Tags: riseup-oss/mcp

v0.3.0: expose accountNumberHash on transactions and budget

Document the new per-account identifier field now returned on every
transaction and budget actual. Stable, opaque, 6-character; distinguishes
multiple accounts under the same source (e.g. two Isracard cards on the
same customer).

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

v0.2.0: add get_transactions tool + enhanced get_budget description

- New get_transactions tool: filter cashflow transactions by
  cashflowMonth (strict YYYY-MM), transactionDate (YYYY-MM-DD), or
  businessName (case-insensitive substring); filters AND together.
  Handler rejects calls with neither month nor date client-side before
  hitting the rate-limited API. Consumes the new RiseUp API endpoint
  /api/external/transactions; tool description documents the response
  shape (amount + isIncome, installmentNumber, ISO datetime dates,
  accountNickname)
- get_budget tool description expanded with response-shape docs
  (envelope types, balancedAmount semantics, actuals structure,
  currency and sign conventions) — same tool, same response
- docs/rate-limits.md synced to actual server limits (60/min, 1000/day)
- CHANGELOG, README updated; 9 new tests (34 total)

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

v0.1.1: diagnostic env-var errors, 403 scope-detail parsing, README l…

…ink cleanup

Addresses 4 UX issues raised by early reviewers:

1. RISEUP_PAT error messages now distinguish three cases — unset vs
   empty-string vs wrong-format — and the wrong-format variant includes
   a safe prefix snippet of the received value so users can spot
   copy-paste mistakes. Old "token looks malformed" message was misleading
   when the env var was actually just unset.

2. 403 responses now parse the JSON body and surface scope detail when
   the upstream API provides it ("Missing scope: budget:read. Your token
   has: transactions:read."). Falls back to the previous generic message
   when the body is empty or not JSON.

3. README link cleanup: previous "Log into the [RiseUp web app](input...)"
   wording invited readers to assume the URL was app.riseup.co.il (it's
   input.riseup.co.il). Replaced with a single unambiguous link to the
   tokens page. Same cleanup applied to docs/quickstart.md.

4. Config-change-needs-restart caveat made explicit in the Claude Desktop
   setup section (Cmd+Q and reopen, not just close window).

Tests: 21 -> 25 (added empty-string, prefix-in-error, 403-with-JSON-body,
403-non-JSON-fallback). Build clean.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>