← Back to search

creditkarma-mcp

GitHub Actions Scanned 20h ago

MCP server for Credit Karma — natural-language access to your transactions, spending, and accounts

B
87.5 / 100

Versions

2.3.2latest
Jul 30, 2026
2.3.0
Jul 13, 2026
2.2.5
Jul 7, 2026
2.2.4
Jun 15, 2026
2.2.3
Jun 13, 2026
+ show 23 moreshow less
2.2.2
Jun 4, 2026
2.2.1
May 29, 2026
2.2.0
May 28, 2026
2.1.4
May 26, 2026
2.0.10
May 21, 2026
2.0.9
May 20, 2026
2.0.8
May 20, 2026
2.0.7
May 16, 2026
2.0.6
May 16, 2026
2.0.5
May 16, 2026
2.0.4
May 4, 2026
2.0.3
Apr 14, 2026
2.0.2
Apr 14, 2026
2.0.1
Apr 12, 2026
2.0.0
Apr 3, 2026
1.2.1
Mar 25, 2026
1.2.0
Mar 24, 2026
1.1.0
Mar 21, 2026
1.0.5
Mar 18, 2026
1.0.3
Mar 18, 2026
1.0.2
Mar 18, 2026
1.0.1
Mar 18, 2026
1.0.0
Mar 18, 2026
PermissionsTool SafetyAuthAnnotationsCode QualityStabilitySpecVuln HistoryAuthorTransparencyCommunity

Tools 8

ck_query_sql
annotations: verified low

Execute a raw SQL SELECT query (CTEs via WITH ... SELECT are supported) against the transactions database.

sql string
readOnlyHint true
ck_set_session
annotations: verified low

Store a Credit Karma session to enable automatic token refresh. Pass the full Cookie header from a signed-in creditkarma.com request (Chrome DevTools \u2192 Network \u2192 any creditkarma.com request \u2192 Request Headers \u2192 right-click the `cookie` header \u2192 Copy value). For most users the easier onboarding path is to install the fetchproxy extension and sign into creditkarma.com \u2014 the MCP reads the cookies automatically.

cookies string
readOnlyHint false
ck_sync_transactions
annotations: verified low

Sync Credit Karma transactions into the local SQLite database.

force_full boolean
readOnlyHint false
ck_list_transactions
annotations: verified low

List transactions with optional filters. Paginated.

limit number offset number status string account string category string end_date string merchant string max_amount number min_amount number start_date string
readOnlyHint true
ck_get_recent_transactions
annotations: verified low

Return the N most recent transactions. Convenience shortcut for ck_list_transactions.

limit number
readOnlyHint true
ck_get_spending_by_category
annotations: verified low

Group debit transactions by category and return totals.

account string end_date string start_date string
readOnlyHint true
ck_get_spending_by_merchant
annotations: verified low

Return top merchants by total debit spend.

limit number category string end_date string start_date string
readOnlyHint true
ck_get_account_summary
annotations: verified low

Return per-account debit, credit, and net totals.

end_date string start_date string
readOnlyHint true

Permissions 4

network medium
Server uses network capabilities via: fetch()
filesystem low
Server uses filesystem capabilities via: fs
shell high
Server uses shell capabilities via: child_process, spawn()
env_vars low
Server uses env_vars capabilities via: process.env

Scan Findings 32

info
Tool 'ck_query_sql' annotations are consistent annotation_checker · 80%
info
Tool 'ck_set_session' annotations are consistent annotation_checker · 80%
info
Tool 'ck_sync_transactions' annotations are consistent annotation_checker · 80%
info
Tool 'ck_list_transactions' annotations are consistent annotation_checker · 80%
info
Tool 'ck_get_recent_transactions' annotations are consistent annotation_checker · 80%
info
Tool 'ck_get_spending_by_category' annotations are consistent annotation_checker · 80%
info
Tool 'ck_get_spending_by_merchant' annotations are consistent annotation_checker · 80%
info
Tool 'ck_get_account_summary' annotations are consistent annotation_checker · 80%
info
Sandbox failed to start for behavioral verification behavioral_verifier · 100%
medium
Vulnerable dependency: esbuild@0.28.0 (GHSA-g7r4-m6w7-qqqr) dependency_analyzer · 95%
medium
Hex string literal (>50 chars) in chrischall-creditkarma-mcp-044227f/tests/queryHash.test.ts:20 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in chrischall-creditkarma-mcp-044227f/tests/queryHash.test.ts:21 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in chrischall-creditkarma-mcp-044227f/tests/no-query-found.test.ts:144 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in chrischall-creditkarma-mcp-044227f/tests/no-query-found.test.ts:145 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in chrischall-creditkarma-mcp-044227f/src/client.ts:68 entropy_analyzer · 70%
info
package.json metadata manifest_parser · 100%
info
Tool: ck_query_sql manifest_parser · 85%
info
Tool: ck_set_session manifest_parser · 85%
info
Tool: ck_sync_transactions manifest_parser · 85%
info
Tool: ck_list_transactions manifest_parser · 85%
info
Tool: ck_get_recent_transactions manifest_parser · 85%
info
Tool: ck_get_spending_by_category manifest_parser · 85%
info
Tool: ck_get_spending_by_merchant manifest_parser · 85%
info
Tool: ck_get_account_summary manifest_parser · 85%
info
Required env vars (4) manifest_parser · 80%
info
Sandbox failed to start for output poisoning scan output_poisoning · 100%
medium
Permission: network access detected permission_analyzer · 70%
low
Permission: filesystem access detected permission_analyzer · 90%
high
Permission: shell access detected permission_analyzer · 95%
low
Permission: env_vars access detected permission_analyzer · 90%
info
SBOM generated: 222 components sbom_generator · 100%
medium
No build provenance detected (SLSA L0) slsa_assessor · 90%