YNAB MCP: Setup, Token Risk, and Gaps

Checked November 4, 2026. YNAB claims are from the ChatGPT app article (July 2, 2026) and the API page. avenir-mcp claims are from its home page, install guide, configuration reference, run-options page, and PyPI. Those avenir-mcp docs say last updated November 3, 2026. FYN claims are from the MCP reference, pricing, and registry entry fyi.fyn/finance. If a page did not say it, it is not here.

Short answer. YNAB does not publish an MCP server. People searching "ynab mcp" usually want an official connector that can see the plan. The official ChatGPT app cannot. Type @ynab and it shows articles, videos, and a debt payoff calculator. You do not sign in, and it cannot see accounts, categories, or transactions. Community servers exist. YNAB lists them as unsupported third-party apps on its API page. avenir-mcp is the one with a public install guide, configuration reference, and run-options page. It is unofficial, not endorsed by YNAB, for personal use on your own machine with your own token, and read-only unless you set AVENIR_MCP_WRITE=1. Treat that token like your YNAB password. Other apps' official servers are in Which budget apps have an MCP server.

What the official ChatGPT app can do

The YNAB ChatGPT app is official, free, and separate from your plan. Connect it once from the ChatGPT Apps directory, then type @ynab. It pulls from a curated library of YNAB articles, blog posts, and videos. A debt payoff calculator can run in the chat if you ask how to pay off debt: you enter balances, interest rates, and what you can put toward debt. Without @ynab, you get a normal ChatGPT answer. You do not need a YNAB subscription. YNAB does not charge for the app. ChatGPT's own plan limits still apply. YNAB does not see what you ask.

It cannot view accounts, categories, transactions, or anything else inside YNAB. You do not sign in with YNAB credentials. If something elsewhere claims to be YNAB and is not the YNAB ChatGPT App in that directory, YNAB says it is not affiliated. What to redact before you paste a statement into a chat is in is it safe to connect ChatGPT to your bank.

The personal access token

The API is a different product from the ChatGPT app. A personal access token is for the account owner, for that owner's own use. YNAB says not to share it and not to ask for anyone else's. Treat it with as much care as the account password. Create it on the web, not in the mobile apps: Account Settings, then Developer Settings, then New Token. You enter your password. YNAB shows the token once. It does not expire. You can revoke it on that same screen.

avenir-mcp's install page says this token can read and change every plan on the account, and that YNAB offers no read-only personal access token. The configuration page says the same: full read and write access to every plan. The YNAB API does document a read-only scope, and it is for OAuth applications, not for this token. avenir-mcp's documented setup uses the personal access token. A read-only avenir-mcp process does not shrink what the token can do if something else uses it. Do not paste it into a chat, a shared file, an issue, or a repository. The install page says avenir-mcp never logs it and never returns it in an answer.

Community servers

The API page's Works with YNAB section splits official integrations from third-party apps. YNAB says it does not provide support for the third-party list. avenir-mcp is on that list. YNAB's line says it is open source, runs on your computer with your personal access token, hosts nothing, is read-only by default, and previews each change, confirms it with a code tied to that preview, and can undo it. The same list includes "Local MCP Server for YNAB" and "MCP for YNAB," each with a one-line description. This guide does not re-test those repositories. Of the three names, avenir-mcp is the one with public install, configuration, and run-options pages.

PyPI lists avenir-mcp 0.8.0, uploaded October 25, 2026, and calls it an unofficial MCP server for YNAB. The project says it is not affiliated with YNAB and not endorsed by YNAB. It is for personal use on your own machine, with your own token. Running it as a public or shared server is not supported. The publisher runs no server and receives none of your data. The token is sent only to YNAB. Plan data goes back to your agent, so the model provider behind that client sees it too.

How to run avenir-mcp read-only

The install page's default is read-only. Leave writes off until you have a figure you can check in YNAB. Clients named there: Claude Code, Claude Desktop, Cursor, VS Code, Gemini CLI, Codex CLI, and LM Studio. The clicks for each one are on that page. This is the short path.

1. Create the personal access token on app.ynab.com, under Account Settings, then Developer Settings. Copy it once. Keep it out of the chat.
2. Claude Desktop can install the extension file, then paste the token on the extension screen. Leave Allow changes to your plans off, and save. That path does not need a terminal.
3. Claude Code, read-only: claude mcp add avenir-mcp --scope user --env YNAB_API_KEY=your-token -- uvx avenir-mcp. Other clients use command uvx, argument avenir-mcp, and YNAB_API_KEY in the environment. Install uv first if the command is missing. The install page has the commands.
4. Ask it to list your YNAB plans. The install page says Claude Code's /mcp shows 19 tools while the server is read-only.

Checked November 4, 2026, the install page, the configuration page, and the run-options page agree on the counts to check: 19 tools while read-only, 13 write tools left out, and 32 tools once writes are on. The home page, last updated November 3, 2026, says 17 tools. Use 19 and 32, which are the checks the install page names. YNAB allows up to 200 API requests an hour on an access token, in a rolling window. avenir-mcp's home page says most tools cost one or two of those requests.

Writes, preview, and undo

Writes stay off until the environment contains AVENIR_MCP_WRITE=1. The configuration page says exactly 1 registers the 13 write tools, read once at startup. Any other value, including 0, true, and yes, keeps the server read-only: those tools are neither listed nor callable. Restart after you change it. On the Claude Desktop extension, turn Allow changes to your plans on, save, and restart. The extension sets the variable for you.

