Nyuchi MCP for YNAB · Project Dashboard
Ship Board
Task tracker for getting ynab.nyuchi.com to a mergeable, launchable state — infrastructure, the OAuth proxy, and what's left before wider launch. Updated by hand alongside the code; every shipped task links to the pull request that shipped it.
16
Done
6
Action needed
0
Blocked
Infrastructure
12 of 12 shown- DonePR #5Multi-tenant modeEach caller brings their own YNAB token, resolved to a fully isolated client, cache, and delta-sync state.
- DonePR #6Per-tenant container routingEach tenant's token routes to its own container instance, not just its own process -- independent CPU, memory, and idle timer.
- DonePR #7Cross-tenant session hijack fixStateless HTTP transport, so a leaked session id can never be reused to execute requests under a different tenant's credentials.
- DonePR #7ObservabilityRequest logs and traces enabled, plus a way to confirm which deployed version is actually live.
- DonePR #8Per-caller rate limiting100 requests/60s per caller on /mcp, so one client can't burn through another's quota.
- DonePR #8Scale headroom for concurrent usersContainer capacity raised well past the OAuth app's current Restricted Mode cap.
- DonePR #10Real brand assets, wider layoutFixed a sitewide dead-CSS bug, swapped a hand-drawn recreation for Nyuchi's actual bee logo, widened the cramped 760px content column, added the mineral-strip brand accent.
- DonePR #11Config reliability: OAuth vars survive every deploy pathYNAB_OAUTH_CLIENT_ID/CLOUDFLARE_ACCOUNT_ID moved from versioned secrets (which kept silently vanishing across deploy paths) to source-controlled vars.
- DonePR #11CI validates the Worker actually deploysNew worker-deploy-dryrun job replaces the equivalent Cloudflare Workers Builds check, which always failed on this repo's worker/-nested layout.
- Action neededIssue #12Astro security upgradeworker/site is pinned to a vulnerable Astro 6.4.8; fix needs a breaking major-version bump to 7.3.1+.
- Action neededIssue #16Triage remaining Dependabot alerts40 alerts flagged on main (19 high, 16 moderate, 5 low) -- some may overlap with the Astro bump above, but not all.
- Action neededIssue #14Clean up the stale Workers Builds checkUncheck "Builds for non-production branches" in the Cloudflare dashboard now that CI covers the same thing properly.
OAuth Proxy
4 of 4 shown- DoneYNAB OAuth application registeredName, description, URLs, privacy policy, and redirect URI all set up directly with YNAB.
- DonePR #8Durable storage for tokensA dedicated store for authorization codes, refresh tokens, and registered clients -- the container's own disk is wiped on every idle-sleep, so this can't live there.
- DonePR #9OAuth proxy serverSign in with YNAB directly, no personal access token to copy and paste. Confirmed live: /.well-known/oauth-authorization-server resolves correctly in production.
- Action neededIssue #15End-to-end test with a real YNAB loginThe pieces (discovery, registration, authorize redirect) all check out programmatically, but nobody has walked the full sign-in flow through a real browser yet.
Launch
6 of 6 shown- DonePR #7Privacy policyPublished, with a working data-deletion contact.
- DonePR #8Public project dashboardThis page.
- DonePR #11Status monitorOpen-source, Upptime-style /status page -- a scheduled GitHub Actions job checks the Worker, tools, YNAB API, and auth every 10 minutes.
- DonePR #11Support portalIntercom Messenger widget plus a published Help Center collection (6 articles) at support.nyuchi.com.
- Action neededIssue #13Support portal polishArticle ordering within the collection, and the table-of-contents/Copy-for-LLM Help Center display settings -- dashboard-only, not a code change.
- Action neededIssue #17Launch planWider announcement now that OAuth, the support portal, and the status monitor are all live -- messaging, timing, and where to announce.