MCP.Market

Spendlog MCP server

by makz81·io.github.makz81/spendlog·v1.0.4·1 stars
No reviews yet

MCP server for expense tracking, invoices, budgets, and financial insights directly in Claude

C63/100grade C
Write a reviewInstall
What users say
No reviews yet
Be the first
Safety scan
C63/100

full report

Adoption
New

1 stars

Reviews

Write one

Nobody has reviewed Spendlog yet.

If you have run it, two minutes of your experience saves the next person an afternoon.

Spendlog tools

No tool declarations could be read from the package source. They show once the server is installed.

Public scan report

scanner v0.1.9 · 2026-09-27 · same rubric, same numbers if you re-run it

1 high
  • Code scan85 source files scanned13/25
  • –Live reliabilityno gateway calls yet and no remote to proben/a
  • –Tool poisoningtools not inspected (local package is not executed); not countedn/a
  • Auth qualitylocal package, no credentials required12/15
  • Maintenancelast push 112 days ago8/15
  • Maintainer identityregistry namespace matches repository owner; GitHub account older than a year8/10

Findings (1)

  • highShell command built from a string (injection risk)exec.shell-concat
    dist/cli.js: … try { execSync(`claude mcp add spendlog --scope user -- npx -y --package=${PACKAGE_NAME} ${MCP_SERVER_BIN}`, { stdio: 'pipe' }); …
Overall 63/100. Components that don't apply are left out of the denominator. Any critical finding is an F.RubricAppeal a findingJSON

How Spendlog compares

Against every graded MCP server, from our own scans and uptime checks. Updated after each scan run.

Safety score
63/100
higher than 18% of 48,255 servers
GitHub stars
1
more than 65% of 28,688 servers

Install Spendlog in Claude Code, Cursor or VS Code

Runs npx -y spendlog on your machine. Read the scan report first; the gateway never runs local packages.

claude mcp add spendlog -- npx -y spendlog
Add to Cursor

Spendlog: common questions

Is Spendlog MCP server safe?
With care: it is graded C, so read the findings first (63/100). Read the Spendlog safety report
How do I install Spendlog?
It runs on your machine. Copy the Claude Code, Cursor, VS Code or Claude Desktop config from the install section.
Does Spendlog need an API key?
Not as far as the registry entry and our scan can tell: no credentials are declared or required.
Is Spendlog maintained?
The last commit was 149 days ago (2026-06-08). The latest release is v1.0.4.
How does Spendlog compare with other MCP servers?
safety score 63/100 (higher than 18% of 48,255 servers); github stars 1 (more than 65% of 28,688 servers). Full comparison.