Orla
finance.orlaPublished by orla.financeOfficial publisherv0.3.0Updated Oct 27, 2026
Personal, family and business books over fiat and crypto. Reads and records; it cannot pay.
Overview
Orla connects an assistant to personal, family or business books over fiat and crypto, letting it read spaces, accounts and transactions and record new entries.
- What you can do
- List the spaces and accounts a connection can reach and pick a default space
- List and search transactions with date, account and text filters
- Record a transaction with account, kind, amount, date, payee and note
- Export the same rows as CSV
- Report which tools the connection was given and which spaces it reaches
- Bridge stdio-only MCP clients to the remote HTTP endpoint
- When to use it
- Useful when you want an assistant to review spending, categorize or close out a month, check balances in a shared space, or record expenses from your own account of a trip, without giving it the ability to pay.
- Requirements
- Either a remote Streamable HTTP endpoint with OAuth sign-in through a browser consent page, or the npm package orla-cli run with npx, which needs Node 22 or newer. A session is stored in the OS keychain, or in a 0600 file when no keychain exists. No environment variables are required.
Installation
In SourceWeft
- Open Orla in the dashboard and add it to a workspace.
- Connect the required credentials. They are stored privately and never shown on public pages.
- Enable the server for the chats that should use its tools.
Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.
Use with an agent
Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.
Read https://sourceweft.com/mcp/finance.orla%2Forla/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.Other MCP clients
Add this to your client's mcpServers config. The client completes OAuth sign-in on first connect.
{
"mcpServers": {
"orla": {
"type": "http",
"url": "https://app.orla.finance/api/mcp/personal"
}
}
}README
orla
Your Orla books from a terminal, and a stdio bridge for MCP clients that cannot speak HTTP.
No dependencies, no build step, no native module to compile. Node 22 or newer.
The package is orla-cli and the command it installs is orla. They differ
because npm refused the bare name as too close to packages that already exist
(ora, ol, rlp, url), and renaming the command would have been the worse
half of that trade: npm i -g orla-cli still gives you orla tx list.
What it is
A thin client over the same MCP endpoint Claude connects to. Every command is a
tool call, so the CLI cannot do anything a personal connection cannot do, and
nothing here has its own idea of authorization. orla login walks the ordinary
OAuth code flow with S256 PKCE: the browser lands on Orla's own consent page,
where you tick the spaces this machine may reach.
It does not move money. A personal connection reads and records. Payments, transfers and card details belong to an agent connected for that purpose, with its own limits, set in the app under Agents. The tools that move money are not in the list this connection is given, and are refused at the endpoint if asked for by name.
That is not a matter of trust in this client: orla login asks for the personal
address, where those tools do not exist, so the promise survives whatever gets
ticked on the consent page. orla login --agent asks for the other address, the
one where a bot with its own budget can be minted. A session remembers which
door issued its tokens and keeps using it, so an existing connection is not
re-pointed by an update.
Commands
--space <id> on anything space-scoped, --json for machine-readable output.
For a program, or an agent
With --json, every command answers with one envelope on stdout:
Read ok, then branch on error.code. Codes that begin cli. are the CLI's
own; any other code is Orla's, passed through unchanged, the same name the
REST API and the MCP endpoint use. The exit status says which kind of failure
it was, so a shell script can branch without parsing anything:
The skill that teaches an agent all of this, including where paying stops, is
skills/orla/SKILL.md. It ships in the package and at
orla.finance/skill.md, and it is one of the
five skills the Claude Code plugin below installs. Into any other agent:
For Claude Desktop there is a bundle, orla-<version>.mcpb, attached to
each release: double-click it to install. It runs the stdio bridge below, and
the bridge signs in by itself.
Environment variables the CLI reads:
As an MCP server
Orla's MCP server is remote and speaks Streamable HTTP, and it answers at two addresses:
A client that supports remote MCP needs nothing from this package. Point it at an address and it will find the consent page by itself. Claude Code, for example:
The difference is not a label. At /mcp/personal every tool that moves money is
withheld from the list and refused if a model asks for one by name, so the
promise holds whatever the consent page was told. At /mcp the page offers both
shapes, and picking "connect an agent" mints a machine principal with a budget
of its own. Use the personal address unless you are deliberately connecting a
bot.
