Ask Bunter · Manual

What Ask Bunter is

One board for the things you would otherwise check in five apps every morning: mail, calendar, bank balances and spending, the news you follow, your own sites and servers, portfolios, health. Everything is pulled into one place on your own server, read-only, and an assistant sits on top of it: ask it anything about your data, ask it to rearrange the board, or ask it to connect a new source.

Two rules run through all of it. Nothing here can move money, send mail, or change anything in the services it reads. And nothing leaves your server except the questions you ask the assistant, which go to the model provider metered by the cent.

The board

How it's laid out

Colour-coded sections, each holding cards. Out of the box: Today (briefing, weather, what's coming up, alerts), Health (sleep, recovery, activity from your watch, strap and phone), News, Funds & spending, Portfolio & markets, Sites & servers, Code (your repositories by last push, the latest commits), Inbox, Files. You can add your own sections and move any card anywhere by asking the assistant (see below); each person's arrangement is their own. Everything that is maintenance rather than information — connected sources and their sync state, accounts, plugins, phone shortcuts, assistant usage — lives in the ☰ setup drawer in the header. A red count on that button means something needs your action, and the drawer lists those first.

The home page: your own template

The first page is a template you arrange, the way widgets sit on a phone's home screen. Every block is one thing the board knows — the briefing, needs attention (alerts), any whole section, or any single card — at one of three sizes: ▪ small is a tile with one number that opens the thing, ▬ medium is a summary (the briefing's lines, the key numbers, a few pictures), ■ large is the whole thing with every card. So "all my health on the home page" is the Health section at large; "just my steps" is the WHOOP or Garmin card at small.

• ✎ edit home opens a side panel listing everything you can add: the sections (the briefing and the alerts first, then every section with its colour) and the cards, listed under their section. Each row has one button: add when it is not on the page, remove when it is. A card always sits under its section: add shows it inside that section's block (bringing the section onto the page in full, with just that card, if it is not showing cards yet), remove hides it there. Drag a section onto the page to put it where you want. On the page every block has a bar: its number (its place on the page), ▲ ▼ to move it up or down, ▪ ▬ ■ for its size, ✕ to take it off — or drag the block itself (with a finger, by ⠿). Changes save as you go; done closes the panel, reset puts the template back.
• Hold a block (or right-click it) any time for the same menu: small, medium, large, remove, edit.
• The chevron on a medium or large block folds it to its title; the browser remembers, per block.
• A card shows once: if it is inside a large section block, a block of its own further down waits until you take it out of the section (or shows a note while editing).
• The default template is the briefing, the alerts, Today in full, then a summary of every other section, News first. The assistant can arrange it too — "show my health in full on the home page", "take Files off my home page".

Reading it

• Click a section's title bar or a card's title to collapse it; the board remembers. Cards show a few items and a show more.
• The eye next to Funds & spending blurs every amount in that section until you open it.
• Cards fed by several accounts (mail, calendar, files) have pills at the top to look at one account at a time.
• Every card has an ask button that opens the assistant with a question about that card.
• The board refreshes itself every minute while open. Sources sync every 15 minutes, some less often (see each connection below).

The assistant

The Ask button opens a chat that can search everything the board holds, add up spending, explain a figure using each service's notes, read the code of your own projects if you connected a repository, and act on the board. It answers with formatted text, tables included. Each question costs about a cent (see Costs).

Good things to ask

• "What did I spend on groceries this month?" — "Which subscriptions renew this week?"
• "Why did my site's match rate drop?" — it reads the service's notes and, if the repository is connected, the code.
• "Summarise today's news for me in five lines." — "What is the board alerting about?"
• "Make a section called My shop and move the orders and the revenue tiles into it."
• "Discover my Notion plugin and show my open tasks on the board." (see Any other API)

Arranging the board

Ask for sections to be created, renamed, hidden, reordered or removed, and for cards to be moved between them. The assistant sees every card by name. The change appears on the next refresh, about a minute, or press ↻. "Put things back" removes a custom section and returns its cards to their usual places. The home page is the assistant's to arrange as well: "put the WHOOP card on my home page, small", "show Health in full at the top", "take Files off the home page", "reset my home page".

