MCP server · 2026

mcp-firefly-iii

Security-first, self-hosted MCP server for Firefly III: 152 operations behind 5 scoped tools.

What it does

5 tools instead of 152: query, mutate and destructive, plus two discovery tools; a typed registry maps every Firefly endpoint onto them.
dry_run on every write returns the exact request, resolved record IDs included, without sending it.
Bulk writes need max_matches and refuse an incomplete scan before the first write.
Read, write and destructive are scoped separately and enforced: by the Firefly token over stdio, by OAuth scope or a static token over HTTP.
A built-in OAuth 2.1 server lets Claude web, Claude mobile and ChatGPT connect, with no separate Keycloak or Authentik.
Docker images for linux/amd64 and linux/arm64, and a setup command that configures Claude Code and Claude Desktop.

Problem: Connecting an AI assistant to a personal finance app is risky when one tool can read, change and delete everything.
My role: I designed and built it, and I maintain it and publish the releases.
Solution: 152 Firefly III operations behind 5 tools. Read, write and delete each need their own permission, and every write can be previewed with dry_run. A built-in OAuth server lets Claude and ChatGPT connect from the web.
Result: Listed in Firefly III’s official documentation, the MCP Registry and Glama; releases are built by CI with npm provenance.

A security-first, self-hosted MCP server for Firefly III. It puts 152 operations behind 5 tools, each with its own scoped permissions.

It runs over stdio or authenticated HTTP, and it is listed in the official Firefly III documentation.