Is Finance Personal Assistant safe to use?

Finance Personal Assistant has no known CVEs as of the latest MCPpedia security scan. It requires authentication to connect, which limits unauthorized access. Licensed under MIT.

How do I install Finance Personal Assistant?

Finance Personal Assistant supports copy-paste install configs on its MCPpedia page for Claude Desktop, Cursor, and Claude Code. Scroll to the Quick Install section and select your client.

What can Finance Personal Assistant do?

Finance Personal Assistant provides 6 tools: authenticate_user, fetch_net_worth, fetch_credit_report, fetch_bank_transactions, fetch_epf_details and 1 more. See the full tools list on the server page for descriptions and parameters.

What AI clients work with Finance Personal Assistant?

Finance Personal Assistant is compatible with claude-desktop, cursor, claude-code. It uses stdio and sse and http transport.

Is Finance Personal Assistant actively maintained?

Finance Personal Assistant is less actively maintained — last commit was 345 days ago. It has 2 GitHub stars.

Finance Personal Assistant

Name: Finance Personal Assistant
Author: beprith

mcp · by beprith

Local implementation of the Model Context Protocol (MCP) server for simulating financial‑data interactions. It is intended for developers who need a secure, simplified environment for testing applications without connecting to live financial systems or user data.

2 6 tools GitHub PyPI

No known CVEs

MIT license

Stale

Last commit 345d ago

Works with most clients

Transport: stdio, sse, http

6 tools · ~324 tok

Grade A · 0.2% of 200K ctx

Edit this pageView history

Finance

Step 1

Install in your client

Config is the same across clients — only the file and path differ.

Supported in Claude Desktopstdio, sse, http · Node 18+

Paste into ~/Library/Application Support/Claude/claude_desktop_config.json

{
  "mcpServers": {
    "finance-personal-assistant": {
      "args": [
        "mcp"
      ],
      "command": "uvx"
    }
  }
}

Are you the author?

Add this badge to your README to show your security score and help users find safe servers.

Embed in your READMEAbout badges →

[![MCPpedia Score](https://mcppedia.org/api/badge/finance-personal-assistant)](https://mcppedia.org/s/finance-personal-assistant)

Read me

What Finance Personal Assistant does

This project provides a lightweight, local implementation of the Model Context Protocol (MCP) server for simulating financial‑data interactions. It is intended for developers who need a secure, simplified environment for testing applications without connecting to live financial systems or user data.

Test This Server

Run this in your terminal to verify the server starts. Then let us know if it worked — your result helps other developers.

uvx 'mcp' 2>&1 | head -1 && echo "✓ Server started successfully"

After testing, let us know if it worked:

Loading README…

Scored, not listed

Why this score

Five weighted categories — click any category to see the underlying evidence.

Score breakdown

77/100across 5 weighted dimensions

How we score →

0255075100

−23

Security

Maintenance

Efficiency

Documentation

Compatibility

Categoriesclick a row to see evidence

Security

OSV.dev

6 fixed

CVE-2026-59950info · fixed

MCP Python SDK: WebSocket server transport does not support Host/Origin validation

### Summary In affected versions, the deprecated WebSocket server transport (`mcp.server.websocket.websocket_server`) accepted the WebSocket handshake without applying any `Host` or `Origin` header validation. The `TransportSecuritySettings` mechanism that the SSE and Streamable HTTP transports use for this purpose was not wired into the WebSocket transport, so there was no SDK-level way to restrict which origins could connect. ### Am I affected? Only if a developer's application server exposes

Affected: >= 0Fixed in 1.28.1source →

CVE-2026-52869high · fixedCVSS 7.1

MCP Python SDK: HTTP transports serve session requests without verifying the authenticated principal

### Summary In affected versions, the SSE and Streamable HTTP server transports routed incoming requests to an existing session based only on the session identifier, without verifying that the request was authenticated as the same principal that created the session. Anyone who learned or guessed a session ID could send JSON-RPC messages on that session, regardless of which bearer token the request carried. ### Am I affected? Only if a developer's application server uses an HTTP transport (SSE,

Affected: >= 0Fixed in 1.27.2source →

CVE-2026-52870high · fixedCVSS 7.6

MCP Python SDK: Experimental task handlers allow any client to access and cancel other clients' tasks

### Summary In affected versions, the default request handlers installed by the experimental tasks feature (`server.experimental.enable_tasks()`) did not check which session created a task before acting on it. On a server with more than one connected client, any client could observe, read results from, and cancel tasks belonging to other clients. ### Am I affected? Only if the developer's application server calls `server.experimental.enable_tasks()`. If `grep -r enable_tasks` over their codebas

Affected: >= 1.23.0Fixed in 1.27.2source →

CVE-2025-66416info · fixed

Model Context Protocol (MCP) Python SDK does not enable DNS rebinding protection by default

