56
grade D
10 days ago
glama
CashChat MCP Server
Connects CashChat financial data to AI assistants, enabling users to manage transactions, view spending summaries, and track category breakdowns through natural language. It supports both local stdio and remote URL-based connections with secure OAuth 2.0 authentication.
Install from
M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.
// key findings
🚨
Secret credentials may flow to a network call
4 flows detected: CASHCHAT_API_KEY. We can’t prove the destination matches the brand the credential belongs to.
⚠️
Known vulnerabilities in dependencies: 2 high
Affects packages this MCP installs at runtime. Upgrade or remove the affected dependency.
🔐
You'll be asked for 4 credentials: CASHCHAT_API_KEY, GOOGLE_CLIENT_SECRET, OAUTH_CLIENT_SECRET, SESSION_SECRET
These are read from process.env at runtime. Make sure you trust where they’ll be sent.
// required environment variables
This server reads these from
process.env. You'll be asked to provide them before it can run.🔐 secret
CASHCHAT_API_KEY— your_api_key_hereconfig
CASHCHAT_API_URLconfig
GOOGLE_CLIENT_ID🔐 secret
GOOGLE_CLIENT_SECRETconfig
OAUTH_CLIENT_ID🔐 secret
OAUTH_CLIENT_SECRET— 2. Set for additional securityconfig
PAYLOAD_URLconfig
PORTconfig
SERVER_URL— Confirm is publicly accessible🔐 secret
SESSION_SECRET// full audit trail
The full breakdown of what we checked, the deductions that landed, the network hosts, the dependency advisories, and concrete fix guidance is available to verified publishers.
// improvement guidance — verified publishers only
We have 7 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.
// embed badge in your README
[](https://m8ven.ai/mcp/pam-supastellar-cashchat-mcp-1nr3p7)commit: e2dc1c31b77f969e5bb28e6f25fe145c5e64475d
code hash: 53c4d0afa917bf7e85e6c5277ff1e922f686bc28c6db91821d6e6a28845d99f9
verified: 4/11/2026, 3:13:05 PM