pod
Other formats agents might prefer:
markdownjsonllms.txt

Agent? You probably want markdown or json, or Pod over MCP.

Reported issues for Copilot Money

Pod holds 22 of 44 problems reported by people outside the maintainer team. Issues filed by the project's own owners, members and collaborators are excluded entirely — a maintainer's release checklist is not a warning to a prospective user.

Back to Copilot Money.

Most discussed

context-budget test reads real $HOME state, and get_connection_status embeds an unbounded scheduled-smoke report

Found while working on #632. Two related things, one a plain test bug, the other a design gap in a budgeted surface. Neither is a defect in your scheduled-smoke.ts writer — see the disclosure at the end, which matters for how you scope the fix.

1. tests/context-budget.test.ts reads real $HOME state

bun run check fails on any machine that has a ~/.claude/copilot-money/scheduled-smoke.json:

(fail) context-budget ratchet (#597) > response-size budgets (cache-mode read tools,

[Read the thread](https://github.com/ignaciohermosillacornejo/copilot-money-mcp/issues/638) · 2026-08-12 · closed · outside contributor · 2 comments

### get_transactions has no field selection — full ~35-40 field document per row is mostly unused bloat

## Summary

`get_transactions` returns the full Firestore transaction document per row — ~35-40 fields including internal IDs (`item_id`, `user_id`, `plaid_category_id`, `parent_transaction_id`), Plaid metadata (`plaid_category_strings`, `plaid_transaction_type`, `plaid_deleted`), intelligence-suggestion arrays (`intelligence_suggested_category_ids`), and assorted flags (`is_amazon`, `from_investment`, `account_dashboard_active`, `_origin`, etc.). For most spending-analysis use cases only a hand

[Read the thread](https://github.com/ignaciohermosillacornejo/copilot-money-mcp/issues/592) · 2026-08-01 · closed · outside contributor · 2 comments

### Unable to attach to server

<img width="1251" height="882" alt="Image" src="https://github.com/user-attachments/assets/2dc79c13-d089-4e0b-9bdc-ef6a3ecdda2b" />

what am I doing wrong

[Read the thread](https://github.com/ignaciohermosillacornejo/copilot-money-mcp/issues/249) · 2026-04-14 · closed · external user · 14 comments

### [Audit] Unaddressed suggestions from PR #234

## Unaddressed Review Suggestions from PR #234

**PR Title:** fix(skill): finance-trip improvements from smoke test

The following suggestions from Claude's code review were identified as potentially unaddressed:

### 1. LOW Priority

Consider moving it to a more stable section, e.g., a `## Location` or `## Personal Info` section, or at minimum placing it above the comment so it's clearly distinguished from the trip list entries.

---
*This issue was automatically created by the PR Review Audi

[Read the thread](https://github.com/ignaciohermosillacornejo/copilot-money-mcp/issues/236) · 2026-04-13 · closed · external user · 1 comment

### [Audit] Unaddressed suggestions from PR #190

## Unaddressed Review Suggestions from PR #190

**PR Title:** feat: add 6 missing tools — balance history, investment performance, TWR, securities, goal history, update recurring

The following suggestions from Claude's code review were identified as potentially unaddressed:

### 1. LOW Priority

Code change suggested: 
Both branches return the same thing. The `if/else` structure could be simplified to just `await this.loadAllCollections(); return this._balanceHistory ?? []` — but since this mi

[Read the thread](https://github.com/ignaciohermosillacornejo/copilot-money-mcp/issues/191) · 2026-04-08 · closed · external user · 1 comment

### [Audit] Unaddressed suggestions from PR #188

## Unaddressed Review Suggestions from PR #188

**PR Title:** fix: audit workflow — trigger on merge, fix bot detection

The following suggestions from Claude's code review were identified as potentially unaddressed:

### 1. LOW Priority

`isLikelyAddressed()` logic is correct: merged PRs → blocking suggestions treated as resolved, non-blocking as p

### 2. LOW Priority

Code change suggested: 
Now that the root cause is confirmed (`github-actions[bot]` is the actual poster), the `claude` and 

[Read the thread](https://github.com/ignaciohermosillacornejo/copilot-money-mcp/issues/189) · 2026-04-08 · closed · external user · 1 comment

### Feature request: get_holdings / get_securities tool for investment positions

First off — amazing project. I use this daily and it's become essential to my personal finance workflow.
I noticed PR #35 added "Phases 7-12: Investment tracking, analytics & search tools" and the implementation plan mentions holdings/securities support. Are these tools available or planned for an upcoming release?
What I'm looking for:
A tool that returns individual investment holdings — ticker, quantity, current price, average cost, total return, and which account they're in. Basically the dat

[Read the thread](https://github.com/ignaciohermosillacornejo/copilot-money-mcp/issues/147) · 2026-03-29 · closed · external user · 7 comments

### Transaction dedup drops real transactions + category totals double-count pending charges

<p style="margin: 0.0px 0.0px 10.0px 0.0px; font: 11.0px 'Times New Roman'"><span style="font-family: 'Times New Roman'; font-weight: normal; font-style: normal; font-size: 11.00px">Hey! Love this project … reading directly from the local Firestore cache is so much cleaner than scraping. I've been integrating it into a personal finance assistant and ran into two related data quality issues that both trace back to the same spot in decodeTransactions().</span></p>
<p style="margin: 10.0px 0.0px 0.

