Feature Request: MCP / Agentic Access

[goobta]

Hi folks!

Lifelong user of splitwise, recently started running SplitPro on my homelab and have been loving it!

One of my main use cases is that I vibe coded a tRPC client on my local computer w/ my Next auth token-- then I let AI rip on it and it can fully manage my expenses, itemize receipts, pull from my email + calendar, etc from natural language.

However, I'd prefer to have this supported first party over MCP since

1. using a Next session token is... not great lol
2. if folks have their SplitPro running on a public domain, then they can add splitpro.domain.com/mcp to their AI agent configs and manage expenses from their phone
3. Ideally offer granular permissions-- you can [not]force approvals on reads vs updates vs deletes

Basically, by offering it first party, SplitPro becomes plug-and-play with any AI client. If designed correctly, theoretically we could have multiple users connect via MCP and have it "just work" (i.e. my partner and I both connect to my splitpro, but she can only modify her groups/expenses)

Proposal

I haven't fully fleshed this out yet, but I'd imagine that this would require a couple of changes:

Make the API key-compliant ¹ (not 100% necessary, but I think that it will be a good addition to add). I haven't fully read the PRs from #300 / #615, but there's a chance that this is already done in in https://github.com/oss-apps/split-pro/milestone/7)

1. Support for User-Scoped Identity Tokens / API Keys
2. Large Scale Change: Back update existing API routes to support token auth (maybe done)

Add MCP Support

3. Annotate existing API routes to support MCP metadata
   • Inputs are already mostly Zod-validated
   • We mostly just need for outputs to also have ZodSchemas and some stricter DTOs
4. Dynamically register MCP endpoints from the API. Automatically scope based off of the method (GET, POST, etc) to figure out scope and/or destructive annotations. ²

Next Steps

If this seems reasonable, I can create issues / tracking bugs for each subtopic (or just do it in PRs, whatever you prefer), and put much more technical plans inside of them for your review. Happy to take on this feature!

Footnotes

1. I think that since SplitPro is already a Google OAuth Client, there is an auth flow where we just use that token. Futhermore, I think that the Google OAuth should be the golden auth flow, as that's what users use anyways to login. Having an API key is beneficial (in my mind) for writing other scripts / integrations and/or bundling a bunch of homelab MCP servers in a service like https://github.com/samanhappy/mcphub (my specific use case) ↩

2. I'm not 100% sold on the automatic MCP registration, because I fear that we might expose too much to the agent. I do like the pattern of having every route be MCP-compliant / registrable, but then setting something in code to "blacklist" or hide a route from the MCP: should be easier to maintain in the future. However, I do think that MCP should have basically all user-api access (including deletes) because that really enables it to cleanup your SplitPro. ↩

[krokosik]

Sounds good, the #707 PR looks like a major step towards that and quite promising as an implementation, but I didn't have time to properly review it as it's massive. Feel free to look at it and leave some comments, maybe there are some changes that would be beneficial for MCP usage that would be good to apply within that PR (of course relating to just the API key handling and the API itself). I'm open to adding such support in general, but my time is very limited and I have no experience with implementing MCPs.

[krokosik]

Oh and super glad to hear you are enjoying using SP!

[goobta]

sgtm!

Yeah I took a brief look at #707.. and realized that I def need a little more time to properly review it. I'll take a proper look through and try to see how it fits. If needed, I can try to cut out pieces of it in a way that could also support MCP lol

Lemme give it a read through and I'll report back! as mentioned before, before sending code, I'll make tracking tickets so you know what I'm sending lol

[krokosik]

Sounds good, thank you!