MCP servers › io.github.agigante80 › actual-mcp-server

MCP server · registry snapshot 2026-11-03 · last checked 2026-11-03

io.github.agigante80/actual-mcp-server

Actual Budget MCP Server — the publisher's title

by agigante80 · GitHub account (the registry's namespace rule)repository: same ownerSource ↗npm ↗Website ↗

Manage Actual Budget accounts, transactions, budgets, rules and reports from an AI assistant. — the publisher's description

8 of 9 record checks metversion 0.25.2JavaScriptMITstandard input/output, streamable HTTP

Summary

io.github.agigante80/actual-mcp-server is a local MCP server listed in the official MCP registry at version 0.25.2, under the namespace of the GitHub account agigante80. Its linked repository, github.com/agigante80/actual-mcp-server, belongs to the same GitHub account.

Record checks

8 of 9 record checks met

met: Registry entry is active and says how to run it
met: Source repository link opens
met: Repository is not archived
met: Code pushed to the repository in the 90 days before our check
met: Repository publishes a security policy (SECURITY.md)
met: Package names its licence with a standard (SPDX) identifier
met: The version the registry lists can be installed and is not withdrawn
met: npm package carries build provenance (attestation)
not met: No known critical or high advisory in the package or its dependencies

#373 of 18,234 packages by monthly downloads
#1,001 of 25,254 repositories by GitHub stars, tied with 5 others

From public records, not a safety rating. Each check with its reason · Is it safe to install?

Operate this server? Correct a fact · README badge · Run the checks yourself

Key facts

Runs: local package
Transport: standard input/output, streamable HTTP
Your own values: secrets: ACTUAL_PASSWORD, MCP_SSE_AUTHORIZATION · settings: ACTUAL_SERVER_URL, ACTUAL_BUDGET_SYNC_ID
Package: npm, Docker (OCI) · listed version behind the latest release
License: MIT
Dependencies: 3 packages with a critical or high advisory (0 critical, 3 high)
Repository: public
Last tested: not tested

Tool list

Not read: It requires a credential (a key or token) that the publisher marks as required. We never fill in credentials, so we did not start it. So there is no tool-list size and no result from the three APIs.

Add to your client

Worth knowing before you connect it

The registry lists 0.25.2; 0.26.0 is newer (1 release).
3 packages with a critical or high advisory (0 critical, 3 high) in its dependencies (as resolved on 2026-11-03).
Its package is signed and carries a build record naming its source.

Each line comes from a section below, with its source and date.

How fresh this is

Live-tested

Last tested

not tested

Latest version

0.25.2, published 2026-11-03 (registry, as of the 2026-11-03 snapshot)

First listed version

2026-10-31 (earliest version still in the registry; older removed versions would be earlier)

Version history

3 versions listed, 2026-10-31 to 2026-11-03; 3 in the 90 days before the 2026-11-03 snapshot.

Most recent 3 versions

0.25.2 · 2026-11-03
0.25.1 · 2026-10-31
0.25.0 · 2026-10-31

(versions still listed in the registry only)

Registry data

snapshot 2026-11-03

Package and repository

checked 2026-11-03

Dead or stale signals

None found in the records we hold

Looked for and not found: deprecated in the registry; listed version cannot be installed or is withdrawn; repository link does not open; repository archived; no push in over 365 days. Each line is a dated fact from a public record. It does not say whether the server still works, and a record can change after the date shown.

Changes since the last refresh

Version 0.25.1 (published 2026-10-31) → 0.25.2 (published 2026-11-03), between the registry lists of 2026-11-02 and 2026-11-03.

The publisher’s GitHub release note for v0.25.2 (“Release v0.25.2”), published 2026-11-03.

