v0.4.0

Upgrading

• Rebuild with make all. Gold migration 0112 applies on the first
  read-write open. It changes only the order of tied rows in
  cashflow coverage. No reload is needed.
• The MCP server is optional. It stays off until wealthdb.cfg has an
  mcp block with "enabled": true. A config without the block behaves
  as before.
• A demo directory built by an earlier release has no mcp block. Run
  make demo before make demo-mcp.

MCP server

• A new component, mcp/, serves the read-only reports to AI agents
  over the Model Context Protocol.
  A model asks what was spent on groceries last year and gets the table
  wealthdb spending prints.
  • wealthdb mcp start runs it in the engine image, on loopback port
    3300. wealthdb mcp url prints the URL and the header for a client.
  • wealthdb mcp stdio serves one session to a client that starts the
    server itself.
  • status, restart, logs and stop manage it. make demo-mcp
    serves the demo household on port 3400.
• Eleven tools: holdings, returns, transactions, spending,
  income, cashflow, status, snapshots, resolutions,
  categorizations and describe. Every parameter is optional. The
  tools filter, sort and page their rows, so a model needs no shell and
  no jq.
• The tools are written for small local models as well as large ones.
  One call usually answers a question:
  • a filter picks the view that has its column;
  • a result is one row per account, category or type for the whole
    window, unless the call asks for monthly or yearly rows;
  • money sorts by size, whatever its sign;
  • a misspelt column name resolves when one column is that close;
  • every result states the dates and the currency it used.
• It reads the live database, read-only, for one call at a time. There
  is nothing to refresh after a load. A test holds the report tools'
  results to the CLI's, cell for cell.
• Two endpoints. /mcp serves full data. /mcp/privacy applies the
  CLI's -p to every result, and no tool parameter can turn it off. It
  hides amounts, quantities, account numbers and the names taken off
  statements. Account names, holdings, categories and dates stay
  legible. wealthdb mcp stdio --privacy is the same over stdio.
• It is locked down by default:
  • it has no tool that writes;
  • every HTTP request needs a bearer token, generated on first start;
  • turning the token off takes both "auth": "none" and
    "insecure": true, and the server warns while it is off;
  • it is published on loopback only, and refuses a foreign Host or
    Origin;
  • the data and the config are mounted read-only, in a container with
    a read-only file system and no capabilities.
• Claude Desktop runs it from its config file, over stdio, also on
  another host over SSH. Its custom-connector dialog cannot reach a
  local server. mcp/README.md has both configs.
• After a later rebuild of the image, run wealthdb mcp restart. A
  running server keeps the old binary, and wealthdb mcp status says
  so.
• See mcp/README.md. Read its security section before you give a
  model the URL.

Help

• wealthdb, wealthdb help and --help say what the database holds.
  The listing puts the read-only reports first and says what question
  each one answers. The write commands follow, labelled as such.
• wealthdb help <command> prints the command's full help, the same
  text as <command> -h. wealthdb help <view> does the same for a
  holdings view.
• The help of each report says more:
  • holdings include property, loans and private holdings, and a loan
    is a negative value;
  • mortgage payments and plan contributions are in cashflow flows,
    not in spending;
  • in the line views, money leaving is negative;
  • a category someone names, such as groceries, is a detailed one;
  • --period total gives one figure for a whole window.
• The wealthdb-ro skill gains a recipe for each common question, and
  rules for --period total, JSON keys and signs. It points an agent
  without a shell to the MCP server.

Engine

• A command that finds the database locked by another one waits up to
  nine seconds for it. It failed at once. This covers a load that
  meets a report in progress, and a report that meets a call to the MCP
  server.
• cashflow coverage lists tied rows in a fixed order, so two runs
  print the same table.

Build and docs

• The engine gains one dependency, the official
  MCP Go SDK, and the
  modules it needs. The other Go dependencies are updated.
• make test-mcp tests the server's lifecycle script, and make test
  runs it.
• AGENTS.md gains rules for documentation, login flows, env files and
  private narrative.