# FinanceSight > FinanceSight is a personal-finance and investing learning resource — a working, > self-hostable app built for family and friends, and shared with anyone keen to > build their financial knowledge. Track what you own, record why you bought it, and > learn the reasoning as you go: portfolios and trade history, written theses you can > check later, planning and goals, household sharing, and a built-in curriculum that > grows with you. It scales from a child's pocket money and the household budget to long-term investing and options. Choose a level and whole parts of the app switch on or off together; change it any time in Settings. Nothing is locked. Built by one person with AI assistance. It has not been reviewed by a > financial professional. It is not financial advice and not a robo-advisor — it is a > decision-support and learning tool. ## Who it's for Self-directed investors and learners who want more than a balance number: people who want to track holdings, keep a written record of their reasoning, and build financial knowledge over time. Built for the author's family and friends first, and shared openly with anyone keen to learn. ## Self-hostable and open source FinanceSight is designed to be self-hosted: you run your own instance and your data stays in your own database. The source is licensed under Apache-2.0. There is no public repository URL to link today — development happens in a private repository. If that changes, the link will appear here rather than being left to inference. ## Bring your own LLM (privacy) AI-assisted reflection is optional and runs on keys you control. Bring your own LLM API key — it is encrypted at rest, there is no pooled or vendor-supplied key behind the app, and you decide the cost — or point the app at a local Ollama model so your data never leaves your own machine. There is no default cloud LLM you are forced to send data to. A key stays yours unless you deliberately grant it to someone in your household, which is an explicit action and revocable. ## Machine interfaces FinanceSight is an application, not a public data service. Every interface below acts on one account's own records and requires a credential; none of it is anonymous, and none of it places orders — the app records trades made elsewhere. ### REST API Served at `/api/…` on the same origin as the app. - Described by an OpenAPI 3.1 document at `/api/openapi.json` (and `/api/openapi.yaml`), with a browsable Swagger UI at `/api/docs`. - Availability: always served outside production. On a production instance the operator must switch it on (`OPENAPI_DOCS`), and it is off by default — so a 404 there means the description is not published, not that there is no API. - The description is COMPLETE — it covers 116 of 116 route modules and 809 of 809 endpoints (100%). Every request body in it is the live validator the route enforces rather than a transcription of one, and a test mounts every route module and fails if a route is undocumented, if the document invents one, or if a body has drifted from its validator. The live figures are in `x-documentation-coverage` at the root of the document — read them rather than taking this sentence's word for it. ### MCP server A Model Context Protocol server ships with the app as its own process, exposing 143 tools over portfolios and positions, trade and cash logging, everyday account transactions (`list_accounts`, `log_transaction`, `list_transactions`), the options lifecycle, theses and factors, risk metrics, correlation and stress tests, regime state and position sizing, dealer-positioning briefs and signal rules, the research corpus, the journal, planning (goals, income, liabilities, planned outflows and the cashflow forecast), and playbooks. Ask it for `tools/list` — that is the authoritative list. - Transports: stdio by default (one process per connection, local and trusted, bound to a single token), or streamable HTTP at `/mcp` on its own port — 8090 by default — when the operator enables it. - Availability: SELF-HOST ONLY. It is not routed on the public host — there is no `/mcp` endpoint on financesight.com. Run your own instance to use it. - Factor citations go both ways: `attach_factor` cites an existing library factor on an existing thesis (idempotent on repeat; refuses a factor or thesis the caller does not own) and `detach_factor` removes that one link. Both are `research`-scope writes of structure — which reason a thesis cites — never of a Matrix verdict. - Record-to-record links are NOT machine territory. `link_records` / `unlink_records` maintain a directed `related` | `contrast` graph between corpus records, and the same graph is read and written by hand: the research corpus shows each record's links and the