{ "SchemaVersion": "1", "Kind": "DirectoryIssues", "Slug": "copilot-money", "Name": "Copilot Money", "CanonicalUrl": "https://askpod.ai/mcp/copilot-money/issues", "ServerUrl": "https://askpod.ai/mcp/copilot-money", "IssueTotal": 44, "Held": 22, "Issues": [ { "Title": "[Audit] Unaddressed suggestions from PR #668", "Excerpt": "## Unaddressed review suggestions from PR #668\n\n**PR title:** fix(decoder): key account dedup on account_id, not name and mask (#662)\n\n### MEDIUM: getHoldings() reads db.getAccounts() without the user_deleted/user_hidden filter that get_accounts applies, so a merged/hidden account's stale twin can contribute holdings post-fix.\n\n- **File:** `src/tools/tools.ts`:2515\n- **Reviewer said:** > getHoldings — src/tools/tools.ts:2515, iterates every account's acct.holdings ... Apply the same filter and a", "SourceUrl": "https://github.com/ignaciohermosillacornejo/copilot-money-mcp/issues/688", "PublishedAt": "2026-08-30T08:00:08.000Z", "State": "open", "Comments": 0, "Reporter": "External", "Rank": "recent", "Extractor": "github_issue" }, { "Title": "[Audit] Unaddressed suggestions from PR #679", "Excerpt": "## Unaddressed review suggestions from PR #679\n\n**PR title:** fix(security): stop allowlisting what the concealment gate inspects\n\n### HIGH: checkGitAttributes strips everything after a '#' anywhere on the line, not just leading comments, so a mid-line '#' lets a diff-suppressing gitattributes entry (e.g. 'src/pay#load.ts binary') slip past the new rule.\n\n- **File:** `scripts/check-concealment.ts`:395\n- **Reviewer said:** > gitattributes(5) says \"Lines that begin with # are ignored.\" Only at lin", "SourceUrl": "https://github.com/ignaciohermosillacornejo/copilot-money-mcp/issues/686", "PublishedAt": "2026-08-30T07:10:49.000Z", "State": "open", "Comments": 0, "Reporter": "External", "Rank": "recent", "Extractor": "github_issue" }, { "Title": "[Audit] Unaddressed suggestions from PR #678", "Excerpt": "## Unaddressed review suggestions from PR #678\n\n**PR title:** docs(audits): record the 2026-08-29 completeness-guard audit\n\n### MEDIUM: F16 was withdrawn from §3 but remains in the §5 remediation table, scheduling a non-existent finding for execution.\n\n- **File:** `docs/audits/2026-08-29-completeness-guard-audit.md`:404\n- **Reviewer said:** > `:404` still schedules a withdrawn finding... `| 6 | F11, F13, F16, F17, F18 |` ... a reader executing §5 top-to-bottom goes hunting for a defect that does", "SourceUrl": "https://github.com/ignaciohermosillacornejo/copilot-money-mcp/issues/682", "PublishedAt": "2026-08-30T06:57:04.000Z", "State": "open", "Comments": 0, "Reporter": "External", "Rank": "recent", "Extractor": "github_issue" }, { "Title": "[Audit] Unaddressed suggestions from PR #676", "Excerpt": "## Unaddressed review suggestions from PR #676\n\n**PR title:** test(field-selection): discover presets instead of listing them\n\n### HIGH: discoverStringConstants does not strip inline comments before parsing, so KNOWN_FREQUENCIES and IGNORED_ITEM_FIELDS escape discovery and are absent from PINNED.