Ghostfolio Mcp — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Ghostfolio Mcp (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
<!-- mcp-name: io.github.mhajder/ghostfolio-mcp -->
Ghostfolio MCP Server is a Python-based Model Context Protocol (MCP) server designed to provide advanced, programmable access to Ghostfolio portfolio management and financial data. It exposes a modern API for querying, analyzing, and managing your investment portfolio through Ghostfolio's comprehensive features. The server supports both read and write operations, robust security features, and is suitable for integration with automation tools, financial dashboards, and custom portfolio management applications.
The easiest way to get started is to install from PyPI:
# Using UV (recommended)
uvx ghostfolio-mcp
# Or using pip
pip install ghostfolio-mcpRemember to configure the environment variables for your Ghostfolio instance before running the server:
# Create environment configuration
export GHOSTFOLIO_URL=https://domain.tld:3333
export GHOSTFOLIO_TOKEN=your-ghostfolio-tokenFor more details, visit: https://pypi.org/project/ghostfolio-mcp/
git clone https://github.com/mhajder/ghostfolio-mcp.git
cd ghostfolio-mcp# Using UV (recommended)
uv sync
# Or using pip
pip install -e .cp .env.example .env
# Edit .env with your Ghostfolio URL and token# Using UV
uv run python run_server.py
# Or directly with Python
python run_server.py
# Or using the installed script
ghostfolio-mcpFor development with additional tools:
# Clone and install with development dependencies
git clone https://github.com/mhajder/ghostfolio-mcp.git
cd ghostfolio-mcp
uv sync --group dev
# Run tests
uv run pytest
# Run with coverage
uv run pytest --cov=src/
# Run linting and formatting
uv run ruff check .
uv run ruff format .
# Run type checking
uv run ty check .
# Setup prek hooks
uv run prek install# Ghostfolio Connection Details
GHOSTFOLIO_URL=https://domain.tld:3333
GHOSTFOLIO_TOKEN=your-ghostfolio-token
# SSL Configuration
GHOSTFOLIO_VERIFY_SSL=true
GHOSTFOLIO_TIMEOUT=30
# Read-Only Mode
# Set READ_ONLY_MODE true to disable all write operations (put, post, delete)
READ_ONLY_MODE=false
# Disabled Tags
# Comma-separated list of tags to disable tools for (empty by default)
# Example: GHOSTFOLIO_DISABLED_TAGS=portfolio,symbol
GHOSTFOLIO_DISABLED_TAGS=
# Logging Configuration
LOG_LEVEL=INFO
# Rate Limiting (requests per minute)
# Set RATE_LIMIT_ENABLED true to enable rate limiting
RATE_LIMIT_ENABLED=false
RATE_LIMIT_MAX_REQUESTS=100
RATE_LIMIT_WINDOW_MINUTES=1
# Tool Search Transform (Optional)
# Set TOOL_SEARCH_ENABLED true to replace full tool listings with search_tools + call_tool
TOOL_SEARCH_ENABLED=false
# Search strategy: bm25 (natural language) or regex (pattern match)
TOOL_SEARCH_STRATEGY=bm25
# Maximum number of tools returned by search_tools
TOOL_SEARCH_MAX_RESULTS=5
# Sentry Error Tracking (Optional)
# Set SENTRY_DSN to enable error tracking and performance monitoring
# SENTRY_DSN=https://[email protected]/6789
# Optional Sentry configuration
# SENTRY_TRACES_SAMPLE_RATE=1.0
# SENTRY_SEND_DEFAULT_PII=true
# SENTRY_ENVIRONMENT=production
# SENTRY_RELEASE=1.2.3
# SENTRY_PROFILE_SESSION_SAMPLE_RATE=1.0
# SENTRY_PROFILE_LIFECYCLE=trace
# SENTRY_ENABLE_LOGS=true
# MCP Transport Configuration
# Transport type: 'stdio' (default), 'sse' (Server-Sent Events), or 'http' (HTTP Streamable)
MCP_TRANSPORT=stdio
# HTTP Transport Settings (used when MCP_TRANSPORT=sse or MCP_TRANSPORT=http)
# Host to bind the HTTP server (default: 0.0.0.0 for all interfaces)
MCP_HTTP_HOST=0.0.0.0
# Port to bind the HTTP server (default: 8000)
MCP_HTTP_PORT=8000
# Optional bearer token for authentication (leave empty for no auth)
MCP_HTTP_BEARER_TOKEN=The server optionally supports Sentry for error tracking, performance monitoring, and debugging. Sentry integration is completely optional and only initialized if configured.
