Silent keyring write failure + doc gaps on Windows 11

[version-910]

Environment

• OS: Windows 11
• ynab-mcp: prebuilt release binary
• Installed to: C:\Users\<user>\.local\bin\ynab-mcp.exe

Issue 1: store-token silently fails on Windows Credential Manager

Running ynab-mcp store-token interactively, pasting a valid YNAB Personal Access Token, reports success. Immediately running ynab-mcp status reports:

• Storage method: Environment Variables
• "No valid token found"

Confirmed no credential entry is written:

cmdkey /list | Select-String -Pattern "ynab" -CaseSensitive:$false

returns nothing.

Expected: store-token writes successfully, or surfaces an error explaining the failure. Actual: apparent silent failure with contradictory status output.

Issue 2: Token env var names not documented

When falling back to env vars (via --no-keyring), the README and help text (ynab-mcp --help, ynab-mcp run --help, ynab-mcp store-token --help) do not document which env var the tool reads for the token.

Binary string extraction reveals both YNAB_API_TOKEN and YNAB_ACCESS_TOKEN are compiled in. Precedence and whether both are read is unclear.

Suggested: add an "Environment Variables" section to the README with the exact variable names and precedence order.

Issue 3: No obvious read-only mode

When the MCP connects, all 16 tools including writes (create_transaction, update_transaction, set_category_budget, etc.) are exposed unconditionally. For a personal finance tool, some default safety around LLM-initiated mutations feels appropriate.

If READ_ONLY_MODE exists, it is not documented in README or help. Suggested: add an explicit read-only flag as a first-class option.

Workaround for Windows installers

MCP client config:

"ynab": {
  "command": "C:\\path\\to\\ynab-mcp.exe",
  "args": ["--no-keyring", "run"],
  "env": {
    "YNAB_API_TOKEN": "...",
    "YNAB_ACCESS_TOKEN": "..."
  }
}

Happy to provide more diagnostics if useful! Take care.