### Description The Model Context Protocol (MCP) Python SDK does not enable DNS rebinding protection by default for HTTP-based servers. When an HTTP-based MCP server is run on localhost without authentication using `FastMCP` with streamable HTTP or SSE transport, and has not configured `TransportSecuritySettings`, a malicious website could exploit DNS rebinding to bypass same-origin policy restrictions and send requests to the local MCP server. This could allow an attacker to invoke tools or ac

Affected: >= 0Fixed in 1.23.0source →

CVE-2025-53366info · fixed

MCP Python SDK vulnerability in the FastMCP Server causes validation error, leading to DoS

A validation error in the MCP SDK can cause an unhandled exception when processing malformed requests, resulting in service unavailability (500 errors) until manually restarted. Impact may vary depending on the deployment conditions, and presence of infrastructure-level resilience measures. Thank you to Rich Harang for reporting this issue.

Affected: >= 0Fixed in 1.9.4source →

Inventory

Tools (6)

Click any tool to inspect its schema.

~324 tokens total

Community

Reviews

Be the first to review

Have you used this server?

Share your experience — it helps other developers decide.

How easy was setup?Did it work reliably?How was the documentation?

Frequently Asked Questions

Is Finance Personal Assistant safe to use?: Finance Personal Assistant has no known CVEs as of the latest MCPpedia security scan. It requires authentication to connect, which limits unauthorized access. Licensed under MIT.
How do I install Finance Personal Assistant?: Finance Personal Assistant supports copy-paste install configs on its MCPpedia page for Claude Desktop, Cursor, and Claude Code. Scroll to the Quick Install section and select your client.
What can Finance Personal Assistant do?: Finance Personal Assistant provides 6 tools: authenticate_user, fetch_net_worth, fetch_credit_report, fetch_bank_transactions, fetch_epf_details and 1 more. See the full tools list on the server page for descriptions and parameters.
What AI clients work with Finance Personal Assistant?: Finance Personal Assistant is compatible with claude-desktop, cursor, claude-code. It uses stdio and sse and http transport.
Is Finance Personal Assistant actively maintained?: Finance Personal Assistant is less actively maintained — last commit was 345 days ago. It has 2 GitHub stars.

Similar servers

Others in finance

View all →

Printr MCP Server90

Let AI agents create, discover, and track tokens across chains via Printr.

3 9

Alpha Vantage Mcp89

Real-time financial market data: stocks, forex, crypto, commodities, and economic indicators

178 3

io.github.PromptPartner/bexio-mcp-server88

Swiss accounting integration for Bexio. 310 tools for invoices, contacts, projects.

20 6

io.github.Licinexus/mcp88

Brazilian public procurement (PNCP) and Federal Revenue CNPJ data — 16 tools, 4 prompts.

68 3

MCP Security Weekly

Get CVE alerts and security updates for Finance Personal Assistant and similar servers.

Community

Discussion

Start a conversation

Ask a question, share a tip, or report an issue.

Has anyone used this with Cursor?How do you handle auth?Any alternatives?

Edit this pageView history

Finance

Step 1

Install in your client

Config is the same across clients — only the file and path differ.

Supported in Claude Desktopstdio, sse, http · Node 18+

Paste into ~/Library/Application Support/Claude/claude_desktop_config.json

{
  "mcpServers": {
    "finance-personal-assistant": {
      "args": [
        "mcp"
      ],
      "command": "uvx"
    }
  }
}

Are you the author?

Add this badge to your README to show your security score and help users find safe servers.

Embed in your READMEAbout badges →

[![MCPpedia Score](https://mcppedia.org/api/badge/finance-personal-assistant)](https://mcppedia.org/s/finance-personal-assistant)

Read me

What Finance Personal Assistant does

Test This Server

Run this in your terminal to verify the server starts. Then let us know if it worked — your result helps other developers.

uvx 'mcp' 2>&1 | head -1 && echo "✓ Server started successfully"

After testing, let us know if it worked:

README

Local Financial MCP Mock Server

This project provides a lightweight, local implementation of the Model Context Protocol (MCP) server for simulating financial‑data interactions. It is intended for developers who need a secure, simplified environment for testing applications without connecting to live financial systems or user data.

See README_UI for UI guide

✨ Features

Capability	Description
Dummy Authentication	Login succeeds if the phone number exists as a directory in `test_data_dir/`.
Pre‑canned Financial Data	Static JSON files for net‑worth, credit report, bank & MF transactions, EPF.
Plug‑and‑Play Tools	Each JSON dataset is exposed as an MCP tool (see list below).
Quick setup	Zero external integrations—just clone, install, run.

📂 Directory Layout

.
├── main_mcp.py        # MCP server implementation (Python)
└── test_data_dir      # Dummy data grouped by phone number
    ├── 1111111111
    │   ├── fetch_net_worth.json
    │   └── ...
    └── 2222222222
        ├── fetch_credit_report.json
        └── ...