\n\n- **File:** `tests/exported-constants.test.ts`:89\n- **Reviewer said:** > Discovery is blind to any array containing an inline comment — 2 of 25 constants escape today: KNOWN_FREQUENCIES in src/models/r", "SourceUrl": "https://github.com/ignaciohermosillacornejo/copilot-money-mcp/issues/677", "PublishedAt": "2026-08-30T00:02:10.000Z", "State": "open", "Comments": 0, "Reporter": "External", "Rank": "recent", "Extractor": "github_issue" }, { "Title": "schema drop on holdings price fields: \"expected number, received number\" (app 6.4.4, mcp 2.3.0)", "Excerpt": "## Environment\n\n- copilot-money-mcp: 2.3.0 (npm, cache-only mode, no flags)\n- Copilot Money macOS app: 6.4.4 (332)\n- macOS 26.3.1, Node 26.5.0\n\n## Symptom\n\n\\`get_cache_info\\` reports \\`decode_health: degraded\\` — 19 documents dropped: 18 in \\`holdings_history\\` and 1 in \\`accounts\\`. All drops are on holdings price fields with a confusing Zod error:\n\n```\nschema drop: collection=accounts docId= path=holdings.0.institution_price code=invalid_type message=\"Invalid input: expected number, ", "SourceUrl": "https://github.com/ignaciohermosillacornejo/copilot-money-mcp/issues/659", "PublishedAt": "2026-08-18T05:53:49.000Z", "State": "closed", "Comments": 1, "Reporter": "External", "Rank": "recent", "Extractor": "github_issue" }, { "Title": "get_accounts_live (and all --live-reads/--write tools) blocked by db.isAvailable() check even when native app isn't installed", "Excerpt": "## Summary\n\n`handleCallTool()` in `dist/cli.js` gates **every** tool call behind `this.db.isAvailable()`, which only checks for the native Copilot Money macOS app's local LevelDB cache (`~/Library/Containers/com.copilot.production/...`). This blocks pure live/GraphQL tools like `get_accounts_live`, `get_connection_status`, `get_cache_info`, etc. — which never touch `this.db` at all (their handlers call `ctx.live.*` directly, confirmed in `TOOL_REGISTRY`) — on any machine where the native app isn", "SourceUrl": "https://github.com/ignaciohermosillacornejo/copilot-money-mcp/issues/640", "PublishedAt": "2026-08-13T23:09:40.000Z", "State": "closed", "Comments": 0, "Reporter": "External", "Rank": "recent", "Extractor": "github_issue" }, { "Title": "context-budget test reads real $HOME state, and get_connection_status embeds an unbounded scheduled-smoke report", "Excerpt": "Found while working on #632. Two related things, one a plain test bug, the other a design gap in a budgeted surface. **Neither is a defect in your `scheduled-smoke.ts` writer** — see the disclosure at the end, which matters for how you scope the fix.\n\n## 1. `tests/context-budget.test.ts` reads real `$HOME` state\n\n`bun run check` fails on any machine that has a `~/.claude/copilot-money/scheduled-smoke.json`:\n\n```\n(fail) context-budget ratchet (#597) > response-size budgets (cache-mode read tools,", "SourceUrl": "https://github.com/ignaciohermosillacornejo/copilot-money-mcp/issues/638", "PublishedAt": "2026-08-12T12:40:55.000Z", "State": "closed", "Comments": 2, "Reporter": "Contributor", "Rank": "top", "Extractor": "github_issue" }, { "Title": "leveldb-reader: temp DB copies (`copilot-leveldb-*`) leak — deferred setTimeout cleanup never fires in short-lived server/worker (33GB observed)", "Excerpt": "### Summary\n\n`copyDatabaseToTemp` copies the Copilot LevelDB (~120 MB) into `os.tmpdir()` as `copilot-leveldb-XXXXXX` on every read, but the cleanup is **deferred** via `setTimeout(…, TEMP_DB_CACHE_TTL)` (5 min). Because the MCP server typically runs as a **short-lived, per-request process** — and decoding happens in a **worker thread** (`dist/decode-worker.js`) that is terminated right after it posts its result — the process/worker almost always exits **before** the timer fires. Pending timers ", "SourceUrl": "https://github.com/ignaciohermosillacornejo/copilot-money-mcp/issues/631", "PublishedAt": "2026-08-09T15:16:41.000Z", "State": "closed", "Comments": 0, "Reporter": "Contributor", "Rank": "recent", "Extractor": "github_issue" }, { "Title": "[Audit] Unaddressed suggestions from PR #600", "Excerpt": "## Unaddressed review suggestions from PR #600\n\n**PR title:** perf(server): compact JSON tool responses (#597 T0)\n\n### LOW: Redundant JSON.parse and toBeDefined assertions remain after the compact-JSON test already validates parseability via the toBe round-trip assertion on line 439.