#### Installation
To enable Sentry monitoring, install the optional dependency:
# Using UV (recommended)
uv sync --extra sentry#### Configuration
Enable Sentry by setting the SENTRY_DSN environment variable in your .env file:
# Required: Sentry DSN for your project
SENTRY_DSN=https://[email protected]/6789
# Optional: Performance monitoring sample rate (0.0-1.0, default: 1.0)
SENTRY_TRACES_SAMPLE_RATE=1.0
# Optional: Include personally identifiable information (default: true)
SENTRY_SEND_DEFAULT_PII=true
# Optional: Environment name (e.g., "production", "staging")
SENTRY_ENVIRONMENT=production
# Optional: Release version (auto-detected from package if not set)
SENTRY_RELEASE=1.2.2
# Optional: Profiling - continuous profiling sample rate (0.0-1.0, default: 1.0)
SENTRY_PROFILE_SESSION_SAMPLE_RATE=1.0
# Optional: Profiling - lifecycle mode for profiling (default: "trace")
# Options: "all", "continuation", "trace"
SENTRY_PROFILE_LIFECYCLE=trace
# Optional: Enable log capture as breadcrumbs and events (default: true)
SENTRY_ENABLE_LOGS=true#### Features
When enabled, Sentry automatically captures:
#### Getting a Sentry DSN
.env file#### Disabling Sentry
Sentry is completely optional. If you don't set SENTRY_DSN, the server will run normally without any Sentry integration, and no monitoring data will be collected.
get_accounts: Get all accounts in your portfolio including account types and balancesget_account_balances: Get account balances for a specific accountcreate_account: Create a new account in your portfoliodelete_account: Delete an existing account from your portfolio (destructive operation)get_portfolio_performance: Get portfolio performance data including returns, benchmarks, and performance metricsget_portfolio_holdings: Get portfolio holdings and positions including allocations and asset breakdownsget_portfolio_details: Get comprehensive portfolio details including accounts, positions, and summaryget_position: Get position details for a specific symbol from a data sourceget_investments: Get investment data grouped by time period showing cash flows and contributionsget_dividends: Get dividend data grouped by time period showing dividend payments and yieldget_orders: Get all activities/orders from your portfolio, optionally filtered by accountcreate_activity: Create a single new transaction/activity in your portfolio (BUY, SELL, DIVIDEND, INTEREST, FEE, etc.)delete_activity: Delete a single activity/transaction by its ID (destructive operation)get_market_data_for_asset: Get market data for a specific assetadd_market_data_points: Add one or more market data points for an asset (typically a MANUAL data source — Ghostfolio rejects writes for auto-fetched sources)get_symbol_data: Get symbol data for a specific asset from a data sourceget_historical_data: Get historical data for a specific symbol on a specific datelookup_symbols: Search for symbols using a query stringget_asset_profile: Get asset profile information for a specific symbolupsert_asset_profile: Create-or-update an asset profile (idempotent; tolerates Ghostfolio's HTTP 500 on the create step and relies on the subsequent PATCH as the source of truth)delete_asset_profile: Delete an asset profile (destructive operation; may delete associated activities and market data depending on backend rules)import_transactions: Import transactions into your portfolio (bulk import operation)get_health: Get system health status of the Ghostfolio backend serviceget_platforms: Get list of available platforms (brokers, exchanges, etc.) for account trackingget_user_info: Get user information and settingsThe server supports a read-only mode that disables all write operations for safe monitoring:
READ_ONLY_MODE=trueWhen enabled, this mode prevents any modifications to your portfolio data while still allowing full read access to all information.
