ignaciohermosillacornejo/copilot-money-mcp

v2.2.1 Feature

This release adds 4 notable features for engineering teams evaluating rollout.

Published 1mo MCP Developer Tools

View tool

✓ No known CVEs patched

Read the diff → Tool health → What is this tool? →

✓ No known CVEs patched in this version

Topics

bun copilot-money leveldb mcp personal-finance typescript

Affected surfaces

auth breaking_upgrade

Summary

AI summary

Updates https://github.com/ignaciohermosillacornejo/copilot-money-mcp/pull/410, https://github.com/ignaciohermosillacornejo/copilot-money-mcp/pull/409, and https://github.com/ignaciohermosillacornejo/copilot-money-mcp/pull/456 across a mixed release.

Changes in this release

Type	Severity	Summary	CVE
Feature
Feature	Medium	`update_transaction` can now edit `type`, `reviewed`, and `name`. Setting `type` to INCOME/INTERNAL_TRANSFER clears category_id. `update_transaction` can now edit `type`, `reviewed`, and `name`. Setting `type` to INCOME/INTERNAL_TRANSFER clears category_id. Source: llm_adapter@2026-06-14 Confidence: high	—
Feature	Medium	`update_recurring` now allows editing the `frequency` field. `update_recurring` now allows editing the `frequency` field. Source: llm_adapter@2026-06-14 Confidence: high	—
Feature	Medium	`create_transaction` accepts new parameters: `tag_ids`, `note`, and `recurring_id`. `create_transaction` accepts new parameters: `tag_ids`, `note`, and `recurring_id`. Source: llm_adapter@2026-06-14 Confidence: high	—
Feature	Medium	CLI flag `--write` now automatically implies `--live-reads`. CLI flag `--write` now automatically implies `--live-reads`. Source: llm_adapter@2026-06-14 Confidence: high	—
Feature	Medium	Browser session discovery extended to all Chromium‑based browsers (Chrome multi‑profile, Edge, Brave, Vivaldi, Arc, Opera). Browser session discovery extended to all Chromium‑based browsers (Chrome multi‑profile, Edge, Brave, Vivaldi, Arc, Opera). Source: llm_adapter@2026-06-14 Confidence: high	—
Feature	Medium	`get_cache_info` and `get_connection_status` now report per‑collection schema‑drop counts and the latest weekly drift‑check result. `get_cache_info` and `get_connection_status` now report per‑collection schema‑drop counts and the latest weekly drift‑check result. Source: llm_adapter@2026-06-14 Confidence: high	—
Feature	Medium	Boundary conformance hardening program added: machine‑readable ledger, live enum/input smokes, Zod warn‑mode validation on mutation responses, reversible write round‑trips, weekly drift check, and `/boundary-audit` skill. Boundary conformance hardening program added: machine‑readable ledger, live enum/input smokes, Zod warn‑mode validation on mutation responses, reversible write round‑trips, weekly drift check, and `/boundary-audit` skill. Source: llm_adapter@2026-06-14 Confidence: low	—
Performance	Low	Bounded retry/backoff added for transport‑level read failures and for provably unsent mutations only. Bounded retry/backoff added for transport‑level read failures and for provably unsent mutations only. Source: granite4.1:30b@2026-06-14-audit Confidence: low	—
Bugfix
Bugfix	Medium	`create_recurring` no longer falsely reports failure after successfully creating a recurring; wrapper now requests only needed fields. `create_recurring` no longer falsely reports failure after successfully creating a recurring; wrapper now requests only needed fields. Source: llm_adapter@2026-06-14 Confidence: high	—
Bugfix	Medium	`get_upcoming_recurrings_live` fixed; Apollo‑only `@connection` directive is now stripped from generated queries. `get_upcoming_recurrings_live` fixed; Apollo‑only `@connection` directive is now stripped from generated queries. Source: llm_adapter@2026-06-14 Confidence: high	—
Bugfix	Medium	Authentication error for logged‑out browsers now shows "no Copilot Money session found" instead of misleading `PROJECT_NUMBER_MISMATCH`. Authentication error for logged‑out browsers now shows "no Copilot Money session found" instead of misleading `PROJECT_NUMBER_MISMATCH`. Source: llm_adapter@2026-06-14 Confidence: high	—
Bugfix	Low	GraphQL error reporting now classifies failures by content type and surfaces the server's raw message instead of a generic "the API changed" message. GraphQL error reporting now classifies failures by content type and surfaces the server's raw message instead of a generic "the API changed" message. Source: granite4.1:30b@2026-06-14-audit Confidence: low	—

