PocketSmith MCP server vs YNAB

PocketSmith MCP server 40

Statuspage at status.pocketsmith.com with components for web, mobile and API, feeds and email, none for MCP (15). One 'Unexpected outage and degraded performance' on 18 August 2026 in the last 90 days (10). API rate limits not found in the docs read (0). An Errors guide in the developer docs, no retry guidance found (5 of 15). No SLA found (0). Not labelled beta (10). 15 + 10 + 0 + 5 + 0 + 10 = 40.

YNAB 82

Statuspage at ynabstatus.com with a Public API component and incident history (20). The 14 October check read the record from the page's /api/ data path, which its robots.txt disallows, so that reading is struck and the record is read from history.atom instead. From 4 August to 2 November 2026 the feed lists an incident with Google Play Store subscriptions on 14 October, Synchrony card connections through Direct Import from 29 October and planned maintenance on 24 October, none touching the Public API, so the page posts incidents and none touches the product (30). Rate limit of 200 requests an hour per access token, rolling window, documented (15). 429 too_many_requests is documented with "wait awhile and try again", but there's no Retry-After and the X-Rate-Limit header was removed in v1.73.0; import_id on created transactions matches retries instead of duplicating them (7 of 15). No SLA found (0). The API is generally available (10). 20 + 30 + 15 + 7 + 0 + 10 = 82.

PocketSmith MCP server 46

Schemas not read without sign-in (15 of 25). llms.txt and a Markdown copy of every docs page (10). Capabilities described by task, not per tool (8 of 20). Inputs not verifiable (5 of 15). Usage examples and an errors guide for the REST API (8 of 15). The developer changelog's newest entry is almost eight years old (0). 15 + 10 + 8 + 5 + 8 + 0 = 46.

YNAB 77

Public OpenAPI 3.1.1 file, version 1.88.0, 44 operations, with the import endpoint marked deprecated (25). No llms.txt or Markdown docs for the API; api.ynab.com/llms.txt answered 401 and www.ynab.com/llms.txt describes the app, per the 14 October check (0). Tag and parameter descriptions say what each resource is and when to use the last-used and default plan aliases, and the docs say to request the most specific resource; little when-not-to-use guidance (14 of 20). Typed parameters with 15 enums, maxLength and required fields, few loose objects (12 of 15). An error table with ids such as 403.1 subscription_lapsed and 403.4 data_limit_reached, sample responses in the docs, few examples in the spec (11 of 15). Versioned spec and a dated changelog from v1.68.0 to v1.88.0 (15). 25 + 0 + 14 + 12 + 11 + 15 = 77.

PocketSmith MCP server 53

Registry entry com.pocketsmith/mcp at 0.1.0, updated 31 October 2026 (30). No dated MCP releases found (0). Help centre and support email; no current changelog (8 of 15). Official registry entry under its own namespace (15). No package to read (0). 30 + 0 + 8 + 15 + 0 = 53. Registry presence read from Anchor Terminal's own daily import of the official MCP registry (/api/v1/registry.json, 6 November 2026), not the registry's API.

YNAB 82

Last API change v1.88.0 on 28 October 2026, which deprecated the import transactions endpoint (30). Since 4 August the changelog has v1.87.0 (17 September) and v1.88.0 (28 October), and the Python SDK has 4.4.0 (12 August) and 4.4.1 (21 October) from its repository tags, both of which only update dependencies and the runtime floor, so they count half each. 2 + 0.5 + 0.5 = 3 dated releases (20, was 0). Closed service with a dated changelog and email support at api@ynab.com that says replies may take up to a week; on the JavaScript SDK maintainers merge their own pull requests within days, but an issue opened on 1 August and a community pull request of 23 August had no reply per the 14 October check (10 of 15). Three official SDKs, regenerated from the spec, but none yet at v1.88.0 (Python carries spec 1.86.0, JavaScript and Ruby 1.85.0), and the JavaScript SDK's newest release is 4.5.0 and Ruby's 5.2.0 of 2 July 2026 (12 of 15). Build and Test CI on the JavaScript SDK, Dependabot and Socket scans, with dependency updates merged through 29 October (10). 30 + 20 + 10 + 12 + 10 = 82.

PocketSmith MCP server 52

Closed service; the privacy policy names PocketSmith Limited (15). Data handling is described by purpose and names Plaid and Salt Edge as feed providers, with no retention periods (15 of 30). No deprecation policy found (2 of 20). Bank-feed processors named, no full subprocessor list (10 of 20). 15 + 15 + 2 + 10 = 42.

YNAB 75

Closed service with API terms, general terms and a privacy policy; SDKs under Apache-2.0 (15). The privacy policy, effective 20 April 2026, gives retention periods (account data up to 24 months after a subscription or trial ends, support conversations up to 3 years, workshop recordings 21 days) and agrees with the security page on deletion; no DPA or subprocessor list found (20 of 30). Deprecated fields such as goal_target_month and debt_original_balance are dated in the changelog, the old domain and /budgets paths still work, and the import endpoint deprecated on 28 October still accepts requests; no written deprecation policy, and that deprecation took effect the day it was announced (12 of 20). Data is processed in the US with Standard Contractual Clauses for UK and EEA transfers, hosting on Heroku and AWS and the aggregators Plaid and MX are named, other subprocessors only by category (10 of 20). 15 + 20 + 12 + 10 = 57.

PocketSmith MCP server 55

66 tools on the full server (5), with a separate 40-tool read-only server (5 back). Pagination guide for the REST API (12 of 20). Errors guide (10 of 20). Deletes always need the user's approval, and a read-only server exists; annotations not read (15 of 20). One-click directory listings in Claude and ChatGPT; SDKs not checked (8 of 15). 10 + 12 + 10 + 15 + 8 = 55.

YNAB 71

Specific single-resource endpoints, since_date and until_date, a type filter (uncategorized, unapproved), and delta requests on nine resources; no field selection (17 of 25). No pagination on lists; date filters and delta requests stand in for it (12 of 20). Errors carry id, name and detail, with 403 split into five documented causes an agent can act on (17 of 20). Reads are safe to repeat and import_id prevents duplicate transactions, with 409 on conflicts and duplicate_import_ids in responses; no idempotency key for other writes (10 of 20). The last-used plan alias cuts a call, few required parameters, and official SDKs for JavaScript, Python and Ruby (15). 17 + 12 + 17 + 10 + 15 = 71.