Read the release note (the publisher’s text, shown as plain text)

## 🎉 Release v0.25.2

### 📦 Docker Images

```bash
# Docker Hub
docker pull agigante80/actual-mcp-server:0.25.2

# GitHub Container Registry
docker pull ghcr.io/agigante80/actual-mcp-server:0.25.2
```

### 📝 Changelog

- chore(release): bump version to 0.25.2 (4ee0405)
- chore(deps): upgrade @actual-app/api to 26.11.0 (38fc34f)

### 📊 What this release ships

- `@actual-app/api` pinned at `26.11.0`
- All 84 MCP tools registered and validated on this tag

### 🔒 Security

This release has been scanned for vulnerabilities. Check the Security tab for details.


**Full Changelog**: https://github.com/agigante80/actual-mcp-server/compare/v0.25.1...v0.25.2

The release on GitHub

Source: the official MCP Registry list on 2026-11-02 and on 2026-11-03; release notes from the GitHub Releases API, checked 2026-11-03.

What it is

How do I add it to my client?

Config from the registry entry

From the npm package actual-mcp-server

This entry needs values of your own (marked < > or { } in the config below), so there is no one-click link: paste the config and fill them in.

Claude Desktop · claude_desktop_config.json (Settings → Developer → Edit Config)

{
  "mcpServers": {
    "actual-mcp-server": {
      "command": "npx",
      "args": [
        "-y",
        "actual-mcp-server@0.25.2",
        "--stdio"
      ],
      "env": {
        "ACTUAL_SERVER_URL": "<ACTUAL_SERVER_URL>",
        "ACTUAL_PASSWORD": "<ACTUAL_PASSWORD>",
        "ACTUAL_BUDGET_SYNC_ID": "<ACTUAL_BUDGET_SYNC_ID>"
      }
    }
  }
}

Cursor · .cursor/mcp.json in a project, or ~/.cursor/mcp.json

{
  "mcpServers": {
    "actual-mcp-server": {
      "command": "npx",
      "args": [
        "-y",
        "actual-mcp-server@0.25.2",
        "--stdio"
      ],
      "env": {
        "ACTUAL_SERVER_URL": "<ACTUAL_SERVER_URL>",
        "ACTUAL_PASSWORD": "<ACTUAL_PASSWORD>",
        "ACTUAL_BUDGET_SYNC_ID": "<ACTUAL_BUDGET_SYNC_ID>"
      }
    }
  }
}

VS Code · .vscode/mcp.json

{
  "servers": {
    "actual-mcp-server": {
      "type": "stdio",
      "command": "npx",
      "args": [
        "-y",
        "actual-mcp-server@0.25.2",
        "--stdio"
      ],
      "env": {
        "ACTUAL_SERVER_URL": "${input:actual-server-url}",
        "ACTUAL_PASSWORD": "${input:actual-password}",
        "ACTUAL_BUDGET_SYNC_ID": "${input:actual-budget-sync-id}"
      }
    }
  },
  "inputs": [
    {
      "type": "promptString",
      "id": "actual-server-url",
      "description": "ACTUAL_SERVER_URL",
      "password": false
    },
    {
      "type": "promptString",
      "id": "actual-password",
      "description": "ACTUAL_PASSWORD",
      "password": true
    },
    {
      "type": "promptString",
      "id": "actual-budget-sync-id",
      "description": "ACTUAL_BUDGET_SYNC_ID",
      "password": false
    }
  ]
}

Claude Code

claude mcp add --env "ACTUAL_SERVER_URL=<ACTUAL_SERVER_URL>" "ACTUAL_PASSWORD=<ACTUAL_PASSWORD>" "ACTUAL_BUDGET_SYNC_ID=<ACTUAL_BUDGET_SYNC_ID>" --transport stdio actual-mcp-server -- npx -y actual-mcp-server@0.25.2 --stdio

Cline · cline_mcp_settings.json (Cline CLI: ~/.cline/data/settings/; in the editor: MCP Servers → Configure → Configure MCP Servers)

