actual-mcp-server: why it is not safe to use

What we found

Our review did not find hidden instructions, hardcoded secrets, obfuscated code, privilege escalation behavior, or access to unrelated credential stores. The repository openly documents its transports, authentication options, and tool behavior. It also discloses that it downloads a local working copy of Actual Budget data to its data directory before syncing changes back to the user’s chosen Actual Budget server.

The main concern we found is in the exposed toolset: it includes destructive actions such as permanently deleting accounts and deleting transactions. In the materials we reviewed, we did not see a documented built-in confirmation gate before those write operations. That increases the risk of unintended data changes if a command is issued in error or with incomplete review.

What to do instead

Use this skill only where destructive budget actions are acceptable and easy to recover from. Prefer setups that add an explicit confirmation step for deletes and other permanent writes, or limit the skill to read-only or non-destructive operations when possible. Before connecting it to important data, make sure you have current backups or another recovery path for your Actual Budget instance.