TracFi MCP Server
Connect your TracFi financial workspace with AI models — Claude.ai, ChatGPT, Cursor IDE, or any custom AI agent. Query live balances, search transactions, analyze budgets, track goals, and record transactions securely using OAuth 2.0.
⚡ Quick Start
Create a free TracFi account at tracfi.in and set up your financial workspace.
Go to MCP Server & AI Integration in your workspace, click Request New MCP Key and submit.
Once approved by admin, use the OAuth Client ID & Secret to connect Claude, ChatGPT, Cursor, or any MCP client.
pending_approval status. A TracFi administrator must approve your request before your OAuth credentials become active. You'll see the status update on the MCP Keys page.
1. Architecture & Endpoints
TracFi implements the Model Context Protocol (MCP) v2024-11-05 over JSON-RPC 2.0. Authentication is handled via OAuth 2.0 (Authorization Code with PKCE, or Client Credentials).
All MCP operations (initialize, tools/list, tools/call) are sent as POST requests with a JSON-RPC 2.0 body to this URL. This is the URL you enter as "Server URL" in any MCP client.
User consent & redirect for Authorization Code flow (used by Claude.ai).
Exchange authorization codes for access tokens, or use Client Credentials grant.
Standard input/output JSON-RPC streams for local desktop applications. Requires the TracFi codebase to be accessible locally.
2. Admin Approval Workflow
Go to your workspace's MCP Server & AI Integration page. Click Request New MCP Key, provide a label, permission scope, and reason for access.
Your request is visible to TracFi platform administrators in the Admin Console. Keys start with status pending_approval.
Once approved, your key becomes active. Return to the MCP Keys page to view your OAuth Client ID and Client Secret, then connect your AI tool.
3. Connecting Claude.ai (Web)
Claude.ai supports remote MCP servers via OAuth 2.0. This is the easiest way to connect — no local setup required.
Navigate to MCP Server & AI Integration in your workspace. Locate your active key and click OAuth & Client Config to see your credentials.
In Claude.ai, go to Settings → Connectors (or look for the plug icon) → click Add Connector.
| Server URL | https://tracfi.in/api/mcp/index.php |
| OAuth Client ID | tracfi_cid_<hex>_<your client id> |
| OAuth Client Secret | tracfi_sec_<hex>_<your client secret> |
⚠️ The Client Secret is only shown once at creation. Store it safely.
Claude will redirect you to https://tracfi.in/authorize. Make sure you're logged in to TracFi. Review the access details and click Authorize & Connect.
The connector status should show 7 tools available. You can now ask Claude things like "What's my financial summary this month?" or "Show me my top expenses in July."
4. Claude Desktop (Local STDIO)
Claude Desktop uses a local STDIO connection. You need the TracFi server files accessible on your machine.
Edit your claude_desktop_config.json file:
{
"mcpServers": {
"tracfi": {
"command": "php",
"args": [
"/path/to/tracfi/mcp/cli.php"
],
"env": {
"TRACFI_MCP_KEY": "tracfi_mcp_YOUR_HEX_ID_YOUR_APPROVED_SECRET",
"TRACFI_WORKSPACE_HEX_ID": "YOUR_HEX_ID"
}
}
}
}
~/Library/Application Support/Claude/claude_desktop_config.json%APPDATA%\Claude\claude_desktop_config.json5. Cursor IDE
In Cursor Settings → Features → MCP Servers → click + Add New MCP Server:
| Name | TracFi |
| Type | command |
| Command | php /path/to/tracfi/mcp/cli.php --key=tracfi_mcp_HEX_YOUR_SECRET --hex=YOUR_HEX_ID |
Replace /path/to/tracfi with the actual absolute path to your TracFi installation.