pack editor adds and removes them, over `/api/research-packs/records/:recordId/links`. Every edge is scoped on BOTH of its ends, so an edge onto a record the caller may not read is absent from the reply rather than named, counted or placeheld. ### OAuth 2.1 An authorisation-code flow for registered third-party clients, on the app origin: `/oauth/authorise`, `/oauth/token`, `/oauth/revoke`. Discovery documents (`/.well-known/oauth-authorization-server` and `/.well-known/oauth-protected-resource`) are served by the MCP HTTP transport, on that transport's own origin, when it is enabled. The application origin does not serve them. That is recorded here on purpose: a client starting from the web origin should use the three endpoints above and the security schemes in the OpenAPI document, and should not read the absence as a missing feature to wait for. ## Authentication There is one machine credential, not two, and it is not a bearer JWT. - **Browsers** use httpOnly session cookies — `fs_at` (short-lived access) and `fs_rt` (refresh; SameSite=Strict and scoped to the path `/api/auth/refresh`, so it is sent nowhere else) — set by `POST /api/auth/signin`. State-changing requests additionally carry a CSRF double-submit token: read the readable `fs_csrf` cookie, or bootstrap one from `GET /api/csrf`, and echo it in `X-CSRF-Token`. A 401 means refresh and retry; a 403 carrying `code: "CSRF"` means that token was missing or stale. - **Non-browser callers** (scripts, daemons, agents) send `Authorization: Bearer ms_…` — a personal access token, minted in the app under Settings → AI, long-lived and revocable. Header-credential callers are exempt from the CSRF check. The same token authenticates the MCP server. - That token is SCOPED: `read`, `price`, `trade`, `research`, `strategy:import`, `deployment:request`, `driver:submit`, `automation`, `full`, `admin`. Reads pass at any scope; a mutation must carry the scope for the resource group its path targets, or the answer is 403 with `code: "SCOPE"`. The admin surface requires the `admin` scope for reads as well as writes. - The OAuth flow issues that same `ms_…` token — it is one credential reached two ways. PKCE is required (`S256`; `plain` is refused), the client secret is required at the token endpoint, and `authorization_code` is the only supported grant: there is no refresh-token grant, so a client re-authorises when its token expires. - A legacy `x-access-token` session header is still accepted for older non-browser callers. It is unscoped and unrevocable; do not build on it. - A few operations — binding or removing a second factor — additionally require a short-lived step-up token in `X-Step-Up`, proving the person re-authenticated just now. - An operator may run an instance in a **username-only trial mode**. A trial account needs no email address; one is optional, and with a verified address password reset works as it does on any account, while an account with none cannot be recovered at all. Linking a sign-in provider to it is refused either way. A trial account is erased 90 days after its last sign-in — signing in restarts that period, and a deleted account cannot be recovered. It is a different kind of account from a guest session. It cannot connect a bank; every other interface above behaves identically. See the Privacy Policy below for the full terms. A guest session (the unauthenticated demonstration, not a signed-in account) is separate: its data is deleted after 30 days of inactivity, and in any case 90 days after the session was created, however active it has been. A guest session holding no data is removed after 24 hours idle. ## Important caveats - Built by one person with AI assistance. - It has NOT been reviewed by a financial professional. - It is NOT financial advice and NOT a robo-advisor. It is a decision-support and learning tool — the decisions, and the responsibility for them, remain yours. ## About this file This is the whole machine-facing summary. There is deliberately no `llms-full.txt`: a second document would be a second thing to keep true, and the parts of this one that can drift — the product statement, the legal URLs and the API coverage figures — are checked against their sources by a test in the repository. ## Legal - Terms of Service: https://financesight.com/legal/terms - Privacy Policy: https://financesight.com/legal/privacy - Cookie Policy: https://financesight.com/legal/cookies - Acceptable Use Policy: https://financesight.com/legal/aup - Data Processing Addendum: https://financesight.com/legal/dpa - Privacy Notice for Young People: https://financesight.com/legal/child-privacy - Security: https://financesight.com/legal/security - Sub-processors: https://financesight.com/legal/sub-processors