FinanceContext MCP

The open-source finance-context layer behind Lumi — a standalone remote MCP server that lets LLM agents reason over a user's real financial state without ever holding elevated credentials.

Extracted from the Lumi codebase; table names (lumi_*) reflect the production schema it runs against.

The security model (the interesting part)

The agent never gets more power than the user. The server validates Supabase-issued bearer JWTs against JWKS, then uses the user's own token for every Supabase read and write — so Postgres row-level security remains the single source of authority. There is no service-role key anywhere in this service. Misbehaving agent, compromised prompt, doesn't matter: the blast radius is exactly what the user themselves could do.

Layered on top:

• OAuth protected-resource metadata (/.well-known/oauth-protected-resource) for MCP client discovery

• Permission claims enforced when present (default read-capable when absent)

• DNS-rebinding protection via a host allowlist when binding publicly

• An activity log (list_recent_activity) so tool usage is auditable

Related MCP server: Copilot Money MCP

Tool surface (19 tools)

The write path is deliberately indirect: agents draft rules and preview their impact, but changes land only through an explicit approval request a human accepts or rejects. Agents propose; people dispose.

Stack

TypeScript · Express 5 · @modelcontextprotocol/sdk (Streamable HTTP) · @supabase/supabase-js · jose (JWKS validation) · zod

Endpoints

GET /health · GET /.well-known/oauth-protected-resource · POST|GET|DELETE /mcp

Local development

cp .env.example .env    # Supabase URL + publishable key
npm install
npm run dev             # tsx watch
npm run check           # typecheck
npm run build && npm start