Full changelog

Write-path capability additions plus a repo-wide "boundary hardening" program: every assumption this server makes about Copilot's GraphQL API is now inventoried and re-verified by an oracle (live conformance smokes, runtime response validation, reversible write round-trips, and a weekly scheduled drift check), so API drift surfaces as a red build instead of a confusing user-facing failure. See docs/CONFORMANCE_ARCHITECTURE.md.

Added

update_transaction can now edit type (REGULAR / INCOME / INTERNAL_TRANSFER) (#473), reviewed (#475), and name (#414). Setting type to INCOME/INTERNAL_TRANSFER clears the category server-side, so category_id can't be combined with them (verified live, with an accurate error).
update_recurring can now edit frequency (#417).
create_transaction accepts tag_ids, note, and recurring_id (#418).
--write now implies --live-reads (#407) — write tools need live transaction metadata, and once authenticated there's no privacy reason to keep reads on the stale cache.
Browser session discovery extended to all Chromium browsers (Chrome multi-profile, Edge, Brave, Vivaldi, Arc, Opera) (#409, #410).
get_cache_info / get_connection_status now report per-collection schema-drop counts (#452) and the last weekly drift-check result (#466).

Fixed

create_recurring no longer reports failure when it actually created a recurring: Copilot's server inserts the recurring, then its emoji/icon resolver crashes for category-less recurrings. The wrapper now requests only the fields it reads (#471).
get_upcoming_recurrings_live was broken — the generated query carried an Apollo-only @connection directive the server rejects; the generator now strips client-only directives (#469).
Auth: a logged-out browser now yields an actionable "no Copilot Money session found" message instead of a misleading PROJECT_NUMBER_MISMATCH — the extractor surfaces every candidate token and discards foreign-project ones during exchange (#478).
GraphQL error reporting classifies failures by content (schema vs. user-action vs. server vs. network) and surfaces the server's raw message, instead of a blanket "the API changed" (#449).
Bounded retry/backoff for transport-level read failures (and provably-unsent mutations only) (#455).

Changed

Boundary conformance hardening — a machine-readable ledger of every external assumption + its oracle (#450); live enum/input-field/read smokes (#456, #469); warn-mode Zod validation on mutation responses (#467); reversible per-write-tool round-trip smokes (#471); a weekly launchd drift check (#466); and a /boundary-audit skill (#465).
Internal architecture — a single tool-registry definition per tool now drives schema, dispatch, write-gating, and the manifest (#470); test mocks are derived from the real GraphQL types so a wrong mock shape fails tsc (#457); doc-sync and PR-template gates in CI (#448, #476).
Dependency bumps: protobufjs 8.6.x, graphql 16.14.2, plus dev-tooling (eslint, prettier, typescript-eslint, @types/node) and codecov-action v7.

View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track ignaciohermosillacornejo/copilot-money-mcp

Get notified when new releases ship.

About ignaciohermosillacornejo/copilot-money-mcp

Read and manage Copilot Money personal finance data — 30 tools for transactions, budgets, accounts, recurring charges, investments, and goals. Reads are 100% local from the Firestore cache; opt-in writes (`--write`) go directly to Copilot's GraphQL API.

All releases →