Model Context Protocol (MCP)

Sure includes an MCP server that lets compatible AI assistants use the financial data and tools available to your Sure account.

An authorized client can read the user and family financial data exposed by Sure’s MCP tools. Depending on the tools available in your Sure version, it may also be able to make changes. For example, import_bank_statement can create a transaction import from an uploaded bank-statement PDF. Only connect clients and AI providers you trust, and review tool requests before approving them.

Connect an AI assistant

Sign in to Sure and open Settings > MCP Server.
Copy the MCP server URL shown on the page. Sure builds this URL from your configured base URL and appends /mcp.
Open Claude.ai and go to Settings > Connectors.
Select Add a connector.
Enter the connector name and paste the MCP server URL from Sure Settings > MCP Server, then select Add.
Select the connector’s Connect button to complete authorization. Your browser redirects to Sure. Sign in if needed, then authorize access.

After authorization, the client can use the Sure tools exposed to it. Other MCP-compatible clients follow the same general process: give the client the URL from Settings > MCP Server, then complete Sure’s sign-in and authorization flow in your browser. The client handles the MCP and OAuth protocol details; you do not need to register it or create an access token manually.

Manage connected clients

The Connected clients section under Settings > MCP Server lists clients with active access to your account. Select Revoke beside a client to invalidate its token. Revoke clients you no longer use or recognize.

Available tools and access

The current Assistant.function_classes registry exposes the following tools. Tool availability and schemas can vary by Sure version, so clients should use tools/list as the source of truth for their installation.

Read

Tool	Description
`get_transactions`	Search transactions with optional filters and pagination; useful for finding transactions and calculating statistics for small groups of results
`get_recurring_transactions`	Detected and manual recurring transactions (subscriptions, bills, salaries) with expected dates and per-currency totals
`get_accounts`	List accounts with current and historical balances and account metadata
`get_holdings`	Search Investment and Crypto account holdings, including portfolio, performance, and cost-basis data; results are paginated
`get_balance_sheet`	Retrieve balance-sheet and net-worth data with historical information
`get_income_statement`	Retrieve income and expenses by category for a date range
`get_budget`	Compare a monthly budget with spending by category, with an optional prior-month trend comparison
`get_merchants`	List merchants with the IDs that `update_transaction` accepts and the exact names that `get_transactions` filters on
`get_tags`	List family tags alphabetically
`get_categories`	List family categories hierarchically, including IDs and parent relationships
`search_family_files`	Search uploaded family documents and return relevant excerpts and source filenames. This is the vector-store document index, not the Statement Vault — statements archived via `upload_account_statement` are not searchable through it

Rules

Tool	Description
`get_rules`	List the family’s transaction rules with conditions, actions (account, category, tag, and merchant names resolved), whether each rule is active, its effective date, and its latest run. Pass `rule_id` for a single rule including its current match count. Pass `search` to match by rule name, condition values, action values, or category names. Results are paginated.
`get_rule_options`	Return the condition types, operators, and action types a rule can use. Call this before `preview_rule` or `create_rule` to build a valid definition. AI-backed actions (`auto_categorize`, `auto_detect_merchants`) are not available through MCP.
`preview_rule`	Show which transactions a rule matches without changing anything. Pass either `rule_id` for a saved rule or an unsaved definition with `conditions` and `actions`. Returns the match count, a sample of the most recent matching transactions, and the actions in readable form. For a saved rule it can also return the `preview_token` that `apply_rule` requires. A nonzero match count needs at least one visible sample; a rule with zero matches can receive a token for future activation.
`create_rule`	Save a new transaction rule. Rules are always saved inactive and do not change any transaction until `apply_rule` activates them. Returns the saved rule and a preview, with a `preview_token` when the preview meets the sample requirements described above.
`update_rule`	Update a rule’s name, conditions, actions, effective date, or set it inactive. Supplying conditions, actions, or an effective date deactivates it, even if the supplied value is unchanged; call `apply_rule` after checking the returned preview. Cannot activate a rule; use `apply_rule` for that. Rules with AI-backed actions must be edited in Settings > Rules.
`apply_rule`	Activate a rule and apply it to matching transactions. Requires the `preview_token` from the latest `preview_rule`, `create_rule`, or `update_rule` call for that rule (`get_rules` does not issue one). The token expires after 30 minutes and is invalidated if the rule definition or its match count changes. By default, transactions whose values were set by hand are preserved; pass `override_locked: true` to overwrite them. Runs in the background.

New rules are saved inactive; renaming an existing active rule can leave it active. apply_rule is the only tool that activates a rule and applies it to existing transactions. A preview_token from an actual preview is required; it expires after 30 minutes and is invalidated if the rule definition or match count changes since the preview was issued. AI-backed actions (auto_categorize, auto_detect_merchants) are not available through MCP — edit those rules in Settings > Rules.

