Watchlist MCP

Connect an AI client to your Watchlist account with a named MCP server. You select the tools that each server can use. Each server has its own public URL and OAuth authorization.

Create a server

1. Sign in to Watchlist.
2. Open Settings → MCP.
3. Create a server. Enter a name and select the tools to enable.
4. Copy the server URL.

The URL has this form:

https://watch.fincobra.com/api/watchlist/mcp/{serverId}

The URL identifies the server. The client must sign in with OAuth before it can use account tools. Keep tokens private.

Connect an AI client

In ChatGPT, add an MCP plugin with the copied server URL. Select OAuth as the authentication method. Start the connection, sign in to FinCobra, and review the requested tools. Approve access to connect the client.

A client can show the sign-in prompt when you install the plugin or when you first use it. The client refreshes its authorization automatically. If authorization expires or you revoke it, sign in again.

For other clients, add a remote MCP server with the same URL. The client must support Streamable HTTP and OAuth with S256 PKCE. Use the client's connection control to sign in and approve access.

Ask the client to run get_connection_status to check the connection. A connection in ChatGPT does not guarantee a connection in Codex or another client. Connect each client that you use.

Tools

Only the tools selected for the named server are available to the client.

Tool	Input	Function
get_connection_status	None	Check the account and server connection.
get_net_worth	None	Read portfolio totals and valuation status.
list_sources	None	List Watchlist sources.
get_source	sourceId	Read one Watchlist source.
create_manual_asset	assetType, name, currency, value, idempotencyKey; optional accountType, mortgageBalance, note, initialLoans	Add a bank account, cash account, property, or car.
update_manual_asset	sourceId, name, currency, value, idempotencyKey; optional accountType, mortgageBalance, note	Replace the details of a manual asset.
delete_manual_asset	sourceId, idempotencyKey	Delete a manual asset.
create_bank_loan	sourceId, name, amount, currency, idempotencyKey	Add a loan to a manual bank account.
update_bank_loan	sourceId, loanId, name, amount, currency, idempotencyKey	Replace the details of a bank loan.
delete_bank_loan	sourceId, loanId, idempotencyKey	Delete a bank loan.
add_wallet	blockchain, address, idempotencyKey	Add a public wallet address or Bitcoin xpub.
remove_wallet	sourceId, idempotencyKey	Remove a wallet from Watchlist.

Use a source ID returned by list_sources. IDs have the form manual:ID, wallet:ID, or exchange:PROVIDER. Manual asset tools accept only manual:ID. The wallet removal tool accepts only wallet:ID.

Manual assets

Set assetType to manual_bank, manual_property, or manual_car. For a bank or cash account, use manual_bank and set accountType to bank or cash. For a property, you can set mortgageBalance. Each entry in initialLoans has name, amount, and currency fields.

Supported currencies are USD, AED, VND, EUR, GBP, JPY, SGD, AUD, CAD, CHF, CNY, RUB, GEL, and THB. Use non-negative values for asset values, mortgage balances, and loan amounts.

Deleting a bank account also deletes its saved loans. Deleting a record does not move funds or repay a loan.

An update sets the required asset fields. Optional accountType, mortgageBalance, and note fields stay the same when omitted. Set an optional field to null to clear it where the asset type permits. The asset type cannot change. Existing bank loans stay in place. Use the bank loan tools to create, update, or delete each loan. Set sourceId to the parent bank account ID (manual:ID). For an update or deletion, use a loan's id from the account details as loanId. These tools accept bank accounts only. A bank account with loans cannot change to a cash account.

Wallets

Set blockchain to bitcoin, ethereum, arbitrum, bsc, or solana. Supply a public address in address. For Bitcoin, you can supply an xpub. These tools do not accept private keys or exchange credentials. They cannot change account security settings.

Retry a change

Supply an idempotencyKey for each write request. Reuse the same key and input when you retry the same action. The key is bound to the account, named server, tool, and input. A key used with a different tool or input returns an error.

A successful retry returns the saved result, including after a later edit or deletion. Manual asset and wallet creation results contain the source details and sourceId. Manual asset updates contain the updated source details and sourceId. Bank loan creation and update results contain sourceId and a loan object. Delete and remove results contain sourceId and deleted: true; bank loan deletion also returns loanId.

Check valuationStatus and valuation notes before you use portfolio totals. Totals are in USD. If the valuation is incomplete, netWorthUsd is null and knownSubtotalUsd contains only the known values.

Change access

Open Settings → MCP to change the server name or enabled tools, then save. Saving applies the selected tools to all active connections for that server, including existing access and refresh tokens. You do not need to reconnect to apply a tool change. Refresh the tool list in your AI client if it still shows the previous selection.

Saving does not restore a revoked connection or an expired authorization. Connect again when authorization is no longer valid.

Delete a server to stop access through its URL. Revoke a connection to stop that client's access. Read tools can expose private account data. Enable write tools only when the client must change account data, and review each requested action.

OAuth endpoints

Clients discover authorization from the server's protected resource metadata:

https://watch.fincobra.com/.well-known/oauth-protected-resource/api/watchlist/mcp/{serverId}

The authorization server metadata is at:

https://watch.fincobra.com/.well-known/oauth-authorization-server

The authorization server provides these endpoints on the same origin:

• Authorization: /api/mcp/authorize
• Token exchange and refresh: /api/mcp/token
• Client registration: /api/mcp/register
• Token revocation: /api/mcp/revoke

The authorization page opens at /mcp/connect. Access is bound to the account, product, and named server that the user approves.