🔧 Installation & Run

Prerequisites

Python 3.9+

Install dependencies

pip install mcp mcp-inspector

Start the server

python main_mcp.py

The server runs using stdio transport by default.

🔑 Dummy Authentication

Login is successful if the supplied phone number matches a folder in test_data_dir/.
Example valid numbers: 1111111111, 2222222222, 3333333333, … (see folders).

🛠️ Available MCP Tools

Tool Name	Purpose
`authenticate_user`	Dummy login check
`fetch_net_worth`	Net‑worth summary + assets/liabilities
`fetch_credit_report`	Credit score & account details
`fetch_bank_transactions`	Full bank‑statement style transaction list
`fetch_epf_details`	EPF balance & employment history
`fetch_mf_transactions`	Mutual‑fund buy/sell history

All tools accept phone_number as their sole argument.

🚀 FastMCP Dev Environment UI

FastMCP ships with a lightweight developer UI that lets you explore any local MCP server, run tools, and inspect raw responses—all from the browser.

1. Install the FastMCP CLI (one‑time)

pip install fastmcp

2. Launch the Dev UI

From your project root:

fastmcp dev main_mcp.py

⚙️ This spins up main_mcp.py and the web UI in one command.

Already registered the server in mcp_servers.json? Simply run:

fastmcp dev

FastMCP will auto‑detect local-financial-mcp and start it.

The UI opens at http://localhost:4400 where you can:

Authenticate with any test phone number (e.g., 2222222222).
Invoke tools like fetch_net_worth, fetch_credit_report, etc.
Inspect request/response JSON in real time for quick debugging.

3. Use alongside other FastMCP‑aware apps

The Dev UI acts purely as a client—you can keep it open while calling the same server from Langflow or the FastMCP CLI.

⚙️ FastMCP Server‑side Entry

If you want another FastMCP‑aware application (or CLI) to auto‑launch this mock server, add the following stanza to its mcp_servers.json (or similar) file:

{
  "servers": {
    "local-financial-mcp": {
      "transport": "stdio",          // or "sse" if you expose an HTTP endpoint
      "command": "python",
      "args": ["main_mcp.py"],
      "cwd": "<

... [View full README on GitHub](https://github.com/beprith/Finance-personal-assistant#readme)

Loading README…

Scored, not listed

Why this score

Five weighted categories — click any category to see the underlying evidence.

Score breakdown

77/100across 5 weighted dimensions

How we score →

0255075100

−23

Security

Maintenance

Efficiency

Documentation

Compatibility

Categoriesclick a row to see evidence

Security

OSV.dev

6 fixed

CVE-2026-59950info · fixed

MCP Python SDK: WebSocket server transport does not support Host/Origin validation

Affected: >= 0Fixed in 1.28.1source →

CVE-2026-52869high · fixedCVSS 7.1

MCP Python SDK: HTTP transports serve session requests without verifying the authenticated principal

Affected: >= 0Fixed in 1.27.2source →

CVE-2026-52870high · fixedCVSS 7.6

MCP Python SDK: Experimental task handlers allow any client to access and cancel other clients' tasks

Affected: >= 1.23.0Fixed in 1.27.2source →

CVE-2025-66416info · fixed

Model Context Protocol (MCP) Python SDK does not enable DNS rebinding protection by default

Affected: >= 0Fixed in 1.23.0source →

CVE-2025-53366info · fixed

MCP Python SDK vulnerability in the FastMCP Server causes validation error, leading to DoS

Affected: >= 0Fixed in 1.9.4source →

Inventory

Tools (6)

Click any tool to inspect its schema.

~324 tokens total

Community

Reviews

Be the first to review

Have you used this server?

Share your experience — it helps other developers decide.

How easy was setup?Did it work reliably?How was the documentation?

Frequently Asked Questions

Is Finance Personal Assistant safe to use?: Finance Personal Assistant has no known CVEs as of the latest MCPpedia security scan. It requires authentication to connect, which limits unauthorized access. Licensed under MIT.
How do I install Finance Personal Assistant?: Finance Personal Assistant supports copy-paste install configs on its MCPpedia page for Claude Desktop, Cursor, and Claude Code. Scroll to the Quick Install section and select your client.
What can Finance Personal Assistant do?: Finance Personal Assistant provides 6 tools: authenticate_user, fetch_net_worth, fetch_credit_report, fetch_bank_transactions, fetch_epf_details and 1 more. See the full tools list on the server page for descriptions and parameters.
What AI clients work with Finance Personal Assistant?: Finance Personal Assistant is compatible with claude-desktop, cursor, claude-code. It uses stdio and sse and http transport.
Is Finance Personal Assistant actively maintained?: Finance Personal Assistant is less actively maintained — last commit was 345 days ago. It has 2 GitHub stars.