[Read the thread](https://github.com/ignaciohermosillacornejo/copilot-money-mcp/issues/119) · 2026-03-04 · closed · external user · 2 comments

## Most recent

### [Audit] Unaddressed suggestions from PR #668

## Unaddressed review suggestions from PR #668

**PR title:** fix(decoder): key account dedup on account_id, not name and mask (#662)

### MEDIUM: getHoldings() reads db.getAccounts() without the user_deleted/user_hidden filter that get_accounts applies, so a merged/hidden account's stale twin can contribute holdings post-fix.

- **File:** `src/tools/tools.ts`:2515
- **Reviewer said:** > getHoldings — src/tools/tools.ts:2515, iterates every account's acct.holdings ... Apply the same filter and a

[Read the thread](https://github.com/ignaciohermosillacornejo/copilot-money-mcp/issues/688) · 2026-08-30 · open · external user · 0 comments

### [Audit] Unaddressed suggestions from PR #679

## Unaddressed review suggestions from PR #679

**PR title:** fix(security): stop allowlisting what the concealment gate inspects

### HIGH: checkGitAttributes strips everything after a '#' anywhere on the line, not just leading comments, so a mid-line '#' lets a diff-suppressing gitattributes entry (e.g. 'src/pay#load.ts binary') slip past the new rule.

- **File:** `scripts/check-concealment.ts`:395
- **Reviewer said:** > gitattributes(5) says "Lines that begin with # are ignored." Only at lin

[Read the thread](https://github.com/ignaciohermosillacornejo/copilot-money-mcp/issues/686) · 2026-08-30 · open · external user · 0 comments

### [Audit] Unaddressed suggestions from PR #678

## Unaddressed review suggestions from PR #678

**PR title:** docs(audits): record the 2026-08-29 completeness-guard audit

### MEDIUM: F16 was withdrawn from §3 but remains in the §5 remediation table, scheduling a non-existent finding for execution.

- **File:** `docs/audits/2026-08-29-completeness-guard-audit.md`:404
- **Reviewer said:** > `:404` still schedules a withdrawn finding... `| 6 | F11, F13, F16, F17, F18 |` ... a reader executing §5 top-to-bottom goes hunting for a defect that does

[Read the thread](https://github.com/ignaciohermosillacornejo/copilot-money-mcp/issues/682) · 2026-08-30 · open · external user · 0 comments

### [Audit] Unaddressed suggestions from PR #676

## Unaddressed review suggestions from PR #676

**PR title:** test(field-selection): discover presets instead of listing them

### HIGH: discoverStringConstants does not strip inline comments before parsing, so KNOWN_FREQUENCIES and IGNORED_ITEM_FIELDS escape discovery and are absent from PINNED.

- **File:** `tests/exported-constants.test.ts`:89
- **Reviewer said:** > Discovery is blind to any array containing an inline comment — 2 of 25 constants escape today: KNOWN_FREQUENCIES in src/models/r

[Read the thread](https://github.com/ignaciohermosillacornejo/copilot-money-mcp/issues/677) · 2026-08-30 · open · external user · 0 comments

### schema drop on holdings price fields: "expected number, received number" (app 6.4.4, mcp 2.3.0)

## Environment

- copilot-money-mcp: 2.3.0 (npm, cache-only mode, no flags)
- Copilot Money macOS app: 6.4.4 (332)
- macOS 26.3.1, Node 26.5.0

## Symptom

\`get_cache_info\` reports \`decode_health: degraded\` — 19 documents dropped: 18 in \`holdings_history\` and 1 in \`accounts\`. All drops are on holdings price fields with a confusing Zod error:

schema drop: collection=accounts docId= path=holdings.0.institution_price code=invalid_type message="Invalid input: expected number,

Read the thread · 2026-08-18 · closed · external user · 1 comment

get_accounts_live (and all --live-reads/--write tools) blocked by db.isAvailable() check even when native app isn't installed

Summary

handleCallTool() in dist/cli.js gates every tool call behind this.db.isAvailable(), which only checks for the native Copilot Money macOS app's local LevelDB cache (~/Library/Containers/com.copilot.production/...). This blocks pure live/GraphQL tools like get_accounts_live, get_connection_status, get_cache_info, etc. — which never touch this.db at all (their handlers call ctx.live.* directly, confirmed in TOOL_REGISTRY) — on any machine where the native app isn

