Aggregate

Ask your AI about your finances.

Aggregate is a read-only finance MCP server: an open-source double-entry ledger that connects your banks, cards, payment apps, books and payroll to your AI.

Every account, company and holding, in one link for Claude, ChatGPT or your own agents.

Reconciled to the cent, and your AI can never move money.

Website · Get started · Self-host · Safety · Docs

English · 简体中文 · 日本語 · 한국어 · Español · Português (Brasil) · Deutsch · Français

Does Aggregate see my bank password? No. You sign in to your bank through Plaid, and to each app on its own page. Aggregate gets a token, encrypted with a key kept outside the database, and only ever uses it to read. Does my data train AI models? No. Aggregate never uses your data to train models and doesn’t let anyone else. What your AI reads is covered by your AI provider’s own policy. Can it move money? Never. There’s no tool and no connection that can pay, transfer or pay a bill. It emails someone else only when you send an invite. How does it count cash, burn and runway? The same way every time. Aggregate computes each figure from one written definition , not your AI, and says “unknown” instead of guessing. What doesn’t it do yet? Crypto, banks outside the US (upload statements instead), cash sales in Square, and more. Each is on Known limits , with what happens instead.

Who it’s for

What you can ask

Once it’s connected, just ask:

*“How much cash do we have across all our companies, and how many months of runway?”*

*“Which invoices are overdue, and who owes us the most?”*

*“How are my investments doing?”*

*“How much is in my personal accounts right now?”*

*“I paid a contractor $500 in cash for Harbor Coffee. Add it.”*

*“What does each company owe me personally?”*

More in the prompt recipes.

Your AI does the thinking. Aggregate makes sure the numbers underneath are right: every payment counted once, balances checked against your bank, and every record traceable to where it came from.

Get started

Connect your AI

One line for each AI:

Or copy the link into any AI that supports MCP:

https://app.aggregate.finance/mcp

You sign in, then choose exactly what that AI can see in one plain sentence. Running your own server? Use https:// /mcp instead.

Agent skill. Teach your agent when to use these tools, the fixed definitions behind cash, burn and runway, and to stay read-only unless you ask (skills/aggregate/SKILL.md):

npx skills add Izzy-Gottz/aggregate-finance

Bots and scripts that can’t sign in

Create a key in Connect your AI → Connect another AI → A bot or script. Keys look like agfn_live_…, are shown once and always expire. Send it as a header:

curl -H "Authorization: Bearer $AGFN_KEY" https://app.aggregate.finance/v1/overview

Or bridge it to a local MCP client over stdio:

AGFN_KEY=agfn_live_… npx aggregate-finance mcp --url https://app.aggregate.finance/mcp

The same tools are available as a REST API, described at /v1/openapi.json.

What it connects

Aggregate only ever reads from your providers and has no way to move money. On hosted, Stripe and Square access is read-only at the source too. QuickBooks, BILL, Lemon Squeezy and Expensify don't offer read-only access, so what they grant could do more than read; Aggregate only reads from all four. Every company you own lives side by side, plus a private Personal space.

[!NOTE]

Aggregate is early. On hosted, Stripe has been on the Stripe App Marketplace since 2026-10-26 and Shopify on the

Shopify App Store since 2026-10-22. Xero connects up to 5 organizations on hosted until Xero certifies

the app. The other

connectors are built to each provider’s documentation and are being verified with real accounts. Issues and fixes

are very welcome.

How it compares

We also measured it. On our benchmark (100 questions about one made-up company, one model), answers through Aggregate were 100/100 correct. The same model reading tidy exported files with Python got 98/100 and cost less ($0.17 against $0.41). Read the caveats there before quoting it: a two-question gap is within run-to-run noise, Aggregate's tools were tuned on these same questions, and real exports are messier than the ones tested.

Safety

Money is the one place an AI can’t be sloppy, so control is the core of the product, not an add-on.

• Your AI can never move money. No payments, no bills paid, no invoices or emails sent. Ever.
• Each AI gets its own permission, written as a sentence you can read: which companies, which kinds of data, read only or read and add, and when it expires. Checked on every single request.
• Everything is logged and undoable. Every question an AI asks and every record it adds, labeled with who added it. Undo for 30 days, or turn on review so AI changes wait for you. Pause or revoke any AI in one click.
• Your secrets stay encrypted. Provider tokens are encrypted with a key kept outside the database (KMS and 1Password supported). Bank logins go through Plaid and are never seen by Aggregate.
• Built for prompt injection. Text from documents and memos is treated as untrusted, and a red-team suite of injection attacks runs on every change.
• Passkeys (or a code sent by email) are required again before connecting accounts or giving an AI more access.

Read the threat model and security policy.

Run it yourself

Everything is open source, including every hosted feature. Self-hosting needs Node 22.18+ or Docker.

git clone ht