Reported issues for Copilot Money
Pod holds 22 of 44 problems reported by people outside the maintainer team. Issues filed by the project's own owners, members and collaborators are excluded entirely — a maintainer's release checklist is not a warning to a prospective user.
Back to Copilot Money.
Most discussed
context-budget test reads real $HOME state, and get_connection_status embeds an unbounded scheduled-smoke report
Found while working on #632. Two related things, one a plain test bug, the other a design gap in a budgeted surface. Neither is a defect in your scheduled-smoke.ts writer — see the disclosure at the end, which matters for how you scope the fix.
1. tests/context-budget.test.ts reads real $HOME state
bun run check fails on any machine that has a ~/.claude/copilot-money/scheduled-smoke.json:
(fail) context-budget ratchet (#597) > response-size budgets (cache-mode read tools,
[Read the thread](https://github.com/ignaciohermosillacornejo/copilot-money-mcp/issues/638) · 2026-08-12 · closed · outside contributor · 2 comments
### get_transactions has no field selection — full ~35-40 field document per row is mostly unused bloat
## Summary
`get_transactions` returns the full Firestore transaction document per row — ~35-40 fields including internal IDs (`item_id`, `user_id`, `plaid_category_id`, `parent_transaction_id`), Plaid metadata (`plaid_category_strings`, `plaid_transaction_type`, `plaid_deleted`), intelligence-suggestion arrays (`intelligence_suggested_category_ids`), and assorted flags (`is_amazon`, `from_investment`, `account_dashboard_active`, `_origin`, etc.). For most spending-analysis use cases only a hand
[Read the thread](https://github.com/ignaciohermosillacornejo/copilot-money-mcp/issues/592) · 2026-08-01 · closed · outside contributor · 2 comments
### Unable to attach to server
<img width="1251" height="882" alt="Image" src="https://github.com/user-attachments/assets/2dc79c13-d089-4e0b-9bdc-ef6a3ecdda2b" />
what am I doing wrong
[Read the thread](https://github.com/ignaciohermosillacornejo/copilot-money-mcp/issues/249) · 2026-04-14 · closed · external user · 14 comments
### [Audit] Unaddressed suggestions from PR #234
## Unaddressed Review Suggestions from PR #234
**PR Title:** fix(skill): finance-trip improvements from smoke test
The following suggestions from Claude's code review were identified as potentially unaddressed:
### 1. LOW Priority
Consider moving it to a more stable section, e.g., a `## Location` or `## Personal Info` section, or at minimum placing it above the comment so it's clearly distinguished from the trip list entries.
---
*This issue was automatically created by the PR Review Audi
[Read the thread](https://github.com/ignaciohermosillacornejo/copilot-money-mcp/issues/236) · 2026-04-13 · closed · external user · 1 comment
### [Audit] Unaddressed suggestions from PR #190
## Unaddressed Review Suggestions from PR #190
**PR Title:** feat: add 6 missing tools — balance history, investment performance, TWR, securities, goal history, update recurring
The following suggestions from Claude's code review were identified as potentially unaddressed:
### 1. LOW Priority
Code change suggested:
Both branches return the same thing. The `if/else` structure could be simplified to just `await this.loadAllCollections(); return this._balanceHistory ?? []` — but since this mi
[Read the thread](https://github.com/ignaciohermosillacornejo/copilot-money-mcp/issues/191) · 2026-04-08 · closed · external user · 1 comment
### [Audit] Unaddressed suggestions from PR #188
## Unaddressed Review Suggestions from PR #188
**PR Title:** fix: audit workflow — trigger on merge, fix bot detection
The following suggestions from Claude's code review were identified as potentially unaddressed:
### 1. LOW Priority
`isLikelyAddressed()` logic is correct: merged PRs → blocking suggestions treated as resolved, non-blocking as p
### 2. LOW Priority
Code change suggested:
Now that the root cause is confirmed (`github-actions[bot]` is the actual poster), the `claude` and
[Read the thread](https://github.com/ignaciohermosillacornejo/copilot-money-mcp/issues/189) · 2026-04-08 · closed · external user · 1 comment
### Feature request: get_holdings / get_securities tool for investment positions
First off — amazing project. I use this daily and it's become essential to my personal finance workflow.
I noticed PR #35 added "Phases 7-12: Investment tracking, analytics & search tools" and the implementation plan mentions holdings/securities support. Are these tools available or planned for an upcoming release?