Create, update, and import

Tool	Description
`import_bank_statement`	Use AI extraction to import transactions from an already-uploaded bank-statement PDF; creates a transaction import and returns its ID and rows for review
`create_goal`	Create a savings goal linked to at least one eligible depository account, only after confirming key details with the user. The available-accounts list returned on failure includes how much each account has free to earmark and whether it is already claimed in full by another goal. Pass an `earmarks` map (account name → amount) to reserve a specific portion of an account rather than its whole balance — required when an account is already claimed in full.
`create_tag`	Create a unique family tag
`update_tag`	Update an existing tag’s name or color
`create_category`	Create a unique category, optionally as a subcategory
`update_category`	Update an existing category’s name, color, or icon
`create_transaction`	Create a new transaction on a writable account. Negative amount = income (money in), positive = expense (money out). Pass `type` (`income` or `expense`) to derive the sign from a positive magnitude instead. Pass `external_id` (and optionally `source`, defaulting to `"mcp"`) to make the call idempotent: a repeat call with the same account + source + external_id returns the existing transaction instead of creating a duplicate.
`delete_transaction`	Permanently delete a transaction and its ledger entry, recalculating the account balance. Pass the transaction `id` returned by `get_transactions` or `create_transaction`. Optionally pass `account_id` as a guard so a mismatched id cannot delete the wrong record. Split child transactions cannot be deleted individually; delete the split parent instead.
`unmatch_transfer`	Unlink a confirmed or pending transfer between two accounts, keeping both transactions. A confirmed transfer’s legs return to standard kinds; a pending match’s existing kinds are preserved. Pass the `transaction_id` of either side or the `transfer_id`. By default the pairing is rejected so auto-match won’t suggest it again; pass `reject: false` to only unlink. Fee transactions attached to the transfer are deleted with it and listed in the result. Pass `dry_run: true` to preview the effect first.
`update_transaction`	Update an existing transaction’s name, notes, category, merchant, or tags after finding it with `get_transactions`
`update_budget`	Update budget allocations for a month
`set_opening_balance`	Set a manual account’s opening balance and, optionally, the date it applies from. Returns whether the current balance will change as a result. Pass `dry_run: true` to preview the effect without writing. Accounts synced from a provider are refused.

create_transaction and delete_transaction write to the ledger. delete_transaction is permanent and irreversible. import_bank_statement is not read-only. It requires a bank-statement PDF already uploaded to Sure and creates an import for review; it does not publish the import automatically. Because MCP access is scoped to the Sure user who authorizes the client, tools can access that user’s family data. Review tool calls whenever your client offers that option. apply_rule activates a rule and runs it against matching transactions, respecting rule order and attribute locks by default. Deactivating the rule does not undo earlier changes.

Preview tools

These tools appear only when the MCP user has opted into preview features under Settings > Preferences. Until then they are absent from tools/list, and calling one by name returns an “Unknown tool” error. The Statement Vault tools also require the user to be an admin or member, matching the permissions enforced in the web UI.

Tool	Description
`upload_account_statement`	Store a statement document (PDF/CSV/XLSX) in the Statement Vault; deduplicates by SHA-256
`list_account_statements`	List vault documents with their SHA-256, period, linked account, and review status
`get_account_statement`	One statement’s details and its reconciliation checks against the ledger. Present only after the opening and closing balances have been entered in the web UI. Does not return the file; stored documents are served only to a signed-in browser session
`get_statement_coverage`	Month-by-month statement coverage for an account: `covered`, `missing`, `mismatched`, `ambiguous`, `duplicate`, `not_expected`, each with a reconciliation status
`record_valuation`	Record an account’s value on a date, with a required source citation
`get_valuations`	List recorded valuations newest first, including the citation stored in each entry’s notes; the read pair for `record_valuation`
`get_insights`	Read the proactive insights feed (spending anomalies, cash-flow warnings, subscription audits, and more) without marking anything read
`get_bills`	List bills, subscriptions, and other recurring obligations with each one’s current payment state; supports filtering by status, payment state, bill type, due date window, and name search
`get_bill_details`	One bill’s full configuration, open occurrences, payment history, price-change history, and cost analytics; pass the exact `bill_id` returned by `get_bills`
`get_paycheck_plan`	Income plan sliced into pay periods: what is due before the next payday, what stays reserved for later bills, and what is safe to spend; requires at least one declared income schedule
`get_bill_audit`	Deterministic review of bills: possible duplicates, price changes, trials about to convert, upcoming renewals, long-overdue bills, dormant bills, and undeclared recurring patterns
`create_bill`	Create a bill, subscription, installment plan, or income schedule; confirm key details with the user before calling
`update_bill`	Update one bill’s configuration; amount changes apply from today forward and status accepts `active` or `paused`
`record_bill_payment`	Record a partial or full payment against a bill’s open occurrence

These tools are designed for agents that maintain a document-backed record of a family’s wealth over time.

Technical details

Sure serves MCP over JSON-RPC 2.0 at the URL displayed in Settings > MCP Server. The endpoint supports initialize, tools/list, and tools/call over HTTP POST requests. MCP-compatible clients use this URL and handle browser-based sign-in and authorization with Sure. Sure authenticates each MCP request with an active OAuth access token that has the read_write scope. The token’s resource owner determines the Sure user and family available to the tools. Sure creates a fresh transient session for that user for the request so an existing browser or impersonation session is not reused.

