Careful with your money data
Your budget is personal. ynab-mcp is built to change nothing unless you ask, keep your token to itself, and leave your details out of logs.
Read-only by default
A new install can read your budget and change nothing. Write tools are left out of the list Claude sees, and the server rejects them even if a client calls one by name. Writes need an explicit YNAB_READ_ONLY=false; a misspelled value stops the server instead of being read as "yes".
When writes are on, each tool carries MCP annotations that tell the client what kind of action it is. Updates and deletes are marked destructive, because YNAB has no undo, and most clients ask before running them. The tool reference shows these markers for every tool.
Your token
- In local (stdio) mode the YNAB token comes only from the server's environment, never from tool arguments, so nothing in a conversation can supply or change it.
- It is never written to logs or returned in tool responses. Errors from the YNAB API reach Claude as fixed, mapped messages, never YNAB's own text. Validation and not-found errors carry the server's own message, and any other error is returned with control characters and recognized secret patterns removed: bearer tokens, labeled values such as
token=,key=orpassword=, connection strings and file paths. The detailed error is logged internally after the same redaction. Redaction works by pattern, so a secret with no recognizable label could still get through. - The health check shows IDs masked to their first and last four characters.
- A personal access token can do anything you can do in YNAB, so keep it out of chats, issues and screenshots. Revoke it in YNAB's Developer Settings if it leaks.
Where your data goes
ynab-mcp talks to one service: the YNAB API at api.ynab.com, over HTTPS. It has no telemetry, no analytics and no central service. What Claude sees is what you'd expect: the tool results it asks for, which your MCP client sends to Claude as part of the conversation.
Caches stay in memory on the machine running the server and are dropped when it stops. This website makes no third-party requests and sets no cookies.
The audit log
Every write through ynab-mcp, successful or not, is recorded with its time, tool, the kind of record and its ID. Ask Claude to show the audit log
to review changes; the ynab_audit_log tool filters by operation, record type and outcome.
The log is kept in memory for the life of the server process (the most recent 1,000 entries). On a shared server, each user sees only their own entries.
Privacy in logs
Audit entries record which fields were present, not what they said:
| Field | Recorded as |
|---|---|
| Payee name | has_payee |
| Account or category name | has_name |
| Memo | has_memo |
Error text in the audit log is redacted for secret-looking patterns and truncated.
Input and output checks
- Inputs: every tool argument is validated with a schema before anything is sent to YNAB, including ID formats, date formats and a length limit on every text field. Oversized or deeply nested arguments are refused up front.
- Outputs: names, memos and notes from your budget are cleaned of control characters and length-limited before they go into a response.
- Money: amounts are converted with exact decimal arithmetic, never floating point, so $0.10 + $0.20 is exactly $0.30.
- Rate limits: the server keeps itself under YNAB's 200 requests an hour, so a runaway conversation can't lock your token out.
Remote servers
On a self-hosted server with OAuth, stored YNAB tokens are encrypted at rest, every user's cache, rate limit and audit log are kept separate, and each connection keeps the read-only or read-write level chosen at consent. Host and Origin checks are on by default. The remote hosting guide covers the details operators need.
Reporting a vulnerability
Please report security problems privately through GitHub's private vulnerability reporting (the repository's Security tab, then "Report a vulnerability"). Don't open a public issue.
- Include the affected version, how the server gets its YNAB credentials (stdio with a token, HTTP header mode, or HTTP OAuth mode), and steps to reproduce.
- Leave out real tokens, budget data, and working exploits against anyone else's instance.
Fixes ship in the next appropriate release, and an advisory is published once the fix is available. Problems with the YNAB API or YNAB's own OAuth service are out of scope; report those to YNAB. The full policy is in SECURITY.md.