MCP server documentation

Let your AI set itself up

The quickest way: copy this prompt into your AI client (Antigravity, Cursor, Claude Code, Codex...). It starts the bridge if needed and adds the server to its own configuration, then gives you the token and the address to paste into GlassFolio (Settings, AI & MCP). The prompt holds no secret and is always in English. The token will appear in your conversation with the AI; you can replace it at any time.

Configure and connect the GlassFolio MCP server to your AI client.Instructions:1. Start the MCP bridge if needed (`npx -y glassfolio-mcp serve` or `node mcp-server/index.mjs serve`) and get the token with the `token` command.2. Add the MCP server "glassfolio" to your local MCP configuration.3. Give me only the token and the address to paste into GlassFolio (Settings > AI & MCP).

How it works

Your vault is encrypted in your browser, and only your open GlassFolio tab holds the key: no program can read it from outside. The MCP server is therefore a bridge that runs on your own computer. Your AI client sends it a tool call, the bridge passes the call to your tab, the tab runs the tool on your data and sends the result back. Nothing goes through GlassFolio’s servers, and the bridge stores nothing.

What you need

• Node.js 22 and a copy of the repository: the bridge is mcp-server/index.mjs and has no dependency.
• GlassFolio open in a browser tab, signed in, with your vault unlocked.
• “Allow AI clients” turned on in Settings, AI & MCP.
• An AI client that supports MCP over stdio or Streamable HTTP.

$ git clone https://github.com/Damien-Esilv/GlassFolio.git$ cd GlassFolio$ node mcp-server/index.mjs --list

Local or online

$ claude mcp add --transport http glassfolio http://localhost:3000/mcp --header "X-GlassFolio-Token: <token>"

$ node mcp-server/index.mjs serve$ node mcp-server/index.mjs token

$ claude mcp add --transport http glassfolio http://127.0.0.1:47831/mcp --header "X-GlassFolio-Token: <token>"

Connect your AI client

Give your client the address of the bridge and its token (header X-GlassFolio-Token), or let it start the command itself. Settings, AI & MCP prepares these snippets with your own values.

{  "mcpServers": {    "glassfolio": {      "command": "node",      "args": ["/absolute/path/to/GlassFolio/mcp-server/index.mjs"]    }  }}

[mcp_servers.glassfolio]command = "node"args = ["/absolute/path/to/GlassFolio/mcp-server/index.mjs"]

Replace the path with the folder of your copy of the repository. Other clients, such as Cursor or Antigravity, take the same information in their own MCP settings: the address and the token, or the command.

Changes need your approval

A tool that changes your data, such as recording a transaction or creating a goal, does not run when the client asks. GlassFolio shows a card in your open tab, and the change is made only if you approve it there. If you do not answer within about a minute and a half, nothing is changed. In read-only mode, these tools are blocked.

Autonomous mode (Settings, AI & MCP) turns this confirmation off: the assistant, a local model and AI clients then change your data at once. A warning explains the risks before you turn it on, such as an agent following an instruction hidden in a document it reads. The actions on the account itself (locking the vault, changing the key, exporting your data, resending the verification email) still ask.

What leaves your computer

The results of the tools go to your AI client, and from there to the model it uses, as when you paste figures into a chat. API keys, recovery keys and authenticator seeds are removed before a result leaves GlassFolio. If nothing must leave your machine, connect a client that runs a local model.

Limits

• The tab has to stay open and unlocked. If you lock the vault or close the tab, the client is told to ask you to open GlassFolio again.
• One tab serves the clients at a time: opening a second tab takes over.
• The bridge listens on your own computer only and accepts only the token that you share.

Compatible clients

Any client that supports MCP over stdio or Streamable HTTP can use it. Claude Code

Tools

The 35 tools that the bridge offers, as your client sees them (the descriptions are in English). The ones marked “Needs your approval” change your data and wait for it.