\n\n- **File:** `tests/unit/server-protocol.test.ts`:441\n- **Reviewer said:** > One small observation: the third assertion at line 441–442 ... This is redundant. If `JSON.parse` threw, the test would already fail ... N", "SourceUrl": "https://github.com/ignaciohermosillacornejo/copilot-money-mcp/issues/601", "PublishedAt": "2026-08-02T22:18:02.000Z", "State": "closed", "Comments": 0, "Reporter": "External", "Rank": "recent", "Extractor": "github_issue" }, { "Title": "get_transactions has no field selection — full ~35-40 field document per row is mostly unused bloat", "Excerpt": "## Summary\n\n`get_transactions` returns the full Firestore transaction document per row — ~35-40 fields including internal IDs (`item_id`, `user_id`, `plaid_category_id`, `parent_transaction_id`), Plaid metadata (`plaid_category_strings`, `plaid_transaction_type`, `plaid_deleted`), intelligence-suggestion arrays (`intelligence_suggested_category_ids`), and assorted flags (`is_amazon`, `from_investment`, `account_dashboard_active`, `_origin`, etc.). For most spending-analysis use cases only a hand", "SourceUrl": "https://github.com/ignaciohermosillacornejo/copilot-money-mcp/issues/592", "PublishedAt": "2026-08-01T02:16:43.000Z", "State": "closed", "Comments": 2, "Reporter": "Contributor", "Rank": "top", "Extractor": "github_issue" }, { "Title": "get_accounts embeds full base64 institution logos, bloating responses ~20-30x", "Excerpt": "## Summary\n\n`get_accounts` embeds each account's institution `logo` as a full base64-encoded PNG (`logo` + `logo_content_type` fields), straight from the cached Firestore document, with no way to opt out. For a normal set of linked accounts this dominates the response size — in my case, 15 accounts came back as ~66KB of JSON, and grep'ing the response showed the actual financial data (balances, names, masks, institution names) was only ~2-3KB of that. The rest was inline PNG bytes.\n\nFor an MCP c", "SourceUrl": "https://github.com/ignaciohermosillacornejo/copilot-money-mcp/issues/589", "PublishedAt": "2026-08-01T01:12:13.000Z", "State": "closed", "Comments": 0, "Reporter": "Contributor", "Rank": "recent", "Extractor": "github_issue" }, { "Title": "[Audit] Unaddressed suggestions from PR #514", "Excerpt": "## Unaddressed review suggestions from PR #514\n\n**PR title:** fix(write): split_transaction resolves parent content live-first\n\n### LOW: Error message still exposes internal LevelDB field name 'original_name' in a user-facing string, even though that fallback is now hidden inside resolveParentSnapshot and this branch is unreachable in live mode.\n\n- **File:** `src/tools/tools.ts`:3192\n- **Reviewer said:** > The phrase \"or original_name\" is internal LevelDB vocabulary leaking into a user-facing er", "SourceUrl": "https://github.com/ignaciohermosillacornejo/copilot-money-mcp/issues/515", "PublishedAt": "2026-07-06T02:16:16.000Z", "State": "closed", "Comments": 0, "Reporter": "External", "Rank": "recent", "Extractor": "github_issue" }, { "Title": "Your MCP server is graded 🟢 SAFE on Agent Skills Hub", "Excerpt": "Hi! I run [Agent Skills Hub](https://agentskillshub.top/), an open directory that security-grades & quality-scores MCP servers