/paused), start dates, and tracking configuration. Calculates total target amount across all goals. Cache-only: no live-mode (`--live-reads`) counterpart exists because Copilot's GraphQL endpoint does not expose goal data, so this tool always returns cached LevelDB data regardless of the `--live-reads` flag.

Input parameters:

- `active_only` (boolean): Only return active goals (default: false)

### `get_investment_prices` (~190 tokens)

Get investment price history for portfolio tracking. Returns daily and high-frequency price data for stocks, ETFs, mutual funds, and crypto. Filter by ticker symbol, date range, or price type (daily/hf). Includes OHLCV data when available.

Input parameters:

- `end_date` (string): End date (YYYY-MM-DD or YYYY-MM)
- `limit` (integer): Maximum number of results (default: 100, max: 10000)
- `offset` (integer): Number of results to skip for pagination (default: 0)
- `price_type` (string): Filter by price type: daily (monthly aggregates) or hf (high-frequency intraday)
- `start_date` (string): Start date (YYYY-MM-DD or YYYY-MM)
- `ticker_symbol` (string): Filter by ticker symbol (e.g., "AAPL", "BTC-USD", "VTSAX")

### `get_investment_splits` (~284 tokens)

Get stock split events from the local Firestore cache. Returns one row per (security, effective_date) with the adjustment multiplier (e.g. 0.1 for a 10-for-1 split — multiply pre-split prices/quantities by this value to convert to the post-split equivalent). Joined with the securities collection so each row includes ticker and name. IMPORTANT: prices returned by `get_investment_prices` and `get_investment_prices_live` are ALREADY split-adjusted by Copilot. Use this tool only when you need the split events themselves (e.g., for narrative or historical-analysis purposes) — you do NOT need to apply these multipliers to the prices yourself. Securities that have never split are not included in the output. Coverage is limited to securities Copilot currently syncs in your local cache (typically currently-held or recently-held).

Input parameters:

- `end_date` (string): Optional. Inclusive upper bound on effective_date (YYYY-MM-DD).
- `limit` (integer): Maximum number of rows. Default 100, max 10000.
- `offset` (integer): Pagination offset, default 0.
- `start_date` (string): Optional. Inclusive lower bound on effective_date (YYYY-MM-DD).
- `ticker_symbol` (string): Optional. Case-insensitive ticker filter (e.g. "NVDA").

### `get_holdings` (~171 tokens)

Get current investment holdings with position-level detail. Returns ticker, name, quantity, current price, equity value, average cost, and total return per holding. Joins data from account holdings, securities, and optionally historical snapshots. Filter by account or ticker symbol. Note: cost_basis may be unavailable for cash-equivalent positions.

Input parameters:

- `account_id` (string): Filter by investment account ID
- `include_history` (boolean): Include monthly price/quantity snapshots per holding (default: false)
- `limit` (integer): Maximum number of results (default: 100, max: 10000)
- `offset` (integer): Number of results to skip for pagination (default: 0)
- `ticker_symbol` (string): Filter by ticker symbol (e.g., "AAPL", "SCHX")

### `get_balance_history` (~217 tokens)

Get daily balance snapshots for accounts over time. Each entry returns current_balance, available_balance, limit, account_id, and account_name. The response also includes an `accounts` array listing the distinct account IDs in the paginated page. Requires a granularity parameter (daily, weekly, monthly) to control response size. Weekly and monthly modes downsample by keeping the last data point per period. Filter by account_id and date range.

Input parameters:

- `account_id` (string): Filter by account ID
- `end_date` (string): End date (YYYY-MM-DD)
- `granularity` (string, required): Required. Controls response density: daily (every day), weekly (one per week), or monthly (one per month). Use weekly or monthly for longer time ranges.
- `limit` (integer): Maximum number of results (default: 100, max: 10000)
- `offset` (integer): Number of results to skip for pagination (default: 0)
- `start_date` (string): Start date (YYYY-MM-DD)

### `get_goal_history` (~171 tokens)

Get monthly progress snapshots for financial goals. Returns current_amount, target_amount, daily data points, and contribution records per month. Filter by goal_id or month range (YYYY-MM). Cache-only: no live-mode (`--live-reads`) counterpart exists because Copilot's GraphQL endpoint does not expose goal data, so this tool always returns cached LevelDB data regardless of the `--live-reads` flag.

Input parameters:

- `end_month` (string): End month (YYYY-MM)
- `goal_id` (string): Filter by goal ID
- `limit` (integer): Maximum number of results (default: 100, max: 10000)
- `offset` (integer): Number of results to skip for pagination (default: 0)
- `start_month` (string): Start month (YYYY-MM)

## Diagnostics

Captured diagnostic sections: Provenance, Dependencies. The full working is on the page: https://verifymcp.io/servers/ignaciohermosillacornejo-copilot-money-mcp/copilot-money-mcp#diagnostics

## Score history

- 2026-08-03: 64
- 2026-08-02: 63
- 2026-08-01: 18
- 2026-07-31: 5
- 2026-07-30: 25
- 2026-07-28: 27
- 2026-07-27: 8

## Links

- npm package: https://www.npmjs.com/package/copilot-money-mcp
- Socket report: https://socket.dev/npm/package/copilot-money-mcp
- Repository: https://github.com/ignaciohermosillacornejo/copilot-money-mcp
- Changelog RSS feed: https://verifymcp.io/servers/ignaciohermosillacornejo-copilot-money-mcp/copilot-money-mcp/changelog.xml
- Changelog JSON feed: https://verifymcp.io/servers/ignaciohermosillacornejo-copilot-money-mcp/copilot-money-mcp/changelog.json
- HTML version of this page: https://verifymcp.io/servers/ignaciohermosillacornejo-copilot-money-mcp/copilot-money-mcp