actual-mcp-server (agigante80/actual-mcp-server) is an MCP server listed on the M8ven Trust Index. M8ven has not graded it: we have no way to read this server ourselves. No publisher has claimed this listing.

C
Emerging
74/100
23 days ago

actual-mcp-server

Talk to your self-hosted Actual Budget from any MCP client: a remote HTTP server for LibreChat/LobeChat or a local stdio process for Claude Desktop, with 71 tools for transactions, budgets, rules, and bank sync. No Docker needed for local use.

Emerging. No concerning findings. Grades remain capped until the project builds reputation through adoption. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.

How we verified

Code Verified⚡ Live Monitored: not connected

Verified is a snapshot. Live keeps it current, and builds your track record.

⚡ Connect GitHub → continuous verification on every pushwhy connect →

Who stands behind it

agigante80

Source: Glama · also listed on github_topic, npm

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →

Install from

M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.

// key findings
No credential exfiltration, no sensitive file access, no obfuscation
Static analysis found nothing flowing your secrets to unexpected places.
Open source with a license and README
Anyone can audit the code, the license is declared, and the publisher documents what it does.
🔐
You'll be asked for 5 credentials: ACTUAL_BUDGET_PASSWORD, ACTUAL_PASSWORD, GH_TOKEN, MCP_AUTH_TOKEN, MCP_HTTPS_KEY
These are read from process.env at runtime. Make sure you trust where they’ll be sent.
// environment variables
To run this server yourself, you supply these values. They go in your own MCP client configuration and stay on your machine. The secret label means the value is sensitive, not that the server mishandles it.
configACTUAL_API_CONCURRENCY5 No Max concurrent Actual API operations
🔐 secretACTUAL_BUDGET_PASSWORD_(none)_ No Optional encryption password for encrypted budgets
configACTUAL_BUDGET_SYNC_IDe =your_sync_id \
configACTUAL_DATA_DIR
configACTUAL_OP_TIMEOUT_MS
🔐 secretACTUAL_PASSWORDe =your_password \
configACTUAL_SERVER_URLe =http://localhost:5006 \
configAUTH_PROVIDERnone No Auth mode: none (static Bearer) or oidc (JWKS-validated JWT)
configBANK_SYNC_TIMEOUT_MS
configBUDGET_DEFAULT_NAMENo "Default"
configDIRECT_SYNC_LOG_DIR
configDOTENV_CONFIG_QUIET
configDRIFT_RESULT
configEXPECTED_TOOL_COUNT
🔐 secretGH_TOKEN
configGITHUB_OUTPUT
configGITHUB_REPOSITORY
configGITHUB_RUN_ID
configGITHUB_SERVER_URL
configGITHUB_WORKFLOW
configLOG_LEVEL_(none)_ No Debug-detection toggle: set to debug to enable extra transport debug output. Distinct from MCP_BRIDGE_LOG_LEVEL (the winston level); has no default and is not itself a log level
configMAX_CONCURRENT_SESSIONS15 No Maximum concurrent MCP sessions allowed
configMCP_ALLOW_UNAUTHENTICATED
🔐 secretMCP_AUTH_TOKEN
configMCP_BRIDGE_BIND_HOST0.0.0.0 No Host address to bind server to (0.0.0.0 = all interfaces)
configMCP_BRIDGE_DEBUG_TRANSPORTfalse No Enable transport-level debug logging
configMCP_BRIDGE_HTTP_PATHsame as MCP_HTTP_PATH No Advertised HTTP path shown to clients (set when a reverse proxy rewrites the path)
configMCP_BRIDGE_LOG_DIRapp/logs (beside the install) No Directory for log files (if STORE_LOGS=true). .env.example and Docker set it explicitly (e.g. ./logs, /app/logs)
configMCP_BRIDGE_MAX_FILES14d No Keep rotated logs for N days (e.g., 14d, 30d)
configMCP_BRIDGE_MAX_LOG_SIZE20m No Rotate when file reaches size (e.g., 20m, 100m)
configMCP_BRIDGE_PORTServer starts at http://localhost:3600/http by default (the listen port is , default 3600).
configMCP_BRIDGE_PUBLIC_HOSTauto-detected No Public hostname/IP for server (shown in logs)
configMCP_BRIDGE_PUBLIC_SCHEMEauto-detected No Public scheme (http or https)
configMCP_BRIDGE_ROTATE_DATEPATTERNYYYY-MM-DD No Date pattern for rotated log filenames
configMCP_BRIDGE_STORE_LOGSfalse No Enable file logging (vs console only)
configMCP_BRIDGE_USE_TLSfalse No Set to true to advertise https:// in the server URL (for reverse-proxy setups where TLS is terminated upstream)
configMCP_ENABLE_HTTPSfalse No Enable native TLS. Requires MCP_HTTPS_CERT and MCP_HTTPS_KEY
configMCP_HTTPS_CERTMCP_ENABLE_HTTPS false No Enable native TLS. Requires and MCP_HTTPS_KEY
🔐 secretMCP_HTTPS_KEYMCP_ENABLE_HTTPS false No Enable native TLS. Requires MCP_HTTPS_CERT and
configMCP_HTTP_PATH/http No HTTP endpoint routing path
configMCP_HTTP_URL
configMCP_SERVER_URL
configMCP_SSE_AUTHORIZATIONe =your_secret_token \
configMCP_STDIO_CONTAINER
configMCP_STDIO_DATA_DIR
configMCP_STDIO_FRAMING_TIMEOUT_MS
configMCP_STDIO_MODE
configMCP_STDIO_SMOKE_TIMEOUT_MS
configREGRESSION_ACTUAL_CTR
configREGRESSION_BOUND_MS
configSESSION_IDLE_TIMEOUT_MINUTES5 No Minutes before idle session cleanup
configSTALE_THRESHOLD_HOURS
configTRAIN_CURRENT
configTRAIN_JOB_NAME
configTRAIN_JOB_RESULT
configTRAIN_OUTCOME
configTRAIN_SOAK_HOURS
configTRAIN_VERSION
configUSE_CONNECTION_POOLtrue No Enable session-based connection pooling
configVERIFY_GHCR_IMAGE
configVERIFY_HUB_IMAGE
configVERIFY_NPM_PACKAGE
configVERIFY_VERSION
configVERSIONauto-detected No Server version (auto-set by build/Docker)
// quality suggestions

