Sure MCP Server

Overview

Sure MCP Server is the remote MCP endpoint built into we-promise/sure, the community-maintained Sure Finance fork of Maybe Finance. It lets external AI assistants query a self-hosted Sure instance through JSON-RPC 2.0 methods for initialization, tool listing, and tool calls.

Use it when a finance-aware assistant needs structured access to a user's Sure data instead of copy-pasted exports. The strongest fit is a self-hosted Sure deployment where the operator wants Claude, OpenClaw, GPT agents, or a custom agent to analyze accounts, transactions, budgets, holdings, documents, and goals while keeping Sure as the system of record.

Status

Verified on 2026-06-18:

• GitHub repository: we-promise/sure
• Current source version in .sure-version: 0.7.2-alpha.7
• Latest GitHub release found during review: v0.7.1-hotfix.1, published on 2026-06-11
• License: AGPL-3.0
• GitHub metadata showed more than 8,700 stars and activity on 2026-06-18
• MCP implementation is present in main, documented in docs/hosting/mcp.md, routed as POST /mcp, exposed through Settings > MCP, and covered by controller tests

This entry treats the MCP surface as real but still early-maturity. Re-check the upstream docs, release notes, and .sure-version before using it for production financial workflows.

Install

Sure's self-hosting docs use Docker Compose as the recommended deployment path. For the AI and MCP stack, fetch the standard compose file, the AI compose file, and the Pipelock example configuration:

curl -o compose.yml https://raw.githubusercontent.com/we-promise/sure/main/compose.example.yml
curl -o compose.ai.yml https://raw.githubusercontent.com/we-promise/sure/main/compose.example.ai.yml
curl -o pipelock.example.yaml https://raw.githubusercontent.com/we-promise/sure/main/pipelock.example.yaml

Set MCP credentials in .env:

MCP_API_TOKEN=generate-a-random-token-here
MCP_USER_EMAIL=user@example.com

Then start the AI compose stack:

docker compose -f compose.ai.yml up -d

The MCP docs describe direct access at POST /mcp. The AI compose file also configures Pipelock as an MCP reverse proxy on port 8889 and recommends external AI clients connect through that proxy for scanning.

Client Configuration

For remote MCP clients that support HTTP endpoints and headers, connect directly to Sure:

{
  "mcpServers": {
    "sure": {
      "url": "https://your-sure-instance/mcp",
      "headers": {
        "Authorization": "Bearer ${SURE_MCP_TOKEN}"
      }
    }
  }
}

For deployments using Pipelock, point the client at the Pipelock MCP proxy instead:

https://your-pipelock-proxy.example.com

Some stdio-only MCP clients may need a bridge or proxy because Sure's endpoint is a remote JSON-RPC HTTP endpoint rather than a local stdio server.

Protocol and Auth

The McpController implements:

Authentication paths:

The settings page displays the instance MCP URL and lets a user revoke connected Doorkeeper tokens.

Tool Scope

The current Assistant.function_classes registry includes:

Best Use Cases

• Ask an external assistant to explain spending patterns from Sure transactions without exporting CSVs into a chat.
• Build a local OpenClaw or custom agent that calls Sure for finance context and keeps conversational orchestration outside the Rails app.
• Query account balances, investment holdings, net worth, income statements, and budget trends through a structured tool interface.
• Search uploaded financial documents, tax files, insurance policies, or bank statements from a family vault.
• Route inbound MCP traffic through Pipelock for DLP, prompt-injection, tool poisoning, and tool-call-policy scanning.
• Keep the app's internal AI assistant on the builtin provider while delegating chat to an external assistant that calls back through MCP.

Safety and Privacy

Sure MCP is useful because it gives agents structured access to sensitive finance data. That same access makes it high risk. Scope tokens to trusted clients, keep the endpoint behind TLS and a private network where possible, and prefer the Pipelock reverse proxy for inbound MCP traffic. The compose comments explicitly warn that /mcp remains reachable on the web port when that port is published, so network design still matters.

Use human confirmation for any tool that writes state, especially create_goal and import_bank_statement. Treat document search and bank-statement extraction as sensitive data flows because uploaded files and extracted excerpts may reach model providers, vector stores, external agents, logs, traces, and MCP clients.

Duplicate Check

Checked current content/mcp/, content/tools/, content/agents/, content/skills/, README entries, open pull requests, and repository-wide content for Sure Finance, Sure MCP, we-promise/sure, Maybe Finance MCP, OpenClaw Sure, personal finance MCP, and finance AI MCP. No dedicated Sure MCP Server entry, exact source URL duplicate, target file, or open duplicate PR was found.

Disclosure

Editorial listing. No paid placement or affiliate link is used. Sure is AGPL-3.0 open-source software. The hosted Sure site, OpenClaw, Pipelock, OpenAI-compatible providers, Anthropic support, vector stores, Langfuse, banking providers, app hosting, and mobile/debug builds may have separate terms, costs, security boundaries, and privacy controls.