and agent skills. {repo} came through 🟢 SAFE — nice work. If useful, you can show the grade in your README:\n\n\n[![Security-graded by Agent Skills Hub](https://agentskillshub.top/badge/ignaciohermosillacornejo/copilot-money-mcp.svg)](https://agentskillshub.top/skill/ignaciohermosillacornejo/copilot-money-mcp/)\n\nIt renders a 🟢 SAFE badge linking to your skill's page (grade ", "SourceUrl": "https://github.com/ignaciohermosillacornejo/copilot-money-mcp/issues/503", "PublishedAt": "2026-06-23T02:31:19.000Z", "State": "closed", "Comments": 1, "Reporter": "External", "Rank": "recent", "Extractor": "github_issue" }, { "Title": "[Audit] Unaddressed suggestions from PR #490", "Excerpt": "## Unaddressed review suggestions from PR #490\n\n**PR title:** chore(deps): bump grouped dev + prod dependencies (#485, #486)\n\n### MEDIUM: `graphql` was added to `dependencies` but is only used in scripts and tests (not in `src/`), so it should remain solely in `devDependencies`.\n\n- **File:** `package.json`:86\n- **Reviewer said:** > `graphql` now appears in both `dependencies` and `devDependencies` ... It is not imported in any src/ file ... graphql must stay in devDependencies only.\n- **Evidence", "SourceUrl": "https://github.com/ignaciohermosillacornejo/copilot-money-mcp/issues/491", "PublishedAt": "2026-06-14T01:54:41.000Z", "State": "closed", "Comments": 0, "Reporter": "External", "Rank": "recent", "Extractor": "github_issue" }, { "Title": "[Audit] Unaddressed suggestions from PR #476", "Excerpt": "## Unaddressed review suggestions from PR #476\n\n**PR title:** ci: require the External assumptions section in PR bodies\n\n### LOW: Doc comment references wrong test file path — missing `scripts/` subdirectory and uses `.sh` extension instead of `.ts`.\n\n- **File:** `scripts/check-pr-sections.sh`:21\n- **Reviewer said:** > # locally: see tests/check-pr-sections.test.sh.\n- **Evidence not applied:** Line 21 still reads `# locally: see tests/check-pr-sections.test.sh.` in the merged file — wrong subdir", "SourceUrl": "https://github.com/ignaciohermosillacornejo/copilot-money-mcp/issues/479", "PublishedAt": "2026-06-13T07:58:31.000Z", "State": "closed", "Comments": 0, "Reporter": "External", "Rank": "recent", "Extractor": "github_issue" }, { "Title": "[Audit] Unaddressed suggestions from PR #466", "Excerpt": "## Unaddressed review suggestions from PR #466\n\n**PR title:** C1: weekly scheduled drift check via launchd\n\n### LOW: Bare JSON.parse(readFileSync(statusPath)) throws an unhelpful ENOENT if runScheduledSmoke() ever exits before writing the status file, making test failures hard to diagnose.\n\n- **File:** `tests/scripts/scheduled-smoke-e2e.test.ts`:40\n- **Reviewer said:** > A `try/catch` returning a helpful message would make test failures easier to diagnose. Minor.\n- **Evidence not applied:** Line", "SourceUrl": "https://github.com/ignaciohermosillacornejo/copilot-money-mcp/issues/468", "PublishedAt": "2026-06-11T07:46:13.000Z", "State": "closed", "Comments": 0, "Reporter": "External", "Rank": "recent", "Extractor": "github_issue" }, { "Title": "Unable to attach to server", "Excerpt": "\"Image\"\n\nwhat am I doing wrong", "SourceUrl": "https://github.com/ignaciohermosillacornejo/copilot-money-mcp/issues/249", "PublishedAt": "2026-04-14T04:14:12.000Z", "State": "closed", "Comments": 14, "Reporter": "External", "Rank": "top", "Extractor": "github_issue" }, { "Title": "[Audit] Unaddressed suggestions from PR #234", "Excerpt": "## Unaddressed Review Suggestions from PR #234\n\n**PR Title:** fix(skill): finance-trip improvements from smoke test\n\nThe following suggestions from Claude's code review were identified as potentially unaddressed:\n\n### 1. LOW Priority\n\n\nConsider moving it to a more stable section, e.g., a `## Location` or `## Personal Info` section, or at minimum placing it above the comment so it's clearly distinguished from the trip list entries.