Firefly III MCP Server

A Model Context Protocol server that gives an AI assistant access to your own Firefly III instance — 152 operations behind 5 scoped tools, with reading, writing and deleting kept as three separate, explicitly-authorized surfaces instead of one tool that can do all three.

> Türkçe: README.tr.md

• *"What did I spend the most on last month?"*
• *"Find uncategorised transactions from August and suggest categories."*
• *"Show me subscriptions whose amount went up."*

Everyone runs this against their own Firefly instance with their own token — there is no hosted backend or relay in between.

Listed in the official MCP Registry as `io.github.YakupEmreYerli/mcp-firefly-iii`, on Glama, and in Firefly III's own third-party apps documentation. Every release is built and published by CI from a tagged commit, with npm provenance attesting that the tarball came from this repository.

Demo

https://github.com/user-attachments/assets/4866f13e-ff09-43b0-b99c-2b4789a30224

38-second demo: ask a financial question, read the answer through MCP, preview a change with `dry_run`, approve it, and write it back to Firefly III. Recorded against a synthetic instance — all financial data shown is fabricated.

Features

• 5 meta-tools, not 152. `firefly_query`, `firefly_mutate`, `firefly_destructive`, plus `firefly_list_operations` and `firefly_get_schema` for discovery — a typed registry maps every Firefly endpoint onto these instead of flooding the model's tool list.
• `dry_run` on every write, returning the exact request — resolved record IDs included — without sending it.
• Bulk writes can't run blind. Filter-driven updates require `max_matches` and refuse an incomplete scan before the first write; multi-split transaction groups are rejected outright rather than risk folding their amounts together.
• Read/write/destructive are separately scoped and enforced, not just annotated — over stdio by the Firefly token, over HTTP by OAuth scope or a static token.
• Embedded OAuth 2.1 authorization server for Claude web, Claude mobile, and ChatGPT — no separate Keycloak or Authentik install.
• Docker images for `linux/amd64`/`linux/arm64`, and a self-checking documentation pipeline that keeps the tool catalogue in sync with the code.
• It tells you when it is out of date. Once a day it checks whether a newer version exists and, if so, says so once — a line on stderr, a sentence beside the next answer. `MCP_UPDATE_CHECK=false` turns it off.

Prerequisites

• A running Firefly III instance and a Personal Access Token (Firefly III → Options → Profile → OAuth → Create New Personal Access Token)
• Node.js 20.6+, unless you're using Docker

Usage

1. stdio (Claude Code, Claude Desktop, Cursor)

Let setup do it — it asks for your Firefly III address and token, checks that they actually work, then configures Claude Code and Claude Desktop if it finds them: `npx -y @yakupemreyerli/firefly-mcp setup`. For any other client it prints the configuration to paste.

By hand, Claude Code:

claude mcp add firefly --env FIREFLY_API_URL=your-firefly.example --env FIREFLY_API_TOKEN=your-token -- npx -y @yakupemreyerli/firefly-mcp

By hand, Claude Desktop / Cursor / other clients — add to the MCP config file:

{
  "mcpServers": {
    "firefly": {
      "command": "npx",
      "args": ["-y", "@yakupemreyerli/firefly-mcp"],
      "env": { "FIREFLY_API_URL": "your-firefly.example", "FIREFLY_API_TOKEN": "your-token" }
    }
  }
}

2. Remote HTTP with a static token

For n8n, automation, or any caller that can't drive a browser-based OAuth flow. Set `MCP_HTTP_TOKEN` in `.env`, then run `npx -y -p @yakupemreyerli/firefly-mcp firefly-mcp-http`. Every request to `/mcp` must carry `Authorization: Bearer ` — one token, full access, no per-connection scoping.

3. Remote HTTP with OAuth (Claude web, Claude mobile, ChatGPT)

None of these clients can hold a static token, and none of them can spawn a local process — they connect to a public HTTPS URL and expect OAuth. With `MCP_AUTH_PASSWORD` set, this server *is* the OAuth 2.1 authorization server: it handles client registration, PKCE and token exchange itself, so there is no Keycloak, no Google sign-in, and no token to copy anywhere.