{
  "mcpServers": {
    "actual-mcp-server": {
      "command": "npx",
      "args": [
        "-y",
        "actual-mcp-server@0.25.2",
        "--stdio"
      ],
      "env": {
        "ACTUAL_SERVER_URL": "<ACTUAL_SERVER_URL>",
        "ACTUAL_PASSWORD": "<ACTUAL_PASSWORD>",
        "ACTUAL_BUDGET_SYNC_ID": "<ACTUAL_BUDGET_SYNC_ID>"
      },
      "disabled": false,
      "autoApprove": []
    }
  }
}

Gemini CLI · ~/.gemini/settings.json, or .gemini/settings.json in a project

{
  "mcpServers": {
    "actual-mcp-server": {
      "command": "npx",
      "args": [
        "-y",
        "actual-mcp-server@0.25.2",
        "--stdio"
      ],
      "env": {
        "ACTUAL_SERVER_URL": "<ACTUAL_SERVER_URL>",
        "ACTUAL_PASSWORD": "<ACTUAL_PASSWORD>",
        "ACTUAL_BUDGET_SYNC_ID": "<ACTUAL_BUDGET_SYNC_ID>"
      }
    }
  }
}

OpenAI Codex · ~/.codex/config.toml, or .codex/config.toml in a trusted project

[mcp_servers.actual-mcp-server]
command = "npx"
args = ["-y", "actual-mcp-server@0.25.2", "--stdio"]

[mcp_servers.actual-mcp-server.env]
"ACTUAL_SERVER_URL" = "<ACTUAL_SERVER_URL>"
"ACTUAL_PASSWORD" = "<ACTUAL_PASSWORD>"
"ACTUAL_BUDGET_SYNC_ID" = "<ACTUAL_BUDGET_SYNC_ID>"

Zed · Zed settings file (command: zed: open settings file)

{
  "context_servers": {
    "actual-mcp-server": {
      "command": "npx",
      "args": [
        "-y",
        "actual-mcp-server@0.25.2",
        "--stdio"
      ],
      "env": {
        "ACTUAL_SERVER_URL": "<ACTUAL_SERVER_URL>",
        "ACTUAL_PASSWORD": "<ACTUAL_PASSWORD>",
        "ACTUAL_BUDGET_SYNC_ID": "<ACTUAL_BUDGET_SYNC_ID>"
      }
    }
  }
}

Try it in the MCP Inspector · runs on your machine, opens in your browser · Node 22.19+

npx @modelcontextprotocol/inspector@2.11.0 -e "ACTUAL_SERVER_URL=<ACTUAL_SERVER_URL>" -e "ACTUAL_PASSWORD=<ACTUAL_PASSWORD>" -e "ACTUAL_BUDGET_SYNC_ID=<ACTUAL_BUDGET_SYNC_ID>" -- npx -y actual-mcp-server@0.25.2 --stdio

Arguments are written as the registry entry gives them; a named one as “--name value”, the form the registry documentation shows.
Replace <ACTUAL_SERVER_URL>, <ACTUAL_PASSWORD>, <ACTUAL_BUDGET_SYNC_ID> with your own values; the entry marks ACTUAL_PASSWORD as secret, so keep the file out of version control.
Optional settings the entry also lists (left out above): ACTUAL_BUDGET_PASSWORD, MCP_BRIDGE_DATA_DIR.
This runs the publisher's code on your machine (npx). Read its README first.
The MCP Inspector lists the server's tools, resources and prompts; a tool you call there runs for real.

Built from the server's registry entry with each client's documented format (checked 2026-10-14; the Cursor link and the VS Code command 2026-10-19; the MCP Inspector command 2026-10-21; Cline, Gemini CLI, OpenAI Codex and Zed 2026-10-26). Values in < > are yours to fill in; this page never contains a key. Where the server needs a setting the entry does not declare, it can still fail to start.

Can it be installed, and is it up to date?

Version pin · advisories

Listed version

Registry lists: 0.25.2
Latest stable: 0.26.0
Status: behind the latest release (1 releases, 0 days)
Withdrawn: no

Source: registry.npmjs.org · 2026-11-03. About the version the registry lists; a manual install may resolve to a different one.