Reminders

"Remind me on the 3rd to renew the domain" sets a reminder that shows in Today once it is within a month, and the briefing mentions it as it approaches. No calendar permission is involved.

Google accounts read-only

Mail, calendar and files come from Google with read-only permissions; the sign-in screen lists exactly those. Open the setup drawer, Connected accounts, sign in with Google: pick the address, consent, and you land back on the board. The last 90 days of mail, the calendar and the files are pulled right away; from then on every 15 minutes.

Up to three accounts. Each extra one appears as its own sources and gets its own pill on the mail, calendar and files cards. A sign in again button appears on an account only when Google has revoked its access; renewing at any other time is just adding the same address again. Remove forgets an account and deletes what was synced from it.

While the Google app behind the board is in testing mode (before Google's verification), an address must first be listed as a test user in the Google Cloud console.

Each person's Google accounts are their own: what you connect shows up on your board only, and nobody else on the server can see or use it. On a hosted server the Google app needs a Web application sign-in client that lists the board's return address (https://your-board/api/google/callback); if it is still the desktop kind, sign in with Google says so in plain words instead of failing at Google.

Bank accounts read-only

Banks in the EU and UK are read through Open Banking: the PSD2 rules that oblige them to share your own account data, read-only, with a licensed third party you approve. Ask Bunter uses Enable Banking as that third party; it covers about 2,700 banks, including app-only ones such as Revolut, and is free for the accounts you link yourself. Nothing can move money through this channel.

Two things to know before starting: you will approve in the bank's app twice (once to whitelist your accounts with the provider, once to open the board's own data session), and the bank sends you back to an https address; on a computer running the board locally that is a self-signed page, so the browser shows a certificate warning once.

Setup, step by step

1. Provider account: create one at enablebanking.com (email; no company needed).
2. Application: in its control panel add a new application in Production, let the browser generate the key, and enter the redirect address the plugin sheet shows you. The form requires a description, an email and privacy/terms URLs; the board's manual address works for the URLs.
3. Key file: the browser saves a .pem named after the Application ID. It is the only copy. Don't double-click it (that opens the keychain); copy its text with a text editor or, in Terminal, cat ~/Downloads/<id>.pem | pbcopy.
4. First approval: on the application's page, Activate by linking accounts (later Link accounts), continue, choose the bank, approve in its app. This whitelists the accounts; no data reaches the board yet.
5. Plugin: setup drawer → + plugin → Bank account (Open Banking): paste the key text and the Application ID (first bank only — later banks reuse them), pick the country and the bank from the list, save.
6. Second approval: the Sources card shows the bank with needs your approval → approve access. Approve in the bank's app again; you land on the board with the first pull done: 90 days of transactions and today's balances.

What you get, and renewal

One balance tile per account and currency under Funds & spending, and every transaction in the Spending panel with merchant, amount, category (rules first, then the assistant) and the bank it came from. Pending card payments appear immediately and are replaced by the booked version. Pulls run every 8 hours because banks cap background reads. Consent lasts up to 90 days: a reminder appears three days before, and the Sources card offers a new approve link; only the last step is repeated. Each bank is its own plugin, row and renewal.

Health: WHOOP and Garmin live

The Health section holds one card per wearable, next to the Health log, which is your phone's Health app alone (the shortcut); a wearable's workouts reach search and the briefing, not that card. Each card shows the figures you chose as tiles (latest value, the change against the day before, a sparkline), and below them a 30-day trend of any of those figures: the daily line with its 7-day average, a crosshair that reads both, and for sleep the night's stages stacked. table shows the same numbers as text. + KPIs on the card lists everything the provider can give, grouped (recovery, sleep, activity, heart, body); tick what you want and Save. Everything is pulled regardless, so the assistant can answer about any of it ("how did my HRV compare to last month?").

WHOOP

1. WHOOP has no personal key: you register a small app of your own. Sign in at developer.whoop.com with your WHOOP account, create an app named Ask Bunter, set the redirect URL the plugin sheet shows (your server's address followed by /api/oauth/whoop/callback), tick every read scope and offline.
2. setup → + plugin → WHOOP: paste the Client Secret as the key and the Client ID in its field, Save. The sheet then shows approve access at WHOOP (the Sources card too): open it, sign in, approve. You land back on the board with 30 days of recovery, strain, sleep and workouts.
3. Pulls run hourly and re-read the last week. If WHOOP drops the connection, the Sources row shows approve access again — only that step is repeated.