Read the thread · 2026-08-13 · closed · external user · 0 comments

leveldb-reader: temp DB copies (copilot-leveldb-*) leak — deferred setTimeout cleanup never fires in short-lived server/worker (33GB observed)

Summary

copyDatabaseToTemp copies the Copilot LevelDB (~120 MB) into os.tmpdir() as copilot-leveldb-XXXXXX on every read, but the cleanup is deferred via setTimeout(…, TEMP_DB_CACHE_TTL) (5 min). Because the MCP server typically runs as a short-lived, per-request process — and decoding happens in a worker thread (dist/decode-worker.js) that is terminated right after it posts its result — the process/worker almost always exits before the timer fires. Pending timers

Read the thread · 2026-08-09 · closed · outside contributor · 0 comments

[Audit] Unaddressed suggestions from PR #600

Unaddressed review suggestions from PR #600

PR title: perf(server): compact JSON tool responses (#597 T0)

LOW: Redundant JSON.parse and toBeDefined assertions remain after the compact-JSON test already validates parseability via the toBe round-trip assertion on line 439.

  • File: tests/unit/server-protocol.test.ts:441
  • Reviewer said: > One small observation: the third assertion at line 441–442 ... This is redundant. If JSON.parse threw, the test would already fail ... N

Read the thread · 2026-08-02 · closed · external user · 0 comments

get_accounts embeds full base64 institution logos, bloating responses ~20-30x

Summary

get_accounts embeds each account's institution logo as a full base64-encoded PNG (logo + logo_content_type fields), straight from the cached Firestore document, with no way to opt out. For a normal set of linked accounts this dominates the response size — in my case, 15 accounts came back as ~66KB of JSON, and grep'ing the response showed the actual financial data (balances, names, masks, institution names) was only ~2-3KB of that. The rest was inline PNG bytes.

For an MCP c

Read the thread · 2026-08-01 · closed · outside contributor · 0 comments

[Audit] Unaddressed suggestions from PR #514

Unaddressed review suggestions from PR #514

PR title: fix(write): split_transaction resolves parent content live-first

LOW: Error message still exposes internal LevelDB field name 'original_name' in a user-facing string, even though that fallback is now hidden inside resolveParentSnapshot and this branch is unreachable in live mode.

  • File: src/tools/tools.ts:3192
  • Reviewer said: > The phrase "or original_name" is internal LevelDB vocabulary leaking into a user-facing er

Read the thread · 2026-07-06 · closed · external user · 0 comments

Your MCP server is graded 🟢 SAFE on Agent Skills Hub

Hi! I run Agent Skills Hub, an open directory that security-grades & quality-scores MCP servers and agent skills. {repo} came through 🟢 SAFE — nice work. If useful, you can show the grade in your README:

Security-graded by Agent Skills Hub

It renders a 🟢 SAFE badge linking to your skill's page (grade

Read the thread · 2026-06-23 · closed · external user · 1 comment

[Audit] Unaddressed suggestions from PR #490

Unaddressed review suggestions from PR #490

PR title: chore(deps): bump grouped dev + prod dependencies (#485, #486)

MEDIUM: graphql was added to dependencies but is only used in scripts and tests (not in src/), so it should remain solely in devDependencies.

  • File: package.json:86
  • Reviewer said: > graphql now appears in both dependencies and devDependencies ... It is not imported in any src/ file ... graphql must stay in devDependencies only.
  • **Evidence

Read the thread · 2026-06-14 · closed · external user · 0 comments

[Audit] Unaddressed suggestions from PR #476

Unaddressed review suggestions from PR #476

PR title: ci: require the External assumptions section in PR bodies

LOW: Doc comment references wrong test file path — missing scripts/ subdirectory and uses .sh extension instead of .ts.

  • File: scripts/check-pr-sections.sh:21
  • Reviewer said: > # locally: see tests/check-pr-sections.test.sh.
  • Evidence not applied: Line 21 still reads # locally: see tests/check-pr-sections.test.sh. in the merged file — wrong subdir

Read the thread · 2026-06-13 · closed · external user · 0 comments

[Audit] Unaddressed suggestions from PR #466

Unaddressed review suggestions from PR #466

PR title: C1: weekly scheduled drift check via launchd

LOW: Bare JSON.parse(readFileSync(statusPath)) throws an unhelpful ENOENT if runScheduledSmoke() ever exits before writing the status file, making test failures hard to diagnose.

  • File: tests/scripts/scheduled-smoke-e2e.test.ts:40
  • Reviewer said: > A try/catch returning a helpful message would make test failures easier to diagnose. Minor.
  • Evidence not applied: Line

Read the thread · 2026-06-11 · closed · external user · 0 comments

The remaining reports are on the project's issue tracker.