Puzzle API and MCP vs rotki MCP server

Puzzle API and MCP 73

OAuth for MCP with a per-company choice and read-only default, and OAuth 2.0 with granular scopes on the API, defaulting to read-only scopes (28). Read-only by default, writes an opt-in beta with confirmation for each change (18). Bank descriptions and vendor names are third-party text, and no prompt-injection guidance was found (3). Every API request is logged per the docs, and a firm activity endpoint returns an audit log (12). A SOC 2 claim in the API docs and a bug bounty policy page; no security.txt (12). 28 + 18 + 3 + 12 + 12 = 73.

rotki MCP server 20

Credential model, desktop build. None. The launcher forces ROTKI_SESSION_KEY empty outside Docker (https://github.com/rotki/rotki/blob/v1.44.1/crates/starling/src/main.rs), so the server runs without a token, and any local process that can open 127.0.0.1:4445 can call the tools while the server runs (0 of 30). The Host and Origin allowlists in server.py stop browser pages from other origins. Docker takes a bearer token that lasts at most seven days and is revoked on logout, which is a single key and is not scored here. Read-only. No tool writes, and query_sql accepts one SELECT or WITH statement with a denylist, on an in-memory SQLite connection that never writes back to rotki (15 of 20). Prompt injection. Get_asset_details returns token names and symbols from GlobalDB as they are. The code's own comment says an asset name is attacker-controlled on a scam token. No injection guidance was found in the docs (5 of 15). Per-call visibility. The MCP module logs nothing per tool call. The server log follows --log-level, and the usage event goes to rotki when the analytics setting is on (0 of 15). Security programme. No SECURITY.md in the repository, no security.txt, and no bug bounty or disclosure policy found in the sources we read. No SECURITY.md in the repository on 4 November either. The GitHub Security tab was not confirmed (0 of 20). 0 + 15 + 5 + 0 + 0 = 20. CVE-2026-116071, the Premium backup key flaw fixed in 1.44.2, is charged under negative events.

Puzzle API and MCP 15

Hosted reading. status.puzzle.io exists but answered 403 to our reader, so no status page or history could be read (0, then 5 for no readable history). No rate limits found in the API docs (0). The errors page documents 409 RESOURCE_PROCESSING with retry later and 500 with retry, but no 429 or idempotency guidance (5). No SLA (0). MCP read access is live, write access is a beta, and the API docs say the API is under development (5). 0 + 5 + 0 + 5 + 0 + 5 = 15.

rotki MCP server 65

Read with the local-software lines, as localghost was. Installs from the rotki desktop app for Windows, macOS and Linux, as README.md states, and from a Docker image built from packaging/docker (20). Public CI. Rotki_ci.yml runs on pushes and pull requests to develop, master and bugfixes, and calls task_backend_tests.yml, which runs pytest over rotkehlchen/tests including tests/mcp. The run results are on GitHub pages our reader can't open, so 15 of 25 for public CI that runs the tests with an unread result (was 0). Unchecked. GitHub's issue pages can't be read by our reader, so open crash and regression issues score absent (0). Semver-style releases (1.44.0, 1.44.1 and 1.44.2) with breaking changes called out in docs/dev_changelog.rst and in the user changelog, such as the 1.44.2 note that older versions can't restore backups made by it (15). Version 1.44.2, past 1.0 (15). 20 + 15 + 0 + 15 + 15 = 65.

Puzzle API and MCP 56

MCP tool count and sizes unpublished, so context cost can't be read (10 of 25). API list endpoints page with count and after or limit, and filter by date and status (16). Error codes and errorContext name the field or resource at fault (17). No idempotency keys found; the MCP server asks for confirmation before writes (8). No official SDKs; few required parameters on reads (5). 10 + 16 + 17 + 8 + 5 = 56.

rotki MCP server 69

Context cost. Eight tools with 9,258 characters of descriptions in total, of which refresh_analytics_data is 2,959 and query_sql 2,667. There is no toolset switch or read-only subset, though the server has no write tools (20 of 25). Output sizing is by row cap, not offset. Query_sql caps results at 500 by default and 5,000 at most, and reports result_truncated and the true row_count. Refresh filters history by time, and --max-events can bound a load, which is off by default. There is no paging cursor (15 of 20). Errors carry a code and a message. Premium_required and premium_check_failed each give an upgrade URL, and SQL errors point to list_tables and describe_table (16 of 20). No readOnlyHint or destructiveHint annotations are set in rotkehlchen/mcp, and every tool is read-only by construction, so retries are safe (10 of 20). Defaults are sensible. Refresh loads history_events unless told otherwise, and few inputs are required. No official SDK for the MCP server or the REST API was found in the repository or the docs we read (8 of 15). 20 + 15 + 16 + 10 + 8 = 69.

Puzzle API and MCP 65

The API reference on ReadMe is generated from an OpenAPI file, though we didn't download the file itself; the MCP tool schemas aren't published (18). llms.txt and Markdown pages on puzzle-api.readme.io (10). Endpoint descriptions name the required scope and explain defaults such as cash basis (14). Typed parameters with documented limits, such as companies capped at 100 a page (11). An error table with HTTP codes and errorContext shapes, and example requests (12). No changelog or version scheme found (0). 18 + 10 + 14 + 11 + 12 + 0 = 65.

rotki MCP server 76

The eight tools are registered with FastMCP, and every input is a typed Python parameter, so the JSON Schema served through tools/list is typed on every tool (25). No separate OpenAPI file exists for the MCP server. llms.txt is served at rotki.com/llms.txt, but it indexes the docs and does not mention the MCP tools (10). Descriptions say when to use most tools. Refresh_analytics_data says to call it first, describe_table says to use it before writing SQL, and get_event_taxonomy says to call it before any aggregate over event_type. Use-not-when is implied rather than stated (15 of 20). Inputs are typed but carry no enums or bounds. Tables is a list of free strings with the valid names in the description, max_rows has no schema bound, and time filters accept seconds or milliseconds (6 of 15). get_event_taxonomy carries worked SQLite recipes, and errors come back as structured payloads with a message and an upgrade URL (10 of 15). Versioned releases and a public changelog in docs/changelog.rst and docs/dev_changelog.rst record API changes, but not MCP tool changes (10 of 15). The MCP module is unchanged between v1.44.1 and v1.44.2, and the docs page source (rotki/docs, usage-guides/mcp.md) last changed on 12 August 2026. 25 + 10 + 15 + 6 + 10 + 10 = 76.

Puzzle API and MCP 15

No x402, MPP or L402 (0). Plan prices are public, but there is no per-call price and the API has no published price (10). "Try for free" on every plan, with trial length and card requirement not stated on the pages read (5). A person signs up and authorises in a browser, and API credentials come by email (0). 0 + 10 + 5 + 0 = 15.

rotki MCP server 10

Per the 10 October check, not re-read on 5 November (rotki's terms bar robots on or through the Service, so rotki.com pages weren't requested beyond the terms). Local software with a paid option, so the rubric scores the Premium plan. No x402, MPP or L402 (0). Plan prices are public without a login. Basic €25 a month and Advanced €45 a month, with no yearly prices shown (10 of 20, plan-only). No free tier reaches the MCP tools. Starter has no MCP access and info is the only free tool (0). A person has to take out a Premium plan and sign in to the desktop app, and no programmatic signup was found (0). 0 + 10 + 0 + 0 = 10. The free, self-hosted app with nothing to buy would score 20, 20 and 20 on the last three lines, but the MCP tools are paid, so that rule does not apply.