
Research
/Security News
Popular npm Packages in the keyv and Cacheable Namespaces Compromised in Active Supply Chain Attack
Popular npm packages keyv and cacheable compromised.
monarch-mcp-jamiew
Advanced tools
An MCP server for Monarch Money — gives AI assistants like Claude access to your financial accounts, transactions, budgets, and more.
Originally forked from @colvint/monarch-money-mcp but has diverged into a full rewrite on a modern FastMCP architecture. It's grown from a handful of tools to a broad toolset — adding server-side transaction search, parallel bulk transaction updates, multi-month spending-pattern analysis with forecasting, and a single-call financial overview that fans out to five Monarch APIs at once. Responses are tuned hard for token efficiency: the default compact transaction format cuts payload size by ~80%, categories return just id+name unless you ask for more, and every tool accepts a verbose flag when you want the full payload. It also ships MCP resources and guided prompts, natural-language date parsing ("last month", "30 days ago"), and proper read/write tool annotations so clients know what's safe to call.
Built on the monarchmoneycommunity library by @bradleyseanf — an actively-maintained community fork that tracks the latest Monarch Money API changes (the api.monarch.com domain move, gql 4.0, auth persistence) with full MFA support, pinned to a specific commit for reproducible builds. It descends from the original monarchmoney library by @hammem, which is no longer actively maintained.
outputSchema + machine-readable structured content) with a text fallback for older clientsaccounts://{account_id}/holdings|history)One-line install, no clone, no absolute-path wrangling. The server is published to PyPI, so uv runs it on demand with uvx monarch-mcp-jamiew. You'll need uv installed and your Monarch credentials (see Getting your MFA secret below).
Every MCP client uses the same shape — command uvx, package monarch-mcp-jamiew, and your three credentials as env vars:
{
"mcpServers": {
"monarch-money": {
"command": "uvx",
"args": ["monarch-mcp-jamiew"],
"env": {
"MONARCH_EMAIL": "your-email@example.com",
"MONARCH_PASSWORD": "your-password",
"MONARCH_MFA_SECRET": "your-mfa-secret-key"
}
}
}
}
Pick your client below for the exact steps.
Edit your config file (create it if it doesn't exist) and add the standard config above under mcpServers:
~/Library/Application Support/Claude/claude_desktop_config.json%APPDATA%\Claude\claude_desktop_config.jsonThen fully quit and reopen Claude Desktop.
claude mcp add monarch-money \
-e MONARCH_EMAIL=your-email@example.com \
-e MONARCH_PASSWORD=your-password \
-e MONARCH_MFA_SECRET=your-mfa-secret-key \
-- uvx monarch-mcp-jamiew
Add -s user to make it available across all your projects. Verify with claude mcp list.
codex mcp add monarch-money \
--env MONARCH_EMAIL=your-email@example.com \
--env MONARCH_PASSWORD=your-password \
--env MONARCH_MFA_SECRET=your-mfa-secret-key \
-- uvx monarch-mcp-jamiew
Or add the equivalent block to ~/.codex/config.toml:
[mcp_servers.monarch-money]
command = "uvx"
args = ["monarch-mcp-jamiew"]
env = { MONARCH_EMAIL = "your-email@example.com", MONARCH_PASSWORD = "your-password", MONARCH_MFA_SECRET = "your-mfa-secret-key" }
.mcp.json (project-scoped)Drop the standard config into a .mcp.json file at your project root. Claude Code (project scope) and most clients auto-load it.
Add to ~/.hermes/config.yaml under mcp_servers:, then /reload-mcp (or restart Hermes):
mcp_servers:
monarch-money:
command: uvx
args: ["monarch-mcp-jamiew"]
env:
MONARCH_EMAIL: "your-email@example.com"
MONARCH_PASSWORD: "your-password"
MONARCH_MFA_SECRET: "your-mfa-secret-key"
Add the standard config to ~/.openclaw/openclaw.json under mcpServers, then restart the gateway.
Most accept the same standard config — drop it into the client's MCP config (e.g. Cursor's ~/.cursor/mcp.json, or VS Code via code --add-mcp). Anything that speaks MCP over stdio works.
Not sure how? Tell your agent:
Install the Monarch Money MCP server from https://github.com/jamiew/monarch-mcp — it's on PyPI as
monarch-mcp-jamiew, runs viauvx monarch-mcp-jamiew, and needs env varsMONARCH_EMAIL,MONARCH_PASSWORD, andMONARCH_MFA_SECRET.
