Give your AI agent read-only access to real bank data.

One endpoint, OAuth sign-in

Sprout's MCP server is remote, so there is nothing to run locally. Clients connect over streamable HTTP to https://api-sprout.z4k.app/mcp. An unauthenticated request is refused, and the client finds the authorization server through Sprout's OAuth protected-resource metadata, then signs the person in with WorkOS AuthKit.

The result is a per-user access token. Every tool call runs as that user, and every query is scoped to that user's own Sprout data. Bank connections live in Sprout: people connect banks through Plaid in the Sprout app, and the MCP layer never handles bank credentials.

The tools

Each tool does one job and returns structured data that a model can explain without recalculating. Inputs accept dates, accounts, categories, merchants, and currencies where they apply, so an agent can scope a question tightly instead of pulling everything into context and filtering there.

Read-only guarantees

Sprout's bank access is read-only at the source, through Plaid. On top of that, every finance tool is annotated as read-only and non-destructive. No tool can move money, pay bills, cancel subscriptions, dispute charges, or place trades, because Sprout has no way to do those things in the first place.

The single exception is update_settings, which changes a Sprout preference such as the default reporting period. It touches nothing at the bank. An agent that goes off script can, at worst, change which period Sprout uses when a question doesn't name one.

Structured outputs an agent can rely on

Finance tools declare output schemas and include a JSON text fallback, so clients get typed results either way. The arithmetic happens on the server. compare_periods returns both totals, the delta, and the percentage, and it says explicitly when the earlier period was zero instead of implying an impossible percentage.

Searches report full match counts and per-currency signed totals, with paged results and continuation offsets, so an agent never mistakes the first page for the whole answer. get_data_health exposes coverage gaps, sync failures, and missing permissions, which keeps missing history from looking like zero spending.

• USD and CAD are never combined. Totals are reported per currency and never converted, so a cross-border user gets two correct numbers instead of one blended guess.
• Every answer has receipts. Results carry the accounts and date range they cover.
• Estimates are labeled. Recurring dates and annual costs are estimates, unusual-charge matches are items to review rather than fraud findings, and net cash flow is not accounting profit.

Transaction text is data, never instructions

Bank descriptions are written by merchants and banks, not by the person in the chat, and an agent should never obey them. Sprout treats every transaction description as untrusted data. A merchant string that reads like a command comes back as a string and nothing more, which closes an obvious route for prompt injection through financial records.

We recommend the same posture on the client side. Treat tool results as facts to reason about, and take instructions only from the person in the conversation. Sprout's tool descriptions also stay free of cross-tool instructions, so they never try to steer which other tools a client calls.

Use it today in Claude

MCP clients that support remote servers with OAuth, such as Claude, can connect today. The Sprout plugin for Claude installs the server along with four guided skills for getting started, money reviews, subscription reviews, and charge reviews. In clients that render MCP Apps, open_sprout shows the Sprout dashboard beside the chat.

Sprout's ChatGPT app is built on the same server and is in review with OpenAI; the ChatGPT page tracks its status. People who would rather skip AI clients altogether get the same answers in Sprout on iPhone, Mac, and the web, with charts, tables, and saved conversations.