Garmin

1. Garmin's API is for companies, so the board signs in to Garmin Connect the way the phone app does. setup → + plugin → Garmin: your Garmin Connect email, your password as the key, Save. After the first sign-in a session token replaces the password for every later pull (valid about a year).
2. Two-step verification on the account? Garmin sends you a code at the first sign-in and the board asks for it — in the plugin sheet right after you save, and on the Sources card in the ☰ setup drawer. Type it, press confirm, and you are connected. A code lasts a few minutes; send a new code asks Garmin for another.
3. The first pull reads the last three weeks a day at a time (a couple of minutes); later pulls run hourly. If the row says the session expired, paste the password again (with two-step verification the card asks for a new code).

iPhone automations live

Some data only exists on the phone: text messages, notifications, the Health app. Ask Bunter reaches it with Apple Shortcuts: a signed shortcut you install once, then a Shortcuts automation you create that runs it (Apple does not let automations be shared, so that step is always yours). The shortcut posts to your server with an access token; the board's iPhone shortcuts card in the setup drawer lists the ones available, with install links and the automation each needs.

Installing a shortcut

1. On the phone, open the board (same Wi-Fi or hotspot as the server, or anywhere once the server has a public address) → setup → iPhone shortcuts → install.
2. Shortcuts asks two questions at import: the server address and your access token (setup drawer → Account → Access token for devices). Nothing personal is baked into the file.
3. Create the automation: Shortcuts app → Automation → + → the trigger the card names (a message containing certain words, a time of day) → Run Shortcut → the one you installed → Run Immediately, notifications off.

Examples

• Bank alerts by SMS — for banks without an API. Trigger: a message containing the alert wording your bank uses. Each alert becomes a transaction on the Spending panel within a second.
• Health — steps and distance, posted hourly by a time-of-day automation; a watch variant adds heart rate and sleep. Health data older than 36 hours raises an alert on the board, since the phone only reaches a local server on the same network.
• Wallet — Apple Pay receipts from their notification.
• Your own — ask the assistant to build a shortcut for anything Shortcuts can read ("post my screen time every evening"); it builds and signs the file and puts it on the same card.

Things to know

• The automation needs the phone unlocked at least occasionally; iOS runs time-of-day automations on its own, message automations when the message arrives.
• Health's Find samples errors on empty results; the shortcuts are built to swallow that.
• The same alert or sample arriving twice is stored once.

Ready-made connections live

Some services are pre-wired: you paste a key (or nothing, for keyless ones) and the board already knows what to pull, how often, which tiles to show, what each figure means and what to alert on. Open setup → + plugin and pick one; the sheet shows the exact steps to get a key with the least permission, and the form is prefilled. Tiles appear within a minute; move them anywhere by asking the assistant. They are a head start, not a requirement: the assistant builds the same thing for any API you give it (see Any other API).

• Servers & sites: Hetzner Cloud (CPU, network, disk, status), Cloudflare (traffic by day), Google Search Console (clicks, impressions, position, top queries; through your Google sign-in), Webshare (proxy pool health, bandwidth allowance).
• Code: GitHub (every repository by last push with open pull requests and issues, the commits of the last two weeks, weekly totals as tiles).
• Daily life: Weather (any places, no key), News (feeds and topics, no key), Stocks and Crypto (tickers and coins, no key).
• Collections: Collectr (card portfolio value with history, items with pictures).
• Money: Bank account (Open Banking), described above.
• Health: WHOOP (recovery, strain, sleep, workouts) and Garmin (steps, sleep, HRV, stress, Body Battery, readiness, workouts), described above.
• Your own dashboards: a site of yours that exposes a JSON health endpoint can have a recipe too; the assistant then explains its figures from notes and, if you connect the repository, from the code.

