Source: https://watch.fincobra.com/docs/mcp.html

# Watchlist MCP

Connect an AI client to your Watchlist account with a named MCP server. You select the tools that each server can use. Each server has its own public URL and OAuth authorization.

## Create a server

1. Sign in to [Watchlist](https://watch.fincobra.com).
2. Open **Settings → MCP**.
3. Create a server. Enter a name and select the tools to enable.
4. Copy the server URL.

The URL has this form:

```text
https://watch.fincobra.com/api/watchlist/mcp/{serverId}
```

The URL identifies the server. The client must sign in with OAuth before it can use account tools. Keep tokens private.

## Connect an AI client

In ChatGPT, add an MCP plugin with the copied server URL. Select **OAuth** as the authentication method. Start the connection, sign in to FinCobra, and review the requested tools. Approve access to connect the client.

A client can show the sign-in prompt when you install the plugin or when you first use it. The client refreshes its authorization automatically. If authorization expires or you revoke it, sign in again.

For other clients, add a remote MCP server with the same URL. The client must support Streamable HTTP and OAuth with S256 PKCE. Use the client's connection control to sign in and approve access.

Ask the client to run `get_connection_status` to check the connection. A connection in ChatGPT does not guarantee a connection in Codex or another client. Connect each client that you use.

## Tools

Only the tools selected for the named server are available to the client.

| Tool | Input | Function |
| --- | --- | --- |
| `get_connection_status` | None | Check the account and server connection. |
| `get_net_worth` | None | Read portfolio totals and valuation status. |
| `list_sources` | None | List Watchlist sources. |
| `get_source` | `sourceId` | Read one Watchlist source. |
| `create_manual_asset` | `assetType`, `name`, `currency`, `value`, `idempotencyKey`; optional `accountType`, `mortgageBalance`, `note`, `initialLoans` | Add a bank account, cash account, property, or car. |
| `update_manual_asset` | `sourceId`, `name`, `currency`, `value`, `idempotencyKey`; optional `accountType`, `mortgageBalance`, `note` | Replace the details of a manual asset. |
| `delete_manual_asset` | `sourceId`, `idempotencyKey` | Delete a manual asset. |
| `create_bank_loan` | `sourceId`, `name`, `amount`, `currency`, `idempotencyKey` | Add a loan to a manual bank account. |
| `update_bank_loan` | `sourceId`, `loanId`, `name`, `amount`, `currency`, `idempotencyKey` | Replace the details of a bank loan. |
| `delete_bank_loan` | `sourceId`, `loanId`, `idempotencyKey` | Delete a bank loan. |
| `add_wallet` | `blockchain`, `address`, `idempotencyKey` | Add a public wallet address or Bitcoin xpub. |
| `remove_wallet` | `sourceId`, `idempotencyKey` | Remove a wallet from Watchlist. |

Use a source ID returned by `list_sources`. IDs have the form `manual:ID`, `wallet:ID`, or `exchange:PROVIDER`. Manual asset tools accept only `manual:ID`. The wallet removal tool accepts only `wallet:ID`.

### Manual assets

Set `assetType` to `manual_bank`, `manual_property`, or `manual_car`. For a bank or cash account, use `manual_bank` and set `accountType` to `bank` or `cash`. For a property, you can set `mortgageBalance`. Each entry in `initialLoans` has `name`, `amount`, and `currency` fields.

Supported currencies are `USD`, `AED`, `VND`, `EUR`, `GBP`, `JPY`, `SGD`, `AUD`, `CAD`, `CHF`, `CNY`, `RUB`, `GEL`, and `THB`. Use non-negative values for asset values, mortgage balances, and loan amounts.

Deleting a bank account also deletes its saved loans. Deleting a record does not move funds or repay a loan.

An update sets the required asset fields. Optional `accountType`, `mortgageBalance`, and `note` fields stay the same when omitted. Set an optional field to `null` to clear it where the asset type permits. The asset type cannot change. Existing bank loans stay in place. Use the bank loan tools to create, update, or delete each loan. Set `sourceId` to the parent bank account ID (`manual:ID`). For an update or deletion, use a loan's `id` from the account details as `loanId`. These tools accept bank accounts only. A bank account with loans cannot change to a cash account.

### Wallets

Set `blockchain` to `bitcoin`, `ethereum`, `arbitrum`, `bsc`, or `solana`. Supply a public address in `address`. For Bitcoin, you can supply an xpub. These tools do not accept private keys or exchange credentials. They cannot change account security settings.

### Retry a change

Supply an `idempotencyKey` for each write request. Reuse the same key and input when you retry the same action. The key is bound to the account, named server, tool, and input. A key used with a different tool or input returns an error.

A successful retry returns the saved result, including after a later edit or deletion. Manual asset and wallet creation results contain the source details and `sourceId`. Manual asset updates contain the updated source details and `sourceId`. Bank loan creation and update results contain `sourceId` and a `loan` object. Delete and remove results contain `sourceId` and `deleted: true`; bank loan deletion also returns `loanId`.

Check `valuationStatus` and valuation notes before you use portfolio totals. Totals are in USD. If the valuation is incomplete, `netWorthUsd` is `null` and `knownSubtotalUsd` contains only the known values.

## Change access

Open **Settings → MCP** to change the server name or enabled tools, then save. Saving applies the selected tools to all active connections for that server, including existing access and refresh tokens. You do not need to reconnect to apply a tool change. Refresh the tool list in your AI client if it still shows the previous selection.

Saving does not restore a revoked connection or an expired authorization. Connect again when authorization is no longer valid.

Delete a server to stop access through its URL. Revoke a connection to stop that client's access. Read tools can expose private account data. Enable write tools only when the client must change account data, and review each requested action.

## OAuth endpoints

Clients discover authorization from the server's protected resource metadata:

```text
https://watch.fincobra.com/.well-known/oauth-protected-resource/api/watchlist/mcp/{serverId}
```

The authorization server metadata is at:

```text
https://watch.fincobra.com/.well-known/oauth-authorization-server
```

The authorization server provides these endpoints on the same origin:

- Authorization: `/api/mcp/authorize`
- Token exchange and refresh: `/api/mcp/token`
- Client registration: `/api/mcp/register`
- Token revocation: `/api/mcp/revoke`

The authorization page opens at `/mcp/connect`. Access is bound to the account, product, and named server that the user approves.