What I'm looking for:
A tool that returns individual investment holdings — ticker, quantity, current price, average cost, total return, and which account they're in. Basically the dat
[Read the thread](https://github.com/ignaciohermosillacornejo/copilot-money-mcp/issues/147) · 2026-03-29 · closed · external user · 7 comments
### Transaction dedup drops real transactions + category totals double-count pending charges
<p style="margin: 0.0px 0.0px 10.0px 0.0px; font: 11.0px 'Times New Roman'"><span style="font-family: 'Times New Roman'; font-weight: normal; font-style: normal; font-size: 11.00px">Hey! Love this project … reading directly from the local Firestore cache is so much cleaner than scraping. I've been integrating it into a personal finance assistant and ran into two related data quality issues that both trace back to the same spot in decodeTransactions().</span></p>
<p style="margin: 10.0px 0.0px 0.
[Read the thread](https://github.com/ignaciohermosillacornejo/copilot-money-mcp/issues/119) · 2026-03-04 · closed · external user · 2 comments
## Most recent
### [Audit] Unaddressed suggestions from PR #668
## Unaddressed review suggestions from PR #668
**PR title:** fix(decoder): key account dedup on account_id, not name and mask (#662)
### MEDIUM: getHoldings() reads db.getAccounts() without the user_deleted/user_hidden filter that get_accounts applies, so a merged/hidden account's stale twin can contribute holdings post-fix.
- **File:** `src/tools/tools.ts`:2515
- **Reviewer said:** > getHoldings — src/tools/tools.ts:2515, iterates every account's acct.holdings ... Apply the same filter and a
[Read the thread](https://github.com/ignaciohermosillacornejo/copilot-money-mcp/issues/688) · 2026-08-30 · open · external user · 0 comments
### [Audit] Unaddressed suggestions from PR #679
## Unaddressed review suggestions from PR #679
**PR title:** fix(security): stop allowlisting what the concealment gate inspects
### HIGH: checkGitAttributes strips everything after a '#' anywhere on the line, not just leading comments, so a mid-line '#' lets a diff-suppressing gitattributes entry (e.g. 'src/pay#load.ts binary') slip past the new rule.
- **File:** `scripts/check-concealment.ts`:395
- **Reviewer said:** > gitattributes(5) says "Lines that begin with # are ignored." Only at lin
[Read the thread](https://github.com/ignaciohermosillacornejo/copilot-money-mcp/issues/686) · 2026-08-30 · open · external user · 0 comments
### [Audit] Unaddressed suggestions from PR #678
## Unaddressed review suggestions from PR #678
**PR title:** docs(audits): record the 2026-08-29 completeness-guard audit
### MEDIUM: F16 was withdrawn from §3 but remains in the §5 remediation table, scheduling a non-existent finding for execution.
- **File:** `docs/audits/2026-08-29-completeness-guard-audit.md`:404
- **Reviewer said:** > `:404` still schedules a withdrawn finding... `| 6 | F11, F13, F16, F17, F18 |` ... a reader executing §5 top-to-bottom goes hunting for a defect that does
[Read the thread](https://github.com/ignaciohermosillacornejo/copilot-money-mcp/issues/682) · 2026-08-30 · open · external user · 0 comments
### [Audit] Unaddressed suggestions from PR #676
## Unaddressed review suggestions from PR #676
**PR title:** test(field-selection): discover presets instead of listing them
### HIGH: discoverStringConstants does not strip inline comments before parsing, so KNOWN_FREQUENCIES and IGNORED_ITEM_FIELDS escape discovery and are absent from PINNED.
- **File:** `tests/exported-constants.test.ts`:89
- **Reviewer said:** > Discovery is blind to any array containing an inline comment — 2 of 25 constants escape today: KNOWN_FREQUENCIES in src/models/r
[Read the thread](https://github.com/ignaciohermosillacornejo/copilot-money-mcp/issues/677) · 2026-08-30 · open · external user · 0 comments
### schema drop on holdings price fields: "expected number, received number" (app 6.4.4, mcp 2.3.0)
## Environment
- copilot-money-mcp: 2.3.0 (npm, cache-only mode, no flags)
- Copilot Money macOS app: 6.4.4 (332)
- macOS 26.3.1, Node 26.5.0
## Symptom
\`get_cache_info\` reports \`decode_health: degraded\` — 19 documents dropped: 18 in \`holdings_history\` and 1 in \`accounts\`. All drops are on holdings price fields with a confusing Zod error:
schema drop: collection=accounts docId=
Read the thread · 2026-08-18 · closed · external user · 1 comment
get_accounts_live (and all --live-reads/--write tools) blocked by db.isAvailable() check even when native app isn't installed
Summary
handleCallTool() in dist/cli.js gates every tool call behind this.db.isAvailable(), which only checks for the native Copilot Money macOS app's local LevelDB cache (~/Library/Containers/com.copilot.production/...). This blocks pure live/GraphQL tools like get_accounts_live, get_connection_status, get_cache_info, etc. — which never touch this.db at all (their handlers call ctx.live.* directly, confirmed in TOOL_REGISTRY) — on any machine where the native app isn
Read the thread · 2026-08-13 · closed · external user · 0 comments
leveldb-reader: temp DB copies (copilot-leveldb-*) leak — deferred setTimeout cleanup never fires in short-lived server/worker (33GB observed)
Summary
copyDatabaseToTemp copies the Copilot LevelDB (~120 MB) into os.tmpdir() as copilot-leveldb-XXXXXX on every read, but the cleanup is deferred via setTimeout(…, TEMP_DB_CACHE_TTL) (5 min). Because the MCP server typically runs as a short-lived, per-request process — and decoding happens in a worker thread (dist/decode-worker.js) that is terminated right after it posts its result — the process/worker almost always exits before the timer fires. Pending timers
Read the thread · 2026-08-09 · closed · outside contributor · 0 comments
[Audit] Unaddressed suggestions from PR #600
Unaddressed review suggestions from PR #600
PR title: perf(server): compact JSON tool responses (#597 T0)
LOW: Redundant JSON.parse and toBeDefined assertions remain after the compact-JSON test already validates parseability via the toBe round-trip assertion on line 439.
