Last updated: May 12, 2026
Extrack exposes a remote Model Context Protocol (MCP) server over HTTPS with OAuth 2.0 (Amazon Cognito). Assistants such as Claude fetch your workspace context in one bundled call (accounts, people, categories, and recent pending drafts) and then create, read, or delete transaction drafts before you post them in the web app.
There is no separate desktop “MCP binary” to install; the connector is a hosted endpoint you attach in your assistant's connector settings.
…/api on your MCP host (Streamable HTTP — not the REST API). …/mcp is also supported. Use the exact URL your operator provides.https://claude.ai/api/mcp/auth_callback, https://claude.com/api/mcp/auth_callback; ChatGPT and others: the URL shown in that product's connector settings). Same requirement for Managed Login and classic Hosted UI.| Tool | Purpose |
|---|---|
| extrack_get_context | Single bundled read — returns the workspace's open accounts, people directory, categories, and the most recent pending transaction drafts (up to 20). Call this once at the start of the conversation so the assistant can pass real ids to every create tool instead of fanning out per-resource list calls. |
| extrack_create_transaction_draft | Create a generic draft — expense, income, or transfer — using real account ids from the context bundle, separate expense & income amounts, date, an optional category name, an external reference, and draft-level split IOUs (with real person ids). |
| extrack_create_split_expense_draft | One-shot Splitwise-style split: total expense + paid-from account + per-person allocations. The web app ensures each person's Lent receivable when you post. |
| extrack_create_lend_money_draft | “I lent money to X” — a 100% IOU draft to one person from your chosen account. |
| extrack_create_repayment_draft | “X paid me back” — a transfer draft from the person's Lent receivable to your cash account. |
| extrack_get_transaction_draft | Fetch one draft by id. |
| extrack_delete_transaction_draft | Delete a draft without posting to the ledger. |
Posting real transactions: Drafts are stored as plaintext on the server for staging. Open the Extrack web app (Automation inbox or the transaction flow with a draft id) to complete posting. The app removes the draft after a successful create. Lending, split, and repayment drafts carry split intents rather than real receivable ids — the web client resolves or creates the right per-person Lent account before writing the transaction.
The Extrack MCP server sends a short set of agent rules with the MCP instructions so compliant clients (Claude, Cursor, ChatGPT) apply them without extra prompting.
extrack_get_context once at the start of the conversation, then reuse its accounts / persons / categories / recentDrafts arrays for the rest of the turn. The assistant should not re-list before every create — one bundled GET avoids the extra round-trips that used to make tool calls slow.extrack_create_* tool expects real accountId / debitAccountId / creditAccountId / personId values copied verbatim from the context bundle. The assistant must never guess or invent UUIDs.recentDrafts is part of the context bundle. If a new request clearly matches an existing pending draft (same title, amount, and day), the assistant flags the conflict before creating. This is not server-enforced — the server no longer blocks a create on a suspected duplicate, so there is no separate confirmDuplicate step./oauth2/token), not the Extrack MCP Lambda. Until that succeeds, Cursor never sends Authorization: Bearer, so API logs may show missing_bearer — that is expected until the exchange works. In the browser devtools Network tab, find the failed token request and read Cognito's JSON error (e.g. invalid_grant, invalid_client). Common fixes: add cursor://anysphere.cursor-mcp/oauth/callback to the same Cognito app client allowed callback URLs as the web client id; use Logout in MCP settings and reconnect in a single flow; avoid duplicate or stale callbacks ("Ignoring OAuth callback" in the log).invalid_grant): Amazon Cognito does not support RFC 8707 resource indicators, so the token exchange fails whenever the preceding /oauth2/authorize carried a resource= parameter — and MCP clients add that parameter automatically. The Extrack remote MCP works around this by publishing itself as the OAuth Authorization Server: it serves /.well-known/oauth-authorization-server and proxies /oauth2/authorize + /oauth2/token to Cognito with resource stripped. If a connector still fails, confirm the metadata document at /.well-known/oauth-protected-resource/api (or …/mcp if that is your connector path) advertises this MCP origin (not the Cognito issuer) under authorization_servers. If the browser still opens Cognito’s hosted UI with resource= on the authorize URL, remove the connector and add it again using a different path (e.g. switch from /mcp to /api) so Claude refetches OAuth metadata.