Copilot Money MCP: why it is not safe to use

What we found

Our review did not find hidden instructions, hardcoded secrets, undisclosed remote code loading, or destructive behavior enabled by default. The main concern came from how live and write modes authenticate.

When those modes are enabled, the server reads the same Firebase refresh token stored in the user's logged-in browser session for `app.copilot.money`. The repository documents this behavior, and the related network access to Copilot Money's API and Google's token refresh endpoint is disclosed. Even so, this is broader credential access than a strictly local-only tool because it relies on a session token associated with the connected account.

That does not mean misuse was found. It means the skill asks for access to a sensitive session credential path that some users and teams may not want an AI-connected tool to depend on.

What to do instead

If you use this skill, prefer its local-only mode when possible. Only enable live or write modes if you understand that the tool will access the browser session refresh token tied to your Copilot Money account and send returned finance data to any connected AI provider you choose. For higher-assurance setups, use tools that keep all processing local or that support narrower, purpose-scoped credentials instead of browser session tokens.