Private beta. Invites rolling out now
Moonlight Request access

Connectors

MCP

Last updated: September 20, 2026

Connect an AI assistant to your Moonlight account over the Model Context Protocol. The endpoint is read-only. Tools cannot move money, pay bills, edit transactions, or change the account. Every tool is scoped to the authenticated user.

Endpoint

POST to the connector URL. The same handler also answers at /api/mcp/ (trailing slash). Transport is Streamable HTTP. The server is stateless: it neither issues nor validates an Mcp-Session-Id. Each request is self-contained. 

https://app.moonlightfi.com/api/mcp

Tools

Each tool can only see the authenticated user's data.

list_accounts

List your financial accounts with balances and metadata.

get_net_worth

Summarize your finances: assets, liabilities, net worth, cash, and investments, from your accounts.

list_transactions

List your transactions, newest first. Optional filters: accountId, category, startDate, endDate, and limit (default 100, max 1000).

list_categories

List your custom transaction categories.

get_financial_tip

Generate a short, personalized financial tip.

get_profile

Get your profile (id, email, name) and whether you've given data consent.

Authentication

Two ways to connect. Chat apps should use OAuth. Terminal clients use a personal access token.

OAuth 2.1 with PKCE

Preferred for chat apps (Claude, Muse). PKCE is required: S256 only. The plain method is rejected. Clients register themselves through dynamic client registration. Authorize is consent-gated. You approve the client in the app before a code is issued.

Discovery:

  • https://app.moonlightfi.com/.well-known/oauth-protected-resource
  • https://app.moonlightfi.com/.well-known/oauth-protected-resource/api/mcp

Personal access token

Send Authorization: Bearer <token>. Mint and revoke tokens in the app at Settings → AI Assistants (MCP). The plaintext is shown once. We store only a SHA-256 hash. Deleting your account revokes your tokens.

Claude Code, Codex, and Grok

Mint a personal access token in the app, copy it when it's shown (you won't see it again), and export it as MOONLIGHT_MCP_TOKEN. Then:

Claude Code

claude mcp add --transport http moonlight https://app.moonlightfi.com/api/mcp \
  --header "Authorization: Bearer $MOONLIGHT_MCP_TOKEN"

Codex

Add this to ~/.codex/config.toml.

[mcp_servers.moonlight]
url = "https://app.moonlightfi.com/api/mcp"
bearer_token_env_var = "MOONLIGHT_MCP_TOKEN"

Grok

grok mcp add --transport http moonlight https://app.moonlightfi.com/api/mcp \
  --header "Authorization: Bearer $MOONLIGHT_MCP_TOKEN"

Verify with claude mcp list, codex mcp list, or grok mcp doctor moonlight.

Claude and Muse

Paste the connector URL https://app.moonlightfi.com/api/mcp and complete OAuth. You'll approve the request in Moonlight before anything is issued. For Muse custom connectors, use the secure credential flow. Don't paste a token in chat.

What Muse can ask

  • What's my net worth?
  • How am I spending by category?
  • What accounts do I have, and what are the balances?
  • Give me a financial tip.

Limits

120 requests per minute, per user.

  • 401: the credential is missing, revoked, or expired.
  • 429: you hit the rate limit.

Questions about this endpoint? Email us at security@moonlightfi.com. For how we protect the data an assistant can read, see Security.