wealthapi-mcp
MCP server that enables AI assistants to answer portfolio questions about a wealthAPI account, with read-only tools for accounts, transactions, investments, dividends, and market data.
Caution. Specific findings reduced this grade. They are listed on the page. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.
How we verified
Verified is a snapshot. Live keeps it current, and builds your track record.
⚡ Connect GitHub → continuous verification on every pushwhy connect →Who stands behind it
wealthAPI-eu
Source: Glama
Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →
Install from
The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.
These names and descriptions are the publisher's own, read from the source code. We print them as written. Our assessment is the findings above, not this list.
list_accountsList all of the user's accounts: depots (where investments live), cash accounts, insurance, etc. Start here when you need to know which accounts exist before drilling in.
get_account_balancesGet balance history for one or more cash accounts over a date range. Works only with cash accounts (type '02_cash'), not depots.
get_portfolio_valuationGet the current total value of one or more depots, and optionally its history when 'from' is given. Use this for 'what is my portfolio worth (today / over time)?'.
get_portfolio_allocationBreak down the portfolio's market value by region, industry sector, or asset type. Use this for 'how diversified am I?' and 'what's my US exposure?'.
get_cash_flow_summaryMonthly income vs. spending for the user's cash accounts. Answers 'how much did I earn and spend?' over a period. Inflows are positive, outflows positive (spending), net = income − spending.
get_savings_rateCompute the user's savings rate over a period: (income − spending) / income, expressed as a percentage. Uses cash flow analytics. Higher is better; negative means the user spent more than they earned.
detect_recurring_transactionsList transactions flagged as regular (salary, rent, subscriptions, standing orders). Grouped by counterpart and direction, with detected payment interval (in months) and average amount. Use this to answer 'what subscriptions do I have?' or 'what are my fixed costs?'.
get_dividend_historyGet dividend income per year (gross and net), with a per-month breakdown for the current year. Use this for 'how much dividend income did I get in 2024?'.
get_dividend_calendarGet this year's dividend calendar for current holdings: expected and received payouts with dates, amounts and yields. Use this for 'when are my next dividend payments?'.
get_portfolio_yieldGet the portfolio's dividend yield per year (on current value and on invested capital) plus the dividend CAGR. Use this for 'what's my dividend yield?'.
list_investmentsList the user's investment holdings (stocks, funds, bonds, ETFs). Returns name, ISIN, type, lots, market value and gain/loss. Use this for 'what do I own?' and 'show me my biggest positions'.
get_gainers_and_losersGet the top gainers or losers — either by today's change or by total return since purchase. Use this for 'best/worst performers'.
get_portfolio_performanceGet TWROR (time-weighted rate of return) timeseries for the portfolio over a date range. Use this to answer 'how did my portfolio perform this year / last 5 years?'.
get_realized_gainsGet realized gains per year, split into trading, dividend, interest and other gains (gross and net, plus tax refunds). Use this for 'what did I realize this year?' and tax questions.
get_risk_metricsGet annualized risk (volatility) and return metrics — for the whole portfolio, or per investment with breakdown=true. Use this for 'how risky is my portfolio?'.
search_symbolsSearch securities by name, ISIN or WKN. Returns the security ID and quote provider needed by get_quotes. Use this to resolve 'Apple' or an ISIN to a tradable security.
get_quotesGet current quotes (last price, daily change) for securities by security ID. Get the IDs from search_symbols first.
get_security_fundamentalsGet master data and valuation fundamentals (P/E, P/B, P/S, F-Score) for a security by ISIN. Use this for 'tell me about this holding' or 'is this stock expensive?'.
list_transactionsList cash transactions (deposits, withdrawals, fees, interest, transfers). Results are sorted by amount (largest absolute value first), so the top rows answer 'what did I spend most money on?'.
list_bookingsList investment bookings: buys, sells, dividends, splits. Use this to see the trade history for a specific security or depot.
whoamiShow which wealthAPI user this session is acting as (name, email, member since). Use this to ground yourself or when the user asks 'which account is this?'.
Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.
When Vitest UI server is listening, arbitrary file can be read and executed
Vitest allows Remote Code Execution when accessing a malicious website while Vitest API server is listening
@modelcontextprotocol/sdk has cross-client data leak via shared server/transport instance reuse
Anthropic's MCP TypeScript SDK has a ReDoS vulnerability
Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default
BEARER_TOKEN"": "paste-your-token-here"LOG_LEVELTool annotations
No tools have read-only/destructive annotations
Add readOnlyHint or destructiveHint annotations to every tool so hosts can warn users before invoking.
All four hints declared on every tool
21/21 tools missing one or more hints — list_accounts (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); get_account_balances (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); get_portfolio_valuation (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint), +18 more. OpenAI's directory rejects tools where any of the four hints are missing or non-boolean.
For every tool, set all four hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) to explicit true/false values that match the handler’s actual behaviour.
Tool test coverage
Only 0/21 tools referenced in tests (0%)
Write tests that reference each tool by name so every tool has at least one test.
Production dependencies are patched
0 critical, 3 high severity in production deps — @modelcontextprotocol/sdk@1.12.0 (high), @modelcontextprotocol/sdk@1.12.0 (high)
Run npm audit fix, or upgrade the affected packages to a non-vulnerable version.
Dev dependencies
2 critical/high in dev-only deps (does not ship to users)
Upgrade dev dependencies when convenient.
Domain consistency
npm scope @wealth_api doesn't match GitHub owner wealthapi-eu
Use the same org name across GitHub, npm, and your homepage so users can verify the publisher.
Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.
[](https://m8ven.ai/mcp/wealthapi-eu/wealthapi-mcp)?variant=verified from the URL.Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.
https://m8ven.ai/api/mcp/tool-check