Clients that only support stdio servers can run this CLI as one. It relays JSON-RPC to the HTTP endpoint and holds the token, so the client needs no OAuth support of its own:
The bridge uses the session orla login stored, refreshes it, and posts to the
door that session was minted at. With no session it signs in by itself, since a client that spawned it has no terminal
to type into: it opens the browser on the consent page, stays a well-formed
server meanwhile (initialize and ping answered, tools/list empty, a tool
call refused with cli.sign_in_in_progress), and tells the client
tools/list_changed when the person is done.
The server is listed in the official MCP registry as finance.orla/orla,
which is the name a client or a directory should resolve it by. The entry
carries both doors: the remote endpoint above and this package for stdio.
Setup for individual clients is written up at
orla.finance/en/mcp. That is the personal
connection, which reads your books and cannot pay. /en/ai-agents is a
different door, where an agent gets a budget and a card of its own.
As a Claude Code plugin
This repository is also a plugin marketplace. Installing it brings five skills, four for keeping the books and one for the CLI itself, and the personal MCP connection they run on:
The first tool call opens the ordinary consent page in a browser, where you pick
the spaces this machine may reach. /mcp shows the connection and starts that
flow by hand.
The plugin points at https://app.orla.finance/api/mcp/personal, which is the
door that holds no tool that moves money. The skills say so, and the address is
what makes it true rather than a promise: payments, transfers and card details
are withheld there and refused if asked for by name.
Two things the skills lean on, worth knowing before you read them. A connection approved without "show full details" receives payees and addresses masked, which limits how much of a bank import can be categorized from four characters. And the tool list stops at 200 rows per call, with the true count beside it, so a busy month is read month by month rather than in one gulp.
contracts/mcp-personal-tools.json is the committed shape of that door, and
test/skills.test.js checks every tool and argument the skills name against it.
Where the token lives
The OS keychain: security on macOS, secret-tool on Linux. Where neither
exists it falls back to a 0600 file under your config directory and says so
on stderr, because a refresh token quietly landing on disk is not something to
discover later.
orla logout clears both.
Development
The server this talks to is not in this repository. --api points the CLI at a
different deployment, and the session records which one minted it, so a token
from one environment is never replayed against another.
Contributions are welcome. See CONTRIBUTING.md.
Evals
test/skills.test.js checks that the skill agrees with the CLI. It cannot check
the thing the skill exists for: whether an agent reading it stops guessing. That
is what evals/ is for. Each case runs twice, once with this plugin and once
without it, so the difference is what the skill itself changed.
The MCP server stays down while they run: under the default --mocks record a
server with no mock is not started, so the cases need no live door, no OAuth and
no account.
What the last run measured
2026-09-18, plugin 0.2.1, Claude Code 2.1.270, three runs per case in each arm, model not pinned (the CLI's default, and the default judge). Whole suite: 294 seconds, $1.53.
Read it honestly. The skill earns most of its keep on the command surface:
without it the model got orla use wrong in three runs out of three, because
guessing a CLI's argument shape is exactly what it cannot do. On the money
questions the base model is already careful most of the time, and the skill
turns "most of the time" into every run, which is the part that matters when
the answer is whether somebody was paid.
Worth knowing about the baseline arm: without the skill the model usually did
not invent a command, it declined and asked to see --help first. That is the
better failure, and it is still a failure for an agent expected to act.
These numbers are one run on one day, not a benchmark. Re-run the command above and you will get your own.
License
MIT. See LICENSE.
Source: README.md at commit f3de724
Tools
0Version history
2- v0.3.0LatestSep 19, 2026
- v0.1.2Sep 16, 2026
Score
85% of the applicable checks met
How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.
- Reached in the last 30 daysRequired25 pts
- Auth declaredRequired10 pts
- Tools listed15 pts
Answer tools/list without a credential, or ship a package that starts in a sandbox without one.
- DescriptionRequired15 pts
- Logo10 pts
- Documentation15 pts
- License10 pts