- File:
tests/unit/server-protocol.test.ts:441 - Reviewer said: > One small observation: the third assertion at line 441–442 ... This is redundant. If
JSON.parsethrew, the test would already fail ... N
Read the thread · 2026-08-02 · closed · external user · 0 comments
get_accounts embeds full base64 institution logos, bloating responses ~20-30x
Summary
get_accounts embeds each account's institution logo as a full base64-encoded PNG (logo + logo_content_type fields), straight from the cached Firestore document, with no way to opt out. For a normal set of linked accounts this dominates the response size — in my case, 15 accounts came back as ~66KB of JSON, and grep'ing the response showed the actual financial data (balances, names, masks, institution names) was only ~2-3KB of that. The rest was inline PNG bytes.
For an MCP c
Read the thread · 2026-08-01 · closed · outside contributor · 0 comments
[Audit] Unaddressed suggestions from PR #514
Unaddressed review suggestions from PR #514
PR title: fix(write): split_transaction resolves parent content live-first
LOW: Error message still exposes internal LevelDB field name 'original_name' in a user-facing string, even though that fallback is now hidden inside resolveParentSnapshot and this branch is unreachable in live mode.
- File:
src/tools/tools.ts:3192 - Reviewer said: > The phrase "or original_name" is internal LevelDB vocabulary leaking into a user-facing er
Read the thread · 2026-07-06 · closed · external user · 0 comments
Your MCP server is graded 🟢 SAFE on Agent Skills Hub
Hi! I run Agent Skills Hub, an open directory that security-grades & quality-scores MCP servers and agent skills. {repo} came through 🟢 SAFE — nice work. If useful, you can show the grade in your README:
It renders a 🟢 SAFE badge linking to your skill's page (grade
Read the thread · 2026-06-23 · closed · external user · 1 comment
[Audit] Unaddressed suggestions from PR #490
Unaddressed review suggestions from PR #490
PR title: chore(deps): bump grouped dev + prod dependencies (#485, #486)
MEDIUM: graphql was added to dependencies but is only used in scripts and tests (not in src/), so it should remain solely in devDependencies.
- File:
package.json:86 - Reviewer said: >
graphqlnow appears in bothdependenciesanddevDependencies... It is not imported in any src/ file ... graphql must stay in devDependencies only. - **Evidence
Read the thread · 2026-06-14 · closed · external user · 0 comments
[Audit] Unaddressed suggestions from PR #476
Unaddressed review suggestions from PR #476
PR title: ci: require the External assumptions section in PR bodies
LOW: Doc comment references wrong test file path — missing scripts/ subdirectory and uses .sh extension instead of .ts.
- File:
scripts/check-pr-sections.sh:21 - Reviewer said: > # locally: see tests/check-pr-sections.test.sh.
- Evidence not applied: Line 21 still reads
# locally: see tests/check-pr-sections.test.sh.in the merged file — wrong subdir
Read the thread · 2026-06-13 · closed · external user · 0 comments
[Audit] Unaddressed suggestions from PR #466
Unaddressed review suggestions from PR #466
PR title: C1: weekly scheduled drift check via launchd
LOW: Bare JSON.parse(readFileSync(statusPath)) throws an unhelpful ENOENT if runScheduledSmoke() ever exits before writing the status file, making test failures hard to diagnose.
- File:
tests/scripts/scheduled-smoke-e2e.test.ts:40 - Reviewer said: > A
try/catchreturning a helpful message would make test failures easier to diagnose. Minor. - Evidence not applied: Line
Read the thread · 2026-06-11 · closed · external user · 0 comments
The remaining reports are on the project's issue tracker.