The home page says every change is previewed, then confirmed, then journaled. You say yes in the client, or with a one-time code bound to that preview. Undo restores the journaled change without overwriting later work. Categories, amounts, reconciliations, and created transactions can be undone. The install page says the same preview, confirm, and undo for classify, budget, reconcile, and create. The run-options page is narrower: every write except approve_transactions is previewed and confirmed. This guide does not treat that exception as covered by the broader sentence.

Some clients cannot ask you a question. avenir-mcp then gives the agent a single-use code, and it is up to the agent to show you the change and wait. The install page reports its own evaluation: one model out of eight, misled by a memo planted in a transaction, used such a code on its own, then undid the change. To accept only a yes in the client, set AVENIR_MCP_REQUIRE_ELICITATION=1. Codes are then neither issued nor accepted. A dismissed question counts as no. A client that cannot ask gets an error. YNAB's directory line says each change is confirmed with a code. avenir-mcp's own pages also allow a yes in the client, and the elicitation flag turns the codes off.

Keep it on your machine

The default is stdio. Your client starts avenir-mcp and talks to it on standard input and output. Nothing listens on the network. HTTP is optional, for a client that wants a URL, or to share one server between clients on that same machine. The run-options page says to keep the host on 127.0.0.1, because the traffic is plain HTTP. It says never bind 0.0.0.0, never publish the port, and never put the server on the internet. PyPI says a public or shared server is not supported. There is no official YNAB URL to paste the way other apps publish one. The roundup is which budget apps have an MCP server.

By default, at startup and at most once a day, avenir-mcp asks PyPI whether a newer release exists. The configuration page says that request sends nothing about you or your plans. Set AVENIR_MCP_NO_UPDATE_CHECK=1 to skip it. The server does not upgrade itself. Revoke the token under Developer Settings if it leaks. The install page says removing the Claude Desktop extension takes the token with it. Claude Code keeps the token in ~/.claude.json. The journal of applied changes is the file under ~/.local/state/avenir-mcp/ unless you move it.

YNAB community MCP vs FYN MCP

The first column is avenir-mcp, the community server above. It is not an official YNAB product. FYN's column is our product. The wider budget comparison is YNAB vs Monarch Money and the YNAB compare page. YNAB's price is ynab.com/pricing on November 4, 2026, in US dollars, plus tax where it applies.

The clocks differ. YNAB meters the token at 200 API requests an hour. FYN meters tool calls by the day. Neither number says how many plain-language questions fit. The assistant decides how many calls a question becomes.

Checklist

Before you rely on a total, run this list.

1. You know which product you opened. The official ChatGPT app cannot see the plan. A community server is not an official YNAB URL.
2. The personal access token stays on your machine. You treat it like the password. You can revoke it under Developer Settings. You did not paste it into the chat.
3. AVENIR_MCP_WRITE is unset unless you want edits. Only 1 turns writes on. You restarted after the change. The install page's check is 19 tools, then 32.
4. You know the confirm path. Preview, then a yes or a one-time code, then undo. The run-options page excepts approve_transactions. If the client can ask you, AVENIR_MCP_REQUIRE_ELICITATION=1 turns codes off.
5. The process is on your computer. HTTP stays on 127.0.0.1. It is not a public shared server. The token can reach every plan on the account.

Where FYN fits

FYN publishes a read-only personal finance MCP server. Registry name fyi.fyn/finance, version 1.1.0, status active, updated November 2, 2026, at https://mcp.fyn.fyi. The reference lists 36 tools, all classified as read. The only scope is fyn.read. The tools read transactions, budgets, cash flow, net worth, investments, and itemized receipts. They do not create, change, or delete those records, and FYN never moves money.

Link each bank once, on Pro, up to 15 accounts. Every agent then plugs into FYN, read-only. Agents connect to FYN, never to your bank, and they do not receive a bank password. Sign-in is OAuth. Agent Activity shows every time an agent reads your data, kept for 90 days. Disconnect anytime, from Agent Activity or from Settings, then Agent access. Why the password stays out of the model is in Banks, AI agents, and a third party.

In ChatGPT, FYN is a custom plugin. Open chatgpt.com/plugins, add a custom MCP server, and paste https://mcp.fyn.fyi. The clicks are in Connect your money to ChatGPT, Claude, or any AI agent. The same URL serves Cursor. ChatGPT, Claude, and Cursor are also on fyn.fyi/agents.

If you do not want bank sync, the free plan still pulls receipts from email and picks up Apple Pay and Google Wallet purchases, including on-device taps. A free account does not sync a bank. Pro adds the bank link.

Start free. The free plan does not expire and does not ask for a card. It includes the connection, at 500 tool calls a day. Pro is $9.99 a month, with bank sync and 10,000 tool calls a day.

FAQ

Sources

Checked November 4, 2026.

• YNAB, July 2, 2026: ChatGPT app.
• YNAB API, personal access tokens, the 200-request hourly limit, the OAuth read-only scope, and unsupported third-party apps: api.ynab.com.
• YNAB pricing, checked November 4, 2026: ynab.com/pricing.
• avenir-mcp, pages last updated November 3, 2026: home, install, configuration, run options.
• PyPI avenir-mcp 0.8.0, uploaded October 25, 2026.
• FYN: MCP reference, connect, pricing. Registry fyi.fyn/finance version 1.1.0, updated November 2, 2026: official MCP Registry.