Each pre-wired connection carries notes for the assistant (what each figure means, which changes are normal) and alert rules (see Alerts). Keys are stored on the server and never shown again; a source that stops working shows an error on its row with what to do.

Any other API live

Anything with an API and a key can be on the board without a recipe. The flow is: save the plugin, let the assistant explore it, tell it what you want and where.

1. Save the plugin: setup → + plugin → Any other API: a name, the API's address, and the key. That's the whole form; how the key must be sent is detected on first use (change it only if you know the API wants a specific header). A docs page helps the assistant. If the address belongs to a service the board already knows, it switches to that service's ready-made connection by itself.
2. Discover: ask the assistant "discover my name". It calls a few endpoints (only reads, only on that host, the key injected by the server), and tells you in plain words what the API offers.
3. Choose: say what you want and where — "show my open support tickets on the board, in a section called Support, refreshed every 30 minutes" or "add a tile with my shop's revenue today". The assistant writes a pull spec (which endpoint, where the items are, which fields are the title, time, value), schedules it, runs it once, and places the card. From then on it pulls on its own like any other source.
4. Adjust: "make it hourly", "also show the customer name", "stop pulling this", "move it to Today" — all through the chat.

Lists become a card named after the record type (orders, tickets, listings…); numbers become tiles with history and a sparkline. The assistant also writes the finish a pre-wired connection has: a name for the source, background notes on what the data means and which changes are normal (so "why did this drop?" gets a real answer), a note per figure, and alert rules that are checked after every pull and show up in Today and the setup drawer like any other alert. Ask it to tighten or loosen a rule at any time. It can also import a one-off batch of items without scheduling anything. Keys never leave the server and the assistant never sees them.

MCP servers live

Many services now offer an MCP server (Model Context Protocol): one address that exposes the service's data as named tools the assistant can call directly, with no API documentation to read. When a service offers one, it is the easiest way in.

1. Save it: setup → + plugin → Any other API → What is it: MCP server. Give a name, the MCP endpoint address (it usually ends in /mcp or /sse), and the token the service gave you for it. Servers that authorise through a sign-in page instead of a token are not supported yet.
2. Ask: "what can my name do?" lists its tools in plain words. Then say what you want on the board: "show my open Linear issues in a section called Work, hourly". The assistant calls the tool, maps the result to a card, schedules it, places it, and writes notes and alert rules, exactly like a REST API.
3. Limits: the assistant only calls tools that read (list, search, get); tools that create, send, delete or pay are refused. Results are the service's own data and stay on your server.

Any website, even without an API live

Most platforms have no public API, but their web app talks to one: every page you open makes calls with your session. The Ask Bunter · API capture Chrome extension (folder extension/ in the project, installed as an unpacked extension) records those calls on the tab you are looking at and sends them to your own server, which learns the API and puts the platform on the board.

1. Install once: chrome://extensions → Developer mode → Load unpacked → the extension folder. Click 🧠 → ⚙ → your access token (setup drawer → Account → Access token for devices).
2. Link: open the platform signed in, click 🧠, check the name, Link this site to the board. Chrome shows a "debugging" bar — that is the extension watching how the site fetches your data. Use the site as usual and open the pages whose data you want (orders, messages, balance, history). Signing in while it watches is useful: the board then knows the sign-in call.
3. Finish: Done browsing, untick any address you do not want, Finish linking. The assistant's model reads the calls with passwords and tokens removed and writes an internal guide to the API: what it is, how it authenticates, every endpoint with what it returns, which ones are safe reads, how to page. The guide is a Markdown file under data/captures/, searchable by the assistant, and shown on the platform's card (API guide).
4. The board gets a section named after the platform with its card: what data is available (each phrase is a question you can click), the session state, the guide. The session headers are the plugin's secret, on your server only; the assistant never sees them.
5. Ask: "what can you get me from name?", "my last ten orders on name", "how much did I sell there this month?". The assistant reads the guide, calls the endpoints (reads only: GET, or a POST the guide marks as a search), and answers. Say "put it on the board, hourly" and it schedules the pull into the platform's section like any other source.

