MCP for AI Agents

Ask ChatGPT Ask Claude

Dollar Diary includes a remote Model Context Protocol server, so an AI agent can work directly with the same workspace data and operations available to API keys. It can inspect the API contract, read and change data, upload files, and run read-only SQL without scraping the web app.

Connect

Create a key from the API Keys page, then add https://www.dollardiary.com/mcp and the authorization header to any MCP client that supports Streamable HTTP and custom headers:

Authorization: Bearer <your-api-key>

Keep the key in your client’s secret or environment-variable store, never in a prompt or committed configuration file. Clients that support only OAuth authentication cannot connect with a Dollar Diary API key yet.

What an agent can do

The MCP server gives agents a compact set of tools for discovering and using the workspace API:

  • Search operations without loading the entire API contract into context.
  • Inspect an operation’s parameters, request body, required scope, and schemas.
  • Read transactions, tags, budgets, analytics, workspace configuration, and other API resources.
  • Create, update, and delete data when the connected key allows it.
  • Upload supported files and run read-only DuckDB SQL against the workspace.

For the complete operation and schema reference, see the API documentation or OpenAPI specification.

Access stays under your control

MCP uses the existing API permission model rather than creating a second path around it. Every call remains limited by the key’s workspace, stored scopes, owner grant, expiry, subscription gates, and rate limits. Removing the member who created a key, or that member leaving the workspace, automatically revokes their active keys. Demotion does not revoke keys; their stored scopes continue to determine access. A workspace editor can revoke a key at any time. Activity is attributed to the same key and creator as a direct API request.

Start with a read-only key. Add CREATE, UPDATE, or DELETE only when you want the agent to make those changes, and revoke the key immediately if its client or secret store is compromised.