To run against a local checkout (and the git-pinned monarchmoneycommunity lib):
git clone https://github.com/jamiew/monarch-mcp
cd monarch-mcp
uv sync
Then point your client at the local copy with absolute paths (find them with which uv and pwd):
{
"mcpServers": {
"monarch-money": {
"command": "/abs/path/to/uv",
"args": ["--directory", "/abs/path/to/monarch-mcp", "run", "python", "server.py"],
"env": {
"MONARCH_EMAIL": "your-email@example.com",
"MONARCH_PASSWORD": "your-password",
"MONARCH_MFA_SECRET": "your-mfa-secret-key"
}
}
}
}
[!NOTE] The
claude mcp add/codex mcp addone-liners put your credentials in shell history. If that bothers you, edit the client's config file directly (as shown for Claude Desktop / Codex above) instead.
T5SPVJIBRNPNNINFSH5W7RFVF2XYADYX)MONARCH_MFA_SECRET| Tool | Description |
|---|---|
get_accounts | List accounts with balances |
get_transactions | Transactions with date/account/category filtering |
search_transactions | Search by merchant name or keyword |
get_transaction_categories | Category list (compact by default) |
create_transaction | Create a manual transaction |
update_transaction | Update a single transaction |
update_transactions_bulk | Update multiple transactions in parallel |
get_budgets | Budget data and spending analysis |
get_cashflow | Income and expense analysis |
get_account_holdings | Investment holdings for an account (requires account_id) |
get_account_history | Account balance history |
get_institutions | Linked financial institutions |
get_recurring_transactions | Recurring transaction detection |
set_budget_amount | Set a budget category amount |
create_manual_account | Create a manually-tracked account |
refresh_accounts | Trigger account data refresh |
get_spending_summary | Spending aggregated by category, account, or month |
get_complete_financial_overview | Combined 5-API call in parallel |
analyze_spending_patterns | Multi-month trend analysis |
By default, transactions return a compact format with the fields that matter:
{
"id": "123456789012345678",
"date": "2025-03-15",
"amount": -12.50,
"merchant": "Corner Deli",
"plaidName": "CORNER DELI NYC",
"category": "Restaurants & Bars",
"categoryId": "cat_001",
"account": "Main Credit Card",
"needsReview": true
}
pending and notes are included only when present. Set verbose=True on any tool for the full API response with all metadata.
Sessions are cached in ~/.monarch-mcp/ for faster subsequent logins (override the location with the MONARCH_SESSION_DIR env var). If you hit auth issues:
~/.monarch-mcp/session.pickle to clear the cached sessionMONARCH_FORCE_LOGIN=true in your env config to force a fresh loginCreate a .env file (git-ignored):
MONARCH_EMAIL="your-email@example.com"
MONARCH_PASSWORD="your-password"
MONARCH_MFA_SECRET="YOUR_TOTP_SECRET_KEY"
uv run pytest tests/ -v # unit tests (no creds needed)
uv run pytest tests/test_integration.py -v # integration tests (needs .env)
uv run scripts/health_check.py # quick API connectivity check
Run all checks locally (same as GitHub Actions CI):
uv run python scripts/ci.py
Cut a release with the /release flow (bump version in pyproject.toml → commit → tag vX.Y.Z → push → gh release create). Publishing the GitHub release triggers .github/workflows/publish.yml, which builds and pushes to PyPI and the MCP Registry via OIDC trusted publishing — no API tokens are stored anywhere. The workflow injects the tag version into server.json automatically, so pyproject.toml is the only version field you bump by hand.
Tools for measuring and optimizing token usage across MCP sessions:
uv run scripts/analyze_logs.py # full report
uv run scripts/analyze_logs.py --json # JSON output
uv run scripts/eval_session.py snapshot # mark log position
# ... use tools in Claude ...
uv run scripts/eval_session.py analyze # analyze new entries
Warning: Monarch Money does not provide an official API. This server uses unofficial API access that requires your actual account credentials. Use with appropriate caution.
~/.monarch-mcp/ contain auth tokens — keep them secure.env or .mcp.json files to version controlThis project started as a fork of colvint/monarch-money-mcp by @colvint. Thanks for the original implementation!
FAQs
MCP server for Monarch Money personal finance
We found that monarch-mcp-jamiew demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Popular npm packages keyv and cacheable compromised.

Security News
A misconfiguration gave three Anthropic models internet access, and one, believing it was in a simulation, shipped a credential-stealing package to PyPI.

Security News
/Company News
Socket has joined the new Composer and Packagist sponsorship program as a launch sponsor, supporting the team that keeps PHP's package ecosystem secure.