Dependency advisories

Counted in the full dependency tree as resolved on 2026-11-03 (npm audit; each bar counts packages with an advisory, not advisories). Bars share one scale. The package itself has no known vulnerability (OSV.dev).

Integrity, provenance, license

Integrity: sha512-NOez8DSLqLLuGq+4k…
Signature: signed and attested
License: MIT

Source: the package registry · 2026-11-03.

Usage

Downloads: 6,187 in the last month

Source: api.npmjs.org · 2026-11-03.

Does the registry listing match what we found?

Feature #6

The registry checks an entry when it is published (each new version), and nothing re-checks it on a schedule. A difference below is about the listing, not a judgement of the publisher.

Registry says	We found	Result	Source · date
Version 0.25.2 on npm	Exists and can be installed	matches	npm · 2026-11-03
Repository github.com/agigante80/actual-mcp-server	Opens publicly	matches	api.github.com · 2026-11-03

Who made it?

Feature #7 · lineage

Facts about the publisher. We do not turn them into a trust score.

Namespace: io.github.agigante80
GitHub owner: a personal account (agigante80)
Build record: signed and attested

Repository: github.com/agigante80/actual-mcp-server
Stars: 76
Repository age: over a year
Last push: 0–30 days ago
Archived: no
Security policy: .github/SECURITY.md

Source: the registry entry and api.github.com · 2026-11-03; security policy read from GitHub · 2026-11-03.

Publish this server? Run these checks against it yourself before release, from your own machine: a server the command starts, or your own server at its URL after a one-time proof that you control it: npx protocolprobe-selftest.

Choosing

Record checks

Public records · not a safety rating

8 of 9 record checks met

#373 of 18,234 packages by monthly downloads
#1,001 of 25,254 repositories by GitHub stars, tied with 5 others

MetRegistry entry is active and says how to run itActive, with a package or a remote address.
MetSource repository link opensThe linked GitHub repository is public.
MetRepository is not archivedNot archived.
MetCode pushed to the repository in the 90 days before our checkLast push 0-30 days before our check.
MetRepository publishes a security policy (SECURITY.md)SECURITY.md found.
MetPackage names its licence with a standard (SPDX) identifierMIT
MetThe version the registry lists can be installed and is not withdrawnThe listed version exists; a newer one is out.
Metnpm package carries build provenance (attestation)Signed, with a build attestation naming the source and workflow.
Not metNo known critical or high advisory in the package or its dependencies3 packages in its dependencies with a critical or high advisory (npm audit counts packages, not advisories).What changes this check: npm's documentation describes listing a project's dependency advisories with npm audit and applying compatible dependency updates. npm: npm audit

Read from public records only: the registry entry, npm/PyPI, GitHub and advisory databases, checked 2026-11-03 (security policy 2026-11-03). No tool was called. Only “met” and “not met” are counted, so the total differs between servers; a check that does not apply or that we could not run is listed, never counted against it. It is not a safety rating, and the same rules apply to every server. How each check works · Leaderboards · How we stay neutral

Common questions about io.github.agigante80/actual-mcp-server

Answered from the data above

Who publishes io.github.agigante80/actual-mcp-server?

The registry ties the namespace io.github.agigante80 to the GitHub account agigante80; only its owner can publish under it. Its linked repository, github.com/agigante80/actual-mcp-server, belongs to the same GitHub account. These are facts from the registry and GitHub, not a rating.

Is io.github.agigante80/actual-mcp-server safe to install?

We do not rate servers as safe or unsafe. 8 of its 9 applicable record checks are met (facts from public records, each listed on this page). What the records show: Its npm package carries a build-provenance attestation that names its source repository and build workflow. Its source repository opens publicly. Its repository had a push in the last 90 days. A newer stable release exists than the one listed. The package itself has no known vulnerability (OSV.dev). Its full dependency tree has packages with advisories (3 high; npm audit). These are facts with their sources on this page, not a safety guarantee, and we did not run its tools.

Has io.github.agigante80/actual-mcp-server been security tested?

