Lunchmoney Cloudflare Connector

Deploy LunchMoney's MCP server to Cloudflare so Claude (desktop or mobile) can use it as a custom connector. Sign-in is gated by Google, with an optional Gmail allowlist for beta deployments. Each end-user supplies their own LunchMoney API token on first connect — the operator deploying the worker does not need a LunchMoney token.

What you'll need

As the operator (the person deploying):

• A free Cloudflare account
• A Google Cloud account (to create the OAuth client all end-users authenticate against)
• Node 22 or newer

As an end-user connecting from Claude:

• A Google account (one of the allowlisted Gmail addresses, if the operator configured an allowlist)
• A LunchMoney API token — you'll paste this once at the /setup page on first connect

Quick start

git clone https://github.com/bm1549/lunchmoney-mcp-cloudflare.git
cd lunchmoney-mcp-cloudflare
./setup.sh

The wizard walks you through everything below — KV namespaces, deploy, Google OAuth client, secrets, redeploy — and prints the final URL to paste into claude.ai.

Setup (manual)

1. Clone, install, log in to Cloudflare

git clone https://github.com/bm1549/lunchmoney-mcp-cloudflare.git
cd lunchmoney-mcp-cloudflare
npm install
npx wrangler login

2. Create the KV namespaces

npx wrangler kv namespace create OAUTH_KV
npx wrangler kv namespace create USER_TOKENS

Open wrangler.jsonc and paste the printed ids over REPLACE_WITH_OAUTH_KV_ID and REPLACE_WITH_USER_TOKENS_ID respectively.

3. Deploy once to mint your URL

npx wrangler deploy

The output prints a URL like https://lunchmoney-mcp.<your-subdomain>.workers.dev. Copy it — you'll need it next.

4. Set up Google sign-in

At Google Cloud → APIs & Services → Credentials:

1. Configure the OAuth consent screen → External + Testing. Add the Gmail addresses you want to allow as test users.
2. Create credentials → OAuth client ID → Web application.
3. Add an Authorized redirect URI:

   https://lunchmoney-mcp.<your-subdomain>.workers.dev/authorize/callback
   

4. Copy the Client ID and Client Secret.

5. Set the worker secrets

echo -n "<google-client-id>"      | npx wrangler secret put GOOGLE_CLIENT_ID
echo -n "<google-client-secret>"  | npx wrangler secret put GOOGLE_CLIENT_SECRET
echo -n "[email protected]"           | npx wrangler secret put ALLOWED_EMAILS
openssl rand -hex 32              | npx wrangler secret put STATE_SECRET

ALLOWED_EMAILS is optional and serves as a beta gate. Leave it unset (or set it to an empty string) to allow any Google account with a verified email. Set it to a comma-separated list to restrict access.

6. Redeploy

npx wrangler deploy

7. Connect from Claude

In claude.ai → Settings → Connectors → Add custom connector:

https://lunchmoney-mcp.<your-subdomain>.workers.dev/mcp

The first time you connect:

1. You'll be bounced through Google sign-in.
2. After sign-in you'll land on a /setup page asking for your LunchMoney API token.
3. Paste a token from my.lunchmoney.app/developers and submit.
4. You'll be returned to Claude with all LunchMoney tools registered.

On subsequent connects you'll skip step 2 — the stored token is reused.

Token rotation (v1 limitation)

This release does not yet expose a self-serve UI for rotating or deleting a stored token. To rotate, the operator deletes the user's KV row:

# `sub` is the Google subject id printed in worker logs at sign-in time.
npx wrangler kv key delete --binding USER_TOKENS "user:<sub>"

The user will then be sent back through /setup on their next connect. A /settings page for self-serve rotation is a planned follow-up.

Troubleshooting

• Google warns "App is being tested" — normal in Testing mode. Continue.
• Forbidden: <email> is not authorized after Google sign-in — that address isn't in ALLOWED_EMAILS. Either add them to the allowlist or unset it for open signup.
• Setup link expired at /setup — the resume token is good for 30 minutes. Re-launch the connect flow from Claude.
• Anything else — npx wrangler tail streams live logs from the deployed worker.

License

MIT