Finance MCP and deployment cleanup (v2.5)

[31b4]

Summary

• add the read-only Finance MCP Worker with Cloudflare Access authentication
• integrate optional MCP deployment into the root deployment flow and reuse existing MCP configuration
• remove the retired public API-key endpoint and deployed secret
• release Finance Manager 2.5

Validation

• npm run test -w api
• npm run test:mcp
• npm run build

[Copilot]

Pull request overview

This PR adds a new read-only Finance MCP Cloudflare Worker protected by Cloudflare Access, integrates optional MCP deployment into the existing root deployment flow, removes the retired public API-key-based endpoint/secret, and bumps the app release to 2.5.

Changes:

• Introduce mcp/ workspace implementing a JSON-RPC MCP server with schema-described read-only finance tools, Access JWT verification, and a tested read-only finance query/service layer.
• Update root deployment to optionally deploy MCP and persist that preference/config in .deploy-config, while removing the retired PUBLIC_API_KEY secret and /public/* endpoint.
• Bump application version to 2.5 and update documentation accordingly.

Reviewed changes

Copilot reviewed 24 out of 26 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
README.md	Updates deploy instructions and consolidates version display to 2.5; adds MCP deploy guidance.
package.json	Bumps version to 2.5; adds mcp workspace + MCP build/test/deploy scripts.
package-lock.json	Updates lockfile for version + new mcp workspace linking.
mcp/wrangler.toml.example	Example Wrangler config for MCP Worker with D1 + Access vars.
mcp/tsconfig.json	TypeScript config for the MCP Worker workspace.
mcp/src/validation.ts	Adds shared validation helpers (dates, ranges, cursors, enums, limits).
mcp/src/validation.test.ts	Unit tests for validation helpers.
mcp/src/types.ts	Defines MCP Worker env bindings and DB row types used by the service.
mcp/src/tools.ts	Declares MCP tool schemas and tool dispatch with input validation.
mcp/src/protocol.test.ts	Protocol-surface tests for Access enforcement, schema listing, and error handling.
mcp/src/index.ts	Implements MCP JSON-RPC handler, routing, auth gating, and diagnostics logging.
mcp/src/finance-service.ts	Implements the read-only finance query surface (dimensions, aggregates, trends, budgets, portfolio, etc.).
mcp/src/finance-service.test.ts	Tests the FinanceService semantics (exclusions, transfers, pagination, forecasts, conversion warnings).
mcp/src/date-series.ts	Date-series and recurring-schedule expansion helpers with bounds.
mcp/src/date-series.test.ts	Unit tests for date-series and recurring schedule expansion behavior.
mcp/src/access-auth.ts	Cloudflare Access JWT verification with signing key retrieval + caching.
mcp/src/access-auth.test.ts	Unit tests for Access config normalization and missing assertion behavior.
mcp/README.md	MCP architecture, security model, tool catalog, deploy/connect instructions.
mcp/package.json	MCP workspace scripts/deps for Wrangler + TS + Vitest.
deploy.sh	Adds optional MCP deployment and .deploy-config persistence; removes public API key secret handling.
api/wrangler.toml.example	Removes PUBLIC_API_KEY example configuration.
api/src/types/environment.types.ts	Removes PUBLIC_API_KEY binding from API environment types.
api/src/repositories/transaction.repository.ts	Removes repository method used only by the retired public endpoint.
api/src/index.ts	Removes /public/recent-expenses endpoint and related feature flag logic.
.gitignore	Ignores MCP Wrangler/dev vars; keeps .deploy-config ignored.
.deploy-config.example	Adds example persisted deploy config including MCP-related keys.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.