# Reported issues for Lunch Money

Pod holds 6 of 6 problems reported by people outside the maintainer team. Issues filed by the project's own owners, members and collaborators are excluded entirely — a maintainer's release checklist is not a warning to a prospective user.

Back to [Lunch Money](/mcp/lunch-money).

## Most discussed

### [Potential Vulnerability] Arbitrary local-file read and exfiltration through `attach_file_to_transaction` in `lunchmoney-mcp`

## Summary

`lunchmoney-mcp` (`@akutishevsky/lunchmoney-mcp`) is a local MCP server whose documented purpose is to drive the LunchMoney personal-finance API from an AI assistant over stdio. Its `attach_file_to_transaction` tool is documented as a way to attach a local image/PDF receipt (max 10 MB) to one of the user's transactions. The tool takes a caller-supplied `file_path` string and passes it **straight to `fs/promises.readFile(file_path)`** — with **no path confinement** (no allow-list, no 

[Read the thread](https://github.com/akutishevsky/lunchmoney-mcp/issues/16) · 2026-06-16 · closed · external user · 1 comment

### Rules handling

There doesn't seem to be a way to handle rules (listing, creation, deletion, update), is that something you're planning on adding?

[Read the thread](https://github.com/akutishevsky/lunchmoney-mcp/issues/13) · 2026-04-30 · closed · external user · 2 comments

### No crypto accounts found

Hi, i'm using the latest version and it works fine for all account types except crypto. 
It just can't find any crypto account.

[Read the thread](https://github.com/akutishevsky/lunchmoney-mcp/issues/12) · 2026-04-29 · closed · external user · 3 comments

### Multiple budgets

Thank you for the MCP.

I have multiple budgets - one for personal finance and one for the company. Can you add support for multiple tokens in MCP?
Let me also try to see how it can be achieved with Claude and my contribution to this project.

Kind Regards,
Eugen

[Read the thread](https://github.com/akutishevsky/lunchmoney-mcp/issues/11) · 2026-04-21 · closed · external user · 3 comments

### upsert_budget: type validation error — expects number but receives string

## Bug

`upsert_budget` fails with type validation errors when called through the MCP:

```
Invalid arguments for tool upsert_budget:
  Expected number, received string for category_id
  Expected number, received string for amount
```

The tool schema defines `category_id` and `amount` as numbers, but the values are being passed/received as strings.

## Workaround

Using the Lunch Money REST API directly (`PUT /v1/budgets`) works fine with the same parameters.

## Environment

- MCP: @akutishevs

[Read the thread](https://github.com/akutishevsky/lunchmoney-mcp/issues/8) · 2026-03-19 · closed · external user · 1 comment

### Split Transaction Tool?

Hi There Anton! 

Just had a quick flick through your MCP Server and a huge thanks for putting this out there! 

Quick question for you, Is there a reason that a Split Transaction Tool wasn't created for the [Split Transaction Endpoint](https://alpha.lunchmoney.dev/v2/docs#tag/transactions-split)?

Saw you did an Unsplit Transaction tool so wondering if it was just time to implement or if there was reasoning for the omission? 

Thanks again!, 
Jon

[Read the thread](https://github.com/akutishevsky/lunchmoney-mcp/issues/7) · 2026-02-26 · closed · external user · 2 comments

## Most recent

The remaining reports are on [the project's issue tracker](https://github.com/akutishevsky/lunchmoney-mcp.git/issues).