Step 1 — give the server a public HTTPS address. Cloudflare Tunnel is the easiest route for a home server (no port forwarding, no certificate); Caddy or Traefik work on a VPS. `compose.example.yml` ships `cloudflare` and `caddy` profiles for exactly this. Say the result is `https://mcp.example.com`.

Step 2 — configure `.env`:

MCP_AUTH_PASSWORD=a-strong-password-of-at-least-12-characters
MCP_RESOURCE_URL=https://mcp.example.com
MCP_AUTH_STATE_DIR=/data/firefly-mcp-auth

`MCP_RESOURCE_URL` is the external origin, character for character, with no path — not the internal `http://firefly-mcp:3000`, and not the `/mcp` connection URL. A mismatch fails the token audience check and the client only reports "invalid token". `MCP_AUTH_STATE_DIR` must sit on a persistent volume (`compose.example.yml` mounts one) or every restart de-authorizes every client.

Step 3 — start it and verify:

docker compose -f compose.example.yml up -d
curl https://mcp.example.com/health     # {"ok":true,"auth":"oauth-builtin"}

If `auth` says `bearer` instead, the password never reached the process and the client will report that the server doesn't support OAuth.

Step 4a — Claude (web, Desktop, iOS/Android). Settings → Connectors → Add custom connector, URL `https://mcp.example.com/mcp`. Leave the authentication choices as detected — Claude probes the server and picks the flow it supports. The connector then works on every Claude surface you're signed into, phone included.

Step 4b — ChatGPT. In the custom connector / MCP screen, enter the same `https://mcp.example.com/mcp` and choose OAuth as the authentication method.

Step 5 — enter the password. A Firefly login screen opens in the browser; type `MCP_AUTH_PASSWORD`. That one screen is the whole decision — the connection is granted all three scopes (`firefly:read`, `firefly:write`, `firefly:destructive`), whatever the client itself asked for. There is no second consent screen: whoever holds the password could have ticked every box on it. To hand out a connection that genuinely cannot write, give the server a read-only Firefly Personal Access Token instead.

Full TLS recipes and troubleshooting: docs/oauth.md.

4. Docker

Recommended for either HTTP mode above:

cp .env.example .env    # fill in the values for the mode you need
docker compose -f compose.example.yml up -d

Swap `build: .` in `compose.example.yml` for `image: ghcr.io/yakupemreyerli/mcp-firefly-iii:latest` to use the prebuilt image — pin a version tag, not `:latest`, for anything you depend on. Single container without Compose: `docker run -d --env-file .env -p 3000:3000 ghcr.io/yakupemreyerli/mcp-firefly-iii:latest`. It refuses to start without one of the two auth modes above, and `/mcp` needs TLS in front — `compose.example.yml` has optional `cloudflare` and `caddy` profiles for that. `/health` is open, for container probes.

Configuration

Every variable, including HTTP and OAuth mode: docs/configuration.md.

Tools

The split is enforced, not just advertised — a delete reached through `firefly_query` is refused, and a connection granted only `firefly:read` never even sees the two writing tools. Responses are trimmed before they reach the model: empty and null attributes are always dropped, and every execution tool takes a `fields` list — roughly a 90% cut on a large transaction list. Full reference: docs/api/operations.md.

Security

This server never sends your data to a third party, but it doesn't control what the AI client or model you connect it to does with a response once it has one. Full threat model: SECURITY.md. Found a vulnerability? Report it privately there.

Documentation

Development

git clone https://github.com/YakupEmreYerli/mcp-firefly-iii.git && cd mcp-firefly-iii
npm install
cp .env.example .env    # fill in your instance
npm test                # mocked; never touches a live instance
npm run build
npm run check           # read-only connection check against .env

Tests are mocked and never reach the network. `npm run smoke:live` is a maintainer tool that walks every read operation against the instance in `.env`; it is read-only and not part of the published package. Bug reports and pull requests are welcome — see CONTRIBUTING.md.

License

MIT — see LICENSE.