6. ChatGPT / Custom GPTs
Use the Client Credentials grant to get an access token programmatically, then send MCP requests directly.
curl -X POST https://tracfi.in/api/mcp/oauth/token.php \ -H "Content-Type: application/x-www-form-urlencoded" \ -d "grant_type=client_credentials" \ -d "client_id=tracfi_cid_YOUR_CLIENT_ID" \ -d "client_secret=tracfi_sec_YOUR_CLIENT_SECRET"
{
"access_token": "tracfi_at_d3e7c3_abc123...",
"token_type": "Bearer",
"expires_in": 86400,
"scope": "read_only",
"workspace_hex": "d3e7c3"
}
curl -X POST https://tracfi.in/api/mcp/index.php \
-H "Content-Type: application/json" \
-H "Authorization: Bearer tracfi_at_d3e7c3_abc123..." \
-d '{
"jsonrpc": "2.0",
"id": 1,
"method": "tools/call",
"params": {
"name": "get_workspace_summary",
"arguments": {}
}
}'
7. Custom HTTP API / Direct API Key
Advanced users and developers can call the MCP server directly using a raw secret API key (without OAuth):
curl -X POST https://tracfi.in/api/mcp/index.php \
-H "Content-Type: application/json" \
-H "Authorization: Bearer tracfi_mcp_YOUR_HEX_ID_YOUR_SECRET_KEY" \
-H "X-Workspace-Hex-ID: YOUR_HEX_ID" \
-d '{
"jsonrpc": "2.0",
"id": 1,
"method": "tools/call",
"params": {
"name": "get_transactions",
"arguments": {
"limit": 10,
"type": "expense",
"start_date": "2026-08-01",
"end_date": "2026-08-02"
}
}
}'
# Python example
import requests
response = requests.post(
"https://tracfi.in/api/mcp/index.php",
headers={
"Authorization": "Bearer tracfi_mcp_YOUR_HEX_ID_YOUR_SECRET",
"Content-Type": "application/json"
},
json={
"jsonrpc": "2.0",
"id": 1,
"method": "tools/call",
"params": {
"name": "get_financial_health_insights",
"arguments": {}
}
}
)
print(response.json())
8. OAuth 2.0 Endpoint Reference
| Endpoint | URL | Purpose |
|---|---|---|
| MCP Server | https://tracfi.in/api/mcp/index.php | All JSON-RPC 2.0 tool calls |
| Authorization | https://tracfi.in/authorize | User consent page (Authorization Code flow) |
| Token | https://tracfi.in/api/mcp/oauth/token.php | Exchange code or client credentials for access token |
| Discovery | https://tracfi.in/.well-known/oauth-authorization-server | RFC 8414 OAuth metadata (auto-discovery) |
authorization_code — Used by Claude.ai web (includes PKCE S256 support)client_credentials — Used by ChatGPT Custom GPTs, server-to-server integrations9. Available MCP Tools (7 Tools)
Once connected, these tools are available to your AI model:
| Tool | Description | Access | Key Parameters |
|---|---|---|---|
| get_workspace_summary | Net balance, monthly income/expenses, savings & goals count. | READ | month (YYYY-MM) |
| get_accounts | List all bank, card, wallet & cash accounts with live balances. | READ | active_only (bool) |
| get_transactions | Paginated transaction search by date, type, category, or text. | READ | limit, offset, type, start_date, end_date, query |
| add_transaction | Record a new income or expense transaction. | WRITE | account_id, amount, type, name, date |
| get_budgets | Monthly budget plan vs. actual spending breakdown by category. | READ | month (YYYY-MM) |
| get_savings_and_goals | Active FD/RD/gold investments and long-term savings goal progress. | READ | — |
| get_financial_health_insights | Automated savings rate %, emergency fund months, and health score. | READ | — |
* add_transaction requires a read_write permission key.
10. Security Model
Every query is scoped exclusively to workspace_id. Cross-tenant data access is structurally impossible.
Raw secret keys are shown only once. The server stores only SHA-256 hashes — never plaintext secrets.
All keys require explicit administrator approval before they can be used. Unapproved keys are rejected with a 403 JSON-RPC error.
Every request — successful or failed — is logged with timestamp, tool name, execution time, client IP, and user agent.
OAuth access tokens expire after 24 hours. Keys can also have optional expiry dates.
Authorization Code flow supports PKCE (S256 & plain) as required by modern OAuth 2.0 clients including Claude.ai.