Dynamic client registration redirect URIs

Sure registers MCP clients dynamically via POST /register. The redirect_uris field must contain at least one URI that matches one of the following schemes:

https — any HTTPS URI with a host (e.g. https://claude.ai/callback)
Loopback HTTP — http://localhost, http://127.0.0.1, or http://[::1] (any port)
Native-app private-use scheme — custom URI schemes used by desktop and mobile OAuth clients, such as cursor://anysphere.cursor-mcp/oauth/callback, vscode://augment.vscode-augment/auth/mcp, or reverse-domain schemes like com.example.app:/oauth2redirect/example-provider

A registration request may include a mix of the above (for example, Cursor’s default payload includes a cursor:// scheme, a loopback HTTP URI, and an https URI in the same list). Sure validates every URI in the list; if any URI fails validation the entire registration is rejected. The following URI schemes are always rejected: javascript, data, file, about, blob, ws, wss, ftp, mailto, tel, sms, and intent. Plain HTTP to a non-loopback host is also rejected. URIs with a userinfo component or a fragment are rejected regardless of scheme.

Dynamic client registration client names

The client_name field in a POST /register request is optional; Sure defaults to "MCP Client" when it is absent. Two additional restrictions apply:

Reserved names — Names that contain the word “Sure” as a whole word, or that start with “SureMobile”, are reserved for first-party apps and are rejected with invalid_client_metadata. The check is case-insensitive, strips punctuation, invisible characters, and combining marks, and maps look-alike Cyrillic, Greek, and Armenian letters to their Latin equivalents before matching. Names such as “Measure Mobile” or “Surefire” are not affected.
Bidirectional control characters — Names that contain any Unicode bidirectional control character (for example U+202E RIGHT-TO-LEFT OVERRIDE) are rejected with invalid_client_metadata. These characters can make the consent screen render a different name than the one stored, so Sure rejects them instead of silently stripping them.

Both rules return HTTP 400 with error: "invalid_client_metadata".

Protocol version and transport

Sure supports protocol versions 2025-03-26 and 2025-06-18. The current default is 2025-06-18, which introduces the Streamable HTTP transport used by clients such as Bifrost v1.6.3 and later. During the initialize handshake, the client sends its preferred version in params.protocolVersion. Sure selects that version if it is supported, or falls back to 2025-06-18 otherwise. The agreed version is returned in the initialize response body and echoed in the Mcp-Protocol-Version response header on every subsequent response. The initialize response also includes a sessionId field. Sure records the session in a server-side cache for 24 hours. Subsequent requests may include this value in the Mcp-Session-Id request header; Sure validates the session and echoes the ID in the corresponding response header. Clients that do not send a session ID are still served normally.

Legacy environment-token fallback

Self-hosted deployments can optionally support older clients that cannot complete the browser authorization flow. Set both MCP_API_TOKEN to a high-entropy secret and MCP_USER_EMAIL to an existing Sure user’s email. The client sends the configured token as a bearer token, and the selected user’s family data is exposed to the available MCP tools. This is a compatibility fallback: Sure tries OAuth access-token authentication first. Prefer the connection flow in Settings > MCP Server, and protect, rotate, and avoid logging any fallback token.

Optional Pipelock proxy

Pipelock is an optional security proxy that can scan MCP tool calls and responses for secret exfiltration, prompt injection, and tool poisoning before forwarding traffic to Sure. Sure’s AI Docker Compose example exposes Pipelock’s MCP listener on port 8889 and forwards it to Sure’s internal /mcp endpoint. The Helm chart can similarly expose a Pipelock MCP ingress. Operators who deploy it should provide users with the proxied MCP address. Pipelock adds scanning; it does not replace Sure’s browser sign-in and authorization or require users to configure OAuth manually. Operators can see the Pipelock section in the Helm guide for deployment and policy options. Use TLS, restrict direct access to /mcp when practical, and ensure clients use the proxied URL so they cannot bypass scanning.

Getting started

Key concepts

App features

Development

Authentication

Third party providers

Knowledge Base

Connect an AI assistant

Manage connected clients

Available tools and access

Read

Rules

Create, update, and import

Preview tools

Technical details

Dynamic client registration redirect URIs

Dynamic client registration client names

Protocol version and transport

Legacy environment-token fallback

Optional Pipelock proxy

​Connect an AI assistant

​Manage connected clients

​Available tools and access

​Read

​Rules

​Create, update, and import

​Preview tools

​Technical details

​Dynamic client registration redirect URIs

​Dynamic client registration client names

​Protocol version and transport

​Legacy environment-token fallback

​Optional Pipelock proxy

Connect an AI assistant

Manage connected clients

Available tools and access

Read

Rules

Create, update, and import

Preview tools

Technical details

Dynamic client registration redirect URIs

Dynamic client registration client names

Protocol version and transport

Legacy environment-token fallback

Optional Pipelock proxy