Oricalo for AI assistants and developers

Let Claude, ChatGPT or your own scripts read and update your budget - safely, and only with your permission.

Connect your AI assistant

Oricalo runs an MCP server - the open standard AI assistants use to work with other apps. Connecting takes a minute and never involves your password.

1. Copy the connector address:

   https://oricalo.com/server/mcp

2. Claude: Settings → Connectors → Add custom connector, and paste the address. ChatGPT: add a custom connector (developer mode) with the same address. Any other MCP client: add a remote server (Streamable HTTP) with this URL.
3. Sign in to Oricalo when asked and approve the connection. You choose whether the assistant may make changes or only read.

MCP client config:

{
  "mcpServers": {
    "oricalo": { "url": "https://oricalo.com/server/mcp" }
  }
}

Then just ask

• “How much did I spend on groceries this month?”
• “Log €12.40 for lunch at Mario's today.”
• “Am I over budget anywhere this month?”
• “Move €50 into my holiday pot.”
• “I owe my dad €5.”
• “I paid the electricity bill.”

What an assistant can do

In Claude, Oricalo also offers ready-made prompts: Monthly review, Find savings and Am I on track this month?

ChatGPT's deep research can read Oricalo too, through the standard search and fetch tools.

Safe by design

• You approve every app. Nothing connects until you sign in and allow it.
• Read-only is one click. Untick “Allow changes” and the assistant can only look.
• Your account stays yours. Apps and keys can never see your password or change your email, plan, billing or security settings.
• Every change can be undone. Settings → AI & API lists what each app or key changed, and undoes one change or everything it did today. Deleted entries also stay in Recently deleted for 30 days.
• You can see who did what. Entries an assistant adds are marked with its name.
• Disconnect any time in Settings → AI & API - access ends immediately.

REST API with personal keys

For your own scripts and tools: create a key in Settings → AI & API - read-only or read & write, with an expiry date - and call the API with it.

Base URL: https://oricalo.com/server

Send the key in the Authorization header:

Authorization: Bearer ocl_your_key

Read a month's summary:

curl "https://oricalo.com/server/api/summary/month?year=2026&month=10" \
  -H "Authorization: Bearer ocl_your_key"

Add an expense (type 0 = expense, 1 = income):

curl -X POST "https://oricalo.com/server/api/transactions" \
  -H "Authorization: Bearer ocl_your_key" \
  -H "Content-Type: application/json" \
  -d '{"date":"2026-10-22","amount":12.40,"type":0,"categoryId":7,"accountId":1,"description":"Lunch"}'

OpenAPI specification · Interactive API reference

Good to know

• A read-only key can only make GET requests.
• Up to 300 requests per minute per user.
• Send an X-Idempotency-Key header on writes to make retries safe.
• Errors come back as JSON: {"message": "…"}.
• Keys reach your budget data only - never sign-in, billing or account settings.

OAuth details for developers

Building an MCP client or integration? The authorization server follows the MCP authorization spec:

• Protected resource metadata (RFC 9728) and authorization server metadata (RFC 8414)
• Open dynamic client registration (RFC 7591)
• Authorization code flow with PKCE (S256 only), refresh-token rotation, revocation (RFC 7009)
• Scopes: read and write. Access tokens last an hour, refresh tokens 90 days.

https://oricalo.com/server/.well-known/oauth-protected-resource/mcp
https://oricalo.com/server/.well-known/oauth-authorization-server

Questions

Does the assistant get my password?

No. You sign in on Oricalo's own page and approve the connection; the assistant receives a token that can only reach your budget data, and you can revoke it at any time.

Can an assistant delete my data?

Only if you allowed changes, and only entries - which go to Recently deleted for 30 days, so they can be restored. It can't delete your account or change your settings.

Which assistants work with Oricalo?

Any assistant or tool that supports remote MCP servers with OAuth sign-in, such as Claude and ChatGPT. Developers can also use the REST API directly with a personal key.

Which plan do I need?

Plus. Connecting an assistant and creating API keys are part of the Plus plan, and its free trial includes them, so you can try it first. If you move to the free plan, your keys and connected apps are paused (not deleted) and start working again when you upgrade.

Where does my data go when an assistant reads it?

The data the assistant fetches is sent to that assistant's provider and handled under their terms. Our Privacy Policy explains this in detail. →