pluggy-mcp

A remote Model Context Protocol server that wraps the Pluggy API data-products surface, deployed on Cloudflare Workers.

Built with Cloudflare Agents (McpAgent) using the Streamable HTTP transport.

Tools

Exposes 25 tools across Pluggy's data products:

Payments, webhooks, and Smart Transfers are out of scope.

Related MCP server: Copiloto Financeiro MCP Server

Authentication

The MCP client authenticates with a Bearer token on every request:

Authorization: Bearer <base64(clientId:clientSecret)>

Generate the token:

printf '%s:%s' "$PLUGGY_CLIENT_ID" "$PLUGGY_CLIENT_SECRET" | base64

The Worker decodes the token, mints a short-lived Pluggy API key via POST /auth (2h TTL, refreshed 5min before expiry), and sends it as X-API-KEY on all Pluggy API calls. Pluggy credentials never reach the MCP client.

Develop

npm install
npm run dev   # wrangler dev on http://127.0.0.1:8787

Deploy

npx wrangler deploy

Connect

Cursor

~/.cursor/mcp.json:

{
  "mcpServers": {
    "pluggy": {
      "url": "https://<your-worker>.<your-subdomain>.workers.dev/mcp",
      "headers": { "Authorization": "Bearer <base64(clientId:clientSecret)>" }
    }
  }
}

Claude Desktop / Windsurf

Same shape, different config file (claude_desktop_config.json / ~/.codeium/windsurf/mcp_config.json).

Notes

• list_items is an opt-in Pluggy feature. It returns 403 LIST_ITEMS_FEATURE_NOT_ENABLED until Pluggy support enables it for your team.

• list_transactions uses the cursor-based GET /v2/transactions endpoint. Pass the after cursor from a previous response's next value to paginate.

• The Durable Object persists the session and the minted API key for its lifetime; credentials are passed per-request via the Worker fetch handler into ctx.props.