Intuit Credit Karma

What the Intuit Credit Karma connector does

The Intuit Credit Karma MCP server lets Claude read the factors behind your credit score — payment history, utilization, credit age, credit mix, inquiries and total accounts — so an agent can explain what is moving the number. Anthropic lists one tool. Reading is a soft pull and cannot lower your score, and nothing here applies for credit.

Intuit Credit Karma tools (1)

• get_credit_factors

Tool names from Anthropic's directory listing. This server requires sign-in, so we could not read tool descriptions or parameter schemas.

Limits

• Credit Karma publishes no tool names, so the one listed name is unverifiable by comparison. The match between get_credit_factors and "Understand your Credit Health" is semantic, not literal. A rename — or a widening of scope from factors to full report data — would not be detectable from any public source.
• The directory lists one capability where Credit Karma documents three. The two omitted are marked ChatGPT Only, so the directory is arguably correct *for Claude* while being an incomplete picture of the server. One of the omitted two is the commercial offer surface.
• The tool's output fields are undocumented. No source states whether tradelines, balances, account histories or individual inquiry records are returned alongside the six factors. We report this as unestablished, not as a bounded read.
• The auth posture is unverifiable from outside, and the edge is a blanket redirect. Every request we made to anthropic.mcp.creditkarma.com — anonymous POST initialize, plain GET, browser-user-agent GET, the host root, a deliberately bogus path, and four .well-known paths — returned an identical zero-byte HTTP 302 from AkamaiGHost to a static error page, with no www-authenticate header. Because a nonexistent path answers exactly as the real endpoint does, none of those responses says anything about the origin. authMode comes from Credit Karma's documented phone-code flow, and authVerified is false.
• No OAuth scopes could be read, so no scope-level boundary can be shown to exist. No RFC 9728 descriptor and no authorization-server metadata was served. On a one-tool read surface the missing boundary matters less than usual — but it also means the scope-versus-tool-name diff, the check that exposes hidden write surfaces elsewhere, could not be run.
• No tool schemas or safety annotations are published here. With no handshake there is no parameter detail, so a parameter-level capability cannot be positively ruled out.
• The data is as of your last Credit Karma login, not live. Credit Karma documents this and the workaround is manual: log into Credit Karma, then return to the agent.
• Credit Karma publishes no accuracy disclaimer for LLM output. Its article warns about stale data but says nothing about the reliability of model-generated financial advice built on it, unlike the sibling TurboTax connector, which disclaims its estimates as reference only.
• Nothing is documented about what Anthropic receives, retains or trains on. The connector article has no privacy link and does not describe what the consent step covers. Intuit's Global Privacy Statement names generative AI providers among its service providers, which is the closest published statement.
• No disconnect procedure is documented. Credit Karma's article covers connection only.
• Region is never stated, though the evidence points to US-only. Every supporting help article is US-suffixed and the footnotes cite the CFPB, but Credit Karma publishes no availability statement, and it operates in the UK and Canada too.
• The connect flow doubles as account signup. A user with no Credit Karma account creates one inside the connector installation, accepting Credit Karma's terms in a chat-adjacent flow rather than on its website.
• www.creditkarma.com serves an identical error shell to non-browser clients for every path, including its own robots.txt-declared sitemap, so no page on the marketing host could be read and none is cited here. All Credit Karma prose on this page comes from the support host.

Frequently asked questions

Sources

• Credit Karma help article, "Intuit Credit Karma on Claude and ChatGPT" (retrieved 2026-08-23). The page itself is a Salesforce Community shell that renders no article text to a non-browser client. The body was read as JSON from the same host's unauthenticated Knowledge REST route, /services/data/v58.0/support/knowledgeArticles/Intuit-Credit-Karma-on-Claude-and-ChatGPT with an Accept-Language: en-US header, which reports article 000003654, version 2, last published 2026-03-24. · retrieved 2026-08-23
• Credit Karma help article, "Why Do I See Multiple Credit Inquiries from Credit Karma?" (retrieved 2026-08-23). Source for the soft-pull characterisation and for background pulls occurring without a login. · retrieved 2026-08-23
• Credit Karma help article, "Will applying for a financial product lower my credit scores?" (retrieved 2026-08-23). Source for browsing versus applying and the hard-inquiry consequence. · retrieved 2026-08-23
• Credit Karma help article, "Which key factors impact my credit scores?" (retrieved 2026-08-23). Source for the six factors, for TransUnion and Equifax coverage, and for soft inquiries not being shown. · retrieved 2026-08-23
• Credit Karma help article, "What are Credit Karma's Approval Odds?" (retrieved 2026-08-23). Source for Approval Odds being lender-criteria ranked and not a pre-approval. · retrieved 2026-08-23
• Intuit Global Privacy Statement (retrieved 2026-08-23). Source for bureau partners supplying Social Security number and employment or income data, for cross-product combination including Credit Karma recommendations, and for generative AI providers as service providers. · retrieved 2026-08-23
• support.creditkarma.com/robots.txt — checked 2026-08-23. Stock Salesforce Communities file: User-agent: *, Allow: /, with only a forgot-password path disallowed. No Content-Signal directive is present. · retrieved 2026-08-23
• Live auth posture check, 2026-08-23: anonymous POST initialize, plain GET, browser-user-agent GET, host root, a deliberately nonexistent path, and four .well-known paths (oauth-protected-resource, oauth-protected-resource/mcp, oauth-authorization-server, openid-configuration) each returned a zero-byte HTTP 302 from AkamaiGHost to Error_Credit_Karma.htm, all with byte-identical empty bodies and no www-authenticate header. DNS resolves the host through wildcard.mcp.creditkarma.com.edgekey.net. Because a bogus path is answered identically to the real endpoint, the origin's posture was never observed; authVerified is false. · retrieved 2026-08-23
• Four-route documentation probe, 2026-08-23: the nominated article, llms.txt and llms-full.txt on both support.creditkarma.com and www.creditkarma.com, and the .md suffix. No llms.txt exists on either host; the nominated URL won only via the Knowledge REST route described above. · retrieved 2026-08-23
• Anthropic Connectors Directory entry — , read from our directory snapshot dated 2026-08-16. Source for the tool name get_credit_factors, the partner tier, and has_mcp_app: true. · retrieved 2026-08-16
• Credit Karma app support — <mailto:AppSupport@creditkarma.com> · Privacy