Dependencies

18 dependencies, 1 flagged: @playwright/test

Tool annotations

No tools have read-only/destructive annotations

Add readOnlyHint or destructiveHint annotations to every tool so hosts can warn users before invoking.

All four hints declared on every tool

2/2 tools missing one or more hints — search.docs (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); math.add (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint). OpenAI's directory rejects tools where any of the four hints are missing or non-boolean.

For every tool, set all four hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) to explicit true/false values that match the handler’s actual behaviour.

Tool test coverage

Only 0/2 tools referenced in tests (0%)

Write tests that reference each tool by name so every tool has at least one test.

Shell command execution

17 child_process calls — runs shell commands

Prefer library functions over shell-outs. If you must shell out, ensure all inputs are properly escaped.

Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.

// full audit trail
The findings above are the summary. The full trail, every check we ran, each deduction, the network hosts observed and the dependency advisories, goes to verified publishers, along with an alert whenever a new one lands. Verified publishers can also review each finding and dispute it in one click. Publisher corrections have sharpened several of our checks this month, because the maintainer knows the codebase better than any scanner.
// improvement guidance — verified publishers only
We have 4 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.
// embed badge in your README
[![M8ven Score](https://m8ven.ai/badge/mcp/agigante80-actual-mcp-server-w9sn4o)](https://m8ven.ai/mcp/agigante80-actual-mcp-server-w9sn4o)
Shows your grade and updates automatically. Prefer no grade? Append ?variant=verified to the badge URL.
commit: 74700aff1f46b59739ea11571cfe4f3fcdf3b6ac
code hash: 0a086b4cda6cb2037256d94cf31bb9ac0279a6a8be2e8ee3cbd73fddb0b3efb2
verified: 8/6/2026, 3:25:18 PM
view raw JSON →
Check MCPs from inside your assistant
Tool Check · MCP

Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.

https://m8ven.ai/api/mcp/tool-check
check_toolsearch_toolscompare_toolsrecommend_alternativescheck_publisherreport_concern
How to add it →Free · no account needed · works in any MCP client