You can disable specific categories of tools by setting disabled tags:
GHOSTFOLIO_DISABLED_TAGS=portfolio,symbol,importAvailable tags include:
account - Account management tools (create, delete, get accounts)portfolio - Portfolio analysis and performance toolssymbol - Symbol lookup and data toolsimport - Data import toolsasset - Asset profile toolsuser - User information toolssystem - System health and platform information toolsactivities - Activity/transaction management tools (create, delete activities)The server supports rate limiting to control API usage and prevent abuse. If enabled, requests are limited per client using a sliding window algorithm.
Enable rate limiting by setting the following environment variables in your .env file:
RATE_LIMIT_ENABLED=true
RATE_LIMIT_MAX_REQUESTS=100 # Maximum requests allowed per window
RATE_LIMIT_WINDOW_MINUTES=1 # Window size in minutesIf RATE_LIMIT_ENABLED is set to true, the server will apply rate limiting middleware. Adjust RATE_LIMIT_MAX_REQUESTS and RATE_LIMIT_WINDOW_MINUTES as needed for your environment.
FastMCP tool search can reduce prompt size for servers with many tools. When enabled, list_tools returns two synthetic tools:
search_tools: Finds matching tools and returns their full schemascall_tool: Executes any discovered tool by nameEnable it with:
TOOL_SEARCH_ENABLED=true
TOOL_SEARCH_STRATEGY=bm25 # bm25 or regex
TOOL_SEARCH_MAX_RESULTS=8 # optional, default is 5bm25 supports natural language queries, while regex uses a regex pattern input for deterministic matching.
Tool search respects existing visibility controls (read-only mode and disabled tags).
The server supports SSL certificate verification and custom timeout settings:
GHOSTFOLIO_VERIFY_SSL=true # Enable SSL certificate verification
GHOSTFOLIO_TIMEOUT=30 # Connection timeout in secondsThe server supports multiple transport protocols for different deployment scenarios:
#### STDIO Transport (Default)
The default transport uses standard input/output for communication. This is ideal for local usage and integration with tools that communicate via stdin/stdout:
MCP_TRANSPORT=stdio#### HTTP SSE Transport (Server-Sent Events)
For network-based deployments, you can use HTTP with Server-Sent Events. This allows the MCP server to be accessed over HTTP with real-time streaming:
MCP_TRANSPORT=sse
MCP_HTTP_HOST=0.0.0.0 # Bind to all interfaces (or specific IP)
MCP_HTTP_PORT=8000 # Port to listen on
MCP_HTTP_BEARER_TOKEN=your-secret-token # Optional authentication tokenWhen using SSE transport with a bearer token, clients must include the token in their requests:
curl -H "Authorization: Bearer your-secret-token" http://localhost:8000/sse#### HTTP Streamable Transport
The HTTP Streamable transport provides HTTP-based communication with request/response streaming. This is ideal for web integrations and tools that need HTTP endpoints:
MCP_TRANSPORT=http
MCP_HTTP_HOST=0.0.0.0 # Bind to all interfaces (or specific IP)
MCP_HTTP_PORT=8000 # Port to listen on
MCP_HTTP_BEARER_TOKEN=your-secret-token # Optional authentication tokenWhen using streamable transport with a bearer token:
curl -H "Authorization: Bearer your-secret-token" \
-H "Accept: application/json, text/event-stream" \
-H "Content-Type: application/json" \
-d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}' \
http://localhost:8000/mcpNote: The HTTP transport requires proper JSON-RPC formatting with jsonrpc and id fields. The server may also require session initialization for some operations.
Ghostfolio supports multiple data sources for market data and symbols:
When using tools that require a data source parameter, specify the appropriate source for your asset type.
A Docker images are available on GitHub Packages for easy deployment.
# Normal STDIO image
docker pull ghcr.io/mhajder/ghostfolio-mcp:latest
# MCPO image for usage with Open WebUI
docker pull ghcr.io/mhajder/ghostfolio-mcpo:latestgit checkout -b feature/amazing-feature)uv run pytest && uv run ruff check .)git commit -m 'Add amazing feature')git push origin feature/amazing-feature)GNU Affero General Public License - see LICENSE file for details.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.