No. It requires a credential (a key or token) that the publisher marks as required. We never fill in credentials, so we did not start it.

Does io.github.agigante80/actual-mcp-server publish a security policy?

Yes: its repository has a public security policy (github.com/agigante80/actual-mcp-server/blob/HEAD/.github/SECURITY.md). That is the publisher's statement, not permission for us to test the server, and we call none of its tools.

Is the listed version current?

No. The registry lists 0.25.2; the latest stable release on npm is 0.26.0.

Where is the source code of io.github.agigante80/actual-mcp-server?

In github.com/agigante80/actual-mcp-server, which opens publicly.

Found this page useful?

Anonymous · no sign-in

A quick, anonymous reaction — no account, no email. One per kind from your browser. The tally updates when the page is next refreshed, and it is only a rough count, never a safety rating or a measured number of people.

Compare with another server

Side by side: registry entry, our read-only session, the tools and the 18 classification fields. Same values as each page; no score.

Security testing

Has it been tested?

Feature #1

It requires a credential (a key or token) that the publisher marks as required. We never fill in credentials, so we did not start it. — the server's own choice

Required inputs the publisher declares: ACTUAL_SERVER_URL, ACTUAL_PASSWORD (secret), ACTUAL_BUDGET_SYNC_ID, MCP_SSE_AUTHORIZATION (secret).

Reference

How is it classified?

18 fields

One value per field, each with its source. Fields written by AI models are marked. A field with no value says why.

TopicAI-classified

pending: added in the weekly update

listed 2026-11-03; not classified yet

Pricing modelAI-classified

pending: added in the weekly update

the website is not read yet

Programming language

JavaScript

api.github.com · 2026-11-03

Hosting type

local package

registry · 2026-11-03

MCP capability

not checked

not read (no session)

Transport

standard input/output, streamable HTTP

registry · 2026-11-03

Required credentials

requires a secret

registry · 2026-11-03 · no declaration is not a guarantee

Package registry

npm, oci

registry · 2026-11-03

Freshness

0–30 days

registry updatedAt · 2026-11-03

Lifecycle status

active

registry · 2026-11-03

License class

permissive

package registry · 2026-11-03

Integrity hash

declared (sri)

package registry · 2026-11-03

Signature / provenance

signed and attested

package registry · 2026-11-03

Dependency advisories

high

npm audit · 2026-11-03

Popularity

6,187 downloads a month

package registry · 2026-11-03

Publisher signals

owner: a personal account · repository age: over a year · stars: 10–99 · build record: signed and attested

api.github.com · 2026-11-03

Maintenance

active

api.github.com · 2026-11-03

Environment

your machine

where it runs, from the hosting type · 2026-11-03

“Not stated” means the source did not state it; “does not apply” means it does not apply to this kind of server; “our limit” means our own lookup failed. A linked value opens the directory filtered to the same value.

Cite or correct this page

Sources and corrections

Suggested citation

ProtocolProbe. “io.github.agigante80/actual-mcp-server: MCP server record.” Data checked 2026-11-03. https://protocolprobe.com/mcp/servers/io.github.agigante80/actual-mcp-server

Figures are valid for the date shown. Our facts on this page are CC BY 4.0: reuse them with a link and the check date. Quoted text (the publisher’s descriptions, website quotes, tool names) is not ours to license.

As JSON: this record in the API · API documentation.

Badge for your README

[![ProtocolProbe](https://protocolprobe.com/api/v1/badge/io.github.agigante80/actual-mcp-server)](https://protocolprobe.com/mcp/servers/io.github.agigante80/actual-mcp-server)

It shows this server's record-check count: facts from public records, no tool called. It is not a security rating or a pass. It links here and updates after each data reload.

Something wrong, or is this yours?

If a fact here is wrong, tell us and we will re-check it. If you operate this server, you can run our checks on it yourself with the free self-test command; we call no server’s tools ourselves for anything shown here.

Write to hello@protocolprobe.com · corrections log · methodology