Skip to content

0.5.0

Choose a tag to compare

View all tags
@calebl calebl released this 19 Oct 11:47
0.5.0
6aa7813
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Security

  • Updated @modelcontextprotocol/sdk to 1.32.1 (#70). This fixes a high-severity advisory in which the SDK's OAuth client could send credentials to an authorization server chosen by the MCP server (fixed upstream in 1.31.0). Upgrading is recommended. The lockfile also resolves the development-only dependencies sharp to 0.35.5 (librsvg CVE-2026-96889) and shell-quote to 1.12.0 (quote() command injection); neither ships in the npm package.

Smarter category suggestions (#72)

  • ynab_suggest_categories now routes each row through exact-payee history, then a personal prior learned from your own categorized outflows on each request, and only then the model.
  • A single agreeing exact-payee row is now enough for a history suggestion. Disagreeing history goes to review with source history_rule instead of to the model.
  • Model answers are always needs_review, never suggested.
  • Optional YNAB_AI_TYPICAL_PAYEES=true sends each category's most frequent payee names to the model. It is off by default because it discloses aggregated payee history to TypeSafe.
  • New guide: Evaluating categorization and local decision models.

Auto-budget service for the Cloudflare Worker, shadow mode (#73)

  • An optional scheduled service, run by the Worker's existing hourly cron, keeps a D1 mirror of transactions and accounts, records shadow decisions in an audit log, and sends alerts and a daily digest through Pushover. It never writes to YNAB in this version. It is off unless AUTOBUDGET_MODE and an AUTOBUDGET_DB binding are set; see DEPLOY.md.
  • Worker-only MCP tools ynab_autobudget_status, ynab_autobudget_plan (dry run) and ynab_autobudget_pause.

Fixed

  • When YNAB_PLAN_ID names a plan the token cannot access, calls now say so and list the plans the token can see, instead of failing with "Resource not found".

See CHANGELOG.md for the full list.

Assets 2
Loading