\n\n\n---\n*This issue was automatically created by the PR Review Audi", "SourceUrl": "https://github.com/ignaciohermosillacornejo/copilot-money-mcp/issues/236", "PublishedAt": "2026-04-13T21:56:47.000Z", "State": "closed", "Comments": 1, "Reporter": "External", "Rank": "top", "Extractor": "github_issue" }, { "Title": "[Audit] Unaddressed suggestions from PR #190", "Excerpt": "## Unaddressed Review Suggestions from PR #190\n\n**PR Title:** feat: add 6 missing tools — balance history, investment performance, TWR, securities, goal history, update recurring\n\nThe following suggestions from Claude's code review were identified as potentially unaddressed:\n\n### 1. LOW Priority\n\n\nCode change suggested: \nBoth branches return the same thing. The `if/else` structure could be simplified to just `await this.loadAllCollections(); return this._balanceHistory ?? []` — but since this mi", "SourceUrl": "https://github.com/ignaciohermosillacornejo/copilot-money-mcp/issues/191", "PublishedAt": "2026-04-08T07:13:04.000Z", "State": "closed", "Comments": 1, "Reporter": "External", "Rank": "top", "Extractor": "github_issue" }, { "Title": "[Audit] Unaddressed suggestions from PR #188", "Excerpt": "## Unaddressed Review Suggestions from PR #188\n\n**PR Title:** fix: audit workflow — trigger on merge, fix bot detection\n\nThe following suggestions from Claude's code review were identified as potentially unaddressed:\n\n### 1. LOW Priority\n\n\n`isLikelyAddressed()` logic is correct: merged PRs → blocking suggestions treated as resolved, non-blocking as p\n\n### 2. LOW Priority\n\n\nCode change suggested: \nNow that the root cause is confirmed (`github-actions[bot]` is the actual poster), the `claude` and ", "SourceUrl": "https://github.com/ignaciohermosillacornejo/copilot-money-mcp/issues/189", "PublishedAt": "2026-04-08T03:47:18.000Z", "State": "closed", "Comments": 1, "Reporter": "External", "Rank": "top", "Extractor": "github_issue" }, { "Title": "Feature request: get_holdings / get_securities tool for investment positions", "Excerpt": "First off — amazing project. I use this daily and it's become essential to my personal finance workflow.\nI noticed PR #35 added \"Phases 7-12: Investment tracking, analytics & search tools\" and the implementation plan mentions holdings/securities support. Are these tools available or planned for an upcoming release?\nWhat I'm looking for:\nA tool that returns individual investment holdings — ticker, quantity, current price, average cost, total return, and which account they're in. Basically the dat", "SourceUrl": "https://github.com/ignaciohermosillacornejo/copilot-money-mcp/issues/147", "PublishedAt": "2026-03-29T04:21:38.000Z", "State": "closed", "Comments": 7, "Reporter": "External", "Rank": "top", "Extractor": "github_issue" }, { "Title": "Transaction dedup drops real transactions + category totals double-count pending charges", "Excerpt": "

Hey! Love this project … reading directly from the local Firestore cache is so much cleaner than scraping. I've been integrating it into a personal finance assistant and ran into two related data quality issues that both trace back to the same spot in decodeTransactions().

\n