• create_alert_ruleCreate a new custom alert rule for real-time portfolio monitoring (e.g. price threshold, P&L %, cash ratio). Requires user confirmation.Needs your approval
• create_goalCreate a new financial goal with a target amount. Requires explicit human confirmation before execution.Needs your approval
• export_gdpr_archiveDownload the GDPR access / portability archive (profile, consent, JSON backup and CSV files) of the current real account in the browser. Not available for the demo account. Requires explicit user confirmation. The archive content is never returned to the assistant.Needs your approval
• get_asset_allocationGet the asset allocation breakdown by asset class (Equity, Crypto, Cash, ETF, Real Estate) with values and percentages.Read-only
• get_cost_basis_methodRead-only. Return the cost basis method of accounts: WAC (weighted average cost, French PRU) or FIFO (first in, first out lots).Read-only
• get_email_verification_statusCheck whether the email address of the current GlassFolio account is verified (email/password accounts receive a verification code and link by email).Read-only
• get_gamification_statusRetrieve user gamification profile: current level, total XP, investor rank title, level progress percentage, and unlocked achievements count.Read-only
• get_portfolio_summaryGet an overall financial summary of the user portfolio (net wealth, cost basis, unrealized profit/loss, and position count).Read-only
• get_privacy_statusGet the legal and privacy status of GlassFolio: version and paths of the legal documents, the privacy contact, the current cookie / audience-measurement consent, and where to exercise GDPR rights (export and account deletion).Read-only
• get_progress_statsRetrieve the Stats shown in the Progress page: this week (transactions of the week, current tracking streak in weeks, XP earned this week) and all-time figures (total transactions, active weeks, current and best streak, total XP, level, achievements unlocked, goals reached, date tracking started). Read-only.Read-only
• get_security_statusInspect the current E2EE security posture of GlassFolio (vault lock state, encryption algorithm, 2FA/TOTP status, registered passkeys count, and recent security audit events with sanitized details).Read-only
• get_storage_statusReport where GlassFolio keeps the data in local mode (the local server / Docker volume, or only this browser) and whether recent changes were saved. Read-only; never exposes data or error internals.Read-only
• get_tax_summaryCalculate and return capital gains, tax estimates, and tax comparison (PFU flat tax vs barème progressif) for a given fiscal year in France.Read-only
• import_snapshotImport a holdings snapshot CSV into an account so its positions match the file exactly (non-fiscal adjustments, re-importing the same file changes nothing). Requires explicit human confirmation before execution. Use preview_snapshot_import first.Needs your approval
• list_alert_rulesList all custom user-defined alert rules (price threshold, P&L %, cash ratio) with their trigger history and enabled state.Read-only
• list_auth_methodsList all configured authentication and recovery methods for the current account (password, passkeys, TOTP 2FA, OAuth providers, and recovery key). Enrollment or removal of passkeys/TOTP cannot be performed via AI tools as it strictly requires biometric/physical user presence and interactive step-up validation.Read-only
• list_goalsList user financial goals, target amounts, current amounts, and completion percentages.Read-only
• list_instrumentsList the assets (instruments) known to the portfolio with their id, symbol, type (stock, etf, fund, crypto, cash, bond, other), ISIN and market identifiers. Use it to find the id before editing an asset.Read-only
• list_notificationsList all notifications and alerts with optional category filter (portfolio, fiscal, goals, security, system), read filter, and limit.Read-only
• list_positionsList user asset holdings and positions with quantities, average cost (PRU), current price, market value, and unrealized gains.Read-only
• list_questsList active periodic gamification missions and progress towards completion.Read-only
• list_transactionsList recent financial transactions with optional filtering by asset ticker or operation type (Buy, Sell, Deposit, Withdrawal).Read-only
• list_vault_secretsList all configured external API providers in the encrypted secrets vault (masked values only).Read-only
• lock_vaultImmediately lock the encrypted vault, wiping all decrypted keys from memory. Requires explicit user confirmation.Needs your approval
• manage_notificationsPerform management actions on notifications (mark single as read, mark all read, delete single, or clear all read). Requires user confirmation.Needs your approval
• preview_csv_importRead-only. Detect how a broker/bank CSV export would be imported: delimiter, header row, broker preset, date order and the proposed column mapping (history = transaction journal, snapshot = current holdings). Nothing is saved.Read-only
• preview_snapshot_importRead-only. Compare a holdings snapshot CSV with the current positions of an account and list what would change (new, increased, decreased, closed positions, average price updates). Nothing is saved.Read-only
• propose_csv_mappingRead-only. Propose which GlassFolio field each column of any broker/bank CSV should feed, from its header and its cells (works on unknown layouts and foreign languages). Every column is reported as matched, ambiguous (a weak or contested guess) or unmatched, with example values and alternatives, so the user only has to decide the doubtful ones. Nothing is saved.Read-only
• record_transactionRecord a new financial transaction (Buy, Sell, Deposit, Withdrawal). Requires explicit human confirmation before execution.Needs your approval
• resend_verification_emailSend a new verification email (security code + confirmation link) to the current account address. Only for unverified email/password accounts. Requires explicit user confirmation.Needs your approval
• rotate_encryption_keyInitiate rotation of the Data Encryption Key (DEK) to re-encrypt all stored records with a fresh AES-256-GCM key. For client-side envelope encryption security, the master password cannot be accepted via AI tool arguments; this action directs the user to the interactive in-app step-up re-wrapping flow.Needs your approval
• set_cost_basis_methodChange the cost basis method of an account (WAC = weighted average cost / PRU, FIFO = first in first out) and recompute its positions and realized P&L. Requires explicit human confirmation before execution.Needs your approval
• simulate_tax_impactSimulate French flat-tax (PFU: income tax + social contributions, at the rates of the fiscal year) impact for a hypothetical capital gain.Read-only
• suggest_next_milestoneAnalyzes incomplete or partially unlocked achievements and recommends the closest financial milestone within reach with actionable advice.Read-only
• update_instrumentEdit the metadata of an asset (name, symbol, type, ISIN, exchange, network, contract address, currency), for example to move a token from stocks to crypto. Positions and tax figures are recomputed. Identify the asset with instrumentId (see list_instruments) or its current symbol. Requires explicit human confirmation before execution.Needs your approval