When the session runs out

Sites expire sessions after hours or days. The first call that is refused marks the platform session expired: the Sources card, the Today attention list and the extension's popup all say so. Two ways back, either works:

• Link again in the extension (no password involved): signed in on the site, press Link again, load one page, Done browsing, Finish linking. The new session replaces the old one; the guide is kept.
• Sign in on the board: when the recording included the site's own username-and-password call, the Sources card shows a sign-in form. The server replays that call exactly as the site's front end does and stores the new session. The password is used for that one call and not kept; the username is remembered so next time only the password is asked. Sites that sign in through a third party (Google, Apple, a bank's app), a captcha or a code on the phone cannot be replayed: link again instead.

Staying on the site's good side

The calls the board makes come from your own server with your own session, like your browser would. What gets accounts flagged is asking too often or typing a wrong password too many times, so the board paces itself: at most 20 calls a minute, 300 an hour and 1,500 a day per platform (the assistant can lower these), scheduled pulls no more than every half hour, and one sign-in try at a time with at most three refused tries a day. The moment a site says stop — a "too many requests" answer, a bot-check page, a run of errors — the board pauses that platform (15 minutes to a day, longer each time it happens) and says so in plain words on the platform's card, the Sources card and the Today list: what happened, what it did, and when it will try again. Nothing is retried in a loop, ever. If a bot check keeps appearing, open the site in Chrome, use it for a minute, and link it again.

The extension needs Chrome's debugger permission because it is the only way to see request headers, cookies and response bodies together; it records only the tab you pressed record on, only while the bar is shown, and sends only to your Ask Bunter server, over HTTPS.

Adding anything: the short version

Whatever the route, the same things follow: the source gets a row on the Sources card with its sync state, a card on the board you can move anywhere by asking, notes the assistant uses to explain its figures, and alert rules. If a source shows needs setup, the row says exactly what is missing.

Documents & screenshots live

Drop a PDF, an image or a text file on the server (or ask the assistant where to put it) and it is read, OCR'd when it is a picture, and stored as a searchable document. Screenshots of a bank's alert thread become transactions; a statement becomes its lines. Files from a connected Drive are indexed the same way.

News live

News has its own section, right after Today: a card for World, one for each place or topic you follow (a country, a subject), then Tech & AI, Business & markets, Science & health, Sports, Culture & lifestyle. Every story shows its headline, outlet, time, and the source's picture when it has one. Tap a story to expand it in place; a small read at source ↗ opens the article. Cards show five stories and a show more; the same story from two sources appears once. Sources are the feeds and topics you set in the News plugin (world and tech feeds, keyword topics resolved to the publisher's page) and newsletters.

Newsletters as news

Newsletters that arrive by email (senders you list on the server, e.g. Morning Brew, TLDR) are read once by the assistant and turned into short items: a title, at most one sentence when needed, the link the newsletter gave, and a category. They land in the News category cards, and those emails no longer clutter the Inbox card. About a cent and a half per newsletter.

Alerts live

Each connection carries rules about its own figures, checked after every pull: a threshold ("server not running", "90% of the proxy bandwidth used", "no scrape for 30 minutes") or a drop against the figure's own 7-day usual ("half the usual traffic"). Phone-fed sources that go quiet raise one too. A firing rule shows in four places: a Needs attention card at the top of Today, the source's row in the setup drawer with a red count on the button, and the briefing's attention list. Alerts withdraw themselves when the condition clears. Ask the assistant "what is the board alerting about?" for the reading behind it.

Order of the sections. Press ✎ edit on a section and ▲ ▼ appear beside it to move it up or down the board; the same arrows sit on every section's row in the home page's ✎ edit home panel. The order is saved with your layout, follows you to every device, and is the order the briefing — and the voice reading it — walks through. You can also ask the assistant: "put Health before News".

Briefings

A short daily summary written by the assistant at the top of the board: a headline, then a few lines per section — what came in, what is due, what moved, the big news of the day — and up to three things needing action, alerts first. Each section shows when its data was last refreshed. Written once a day (7:00 by default) or on demand with refresh briefing. It only reports; it never invents figures that are not on the board.

▶ listen reads it aloud. Once the briefing is written, the assistant rewrites it as a spoken script — a greeting, each section flowing into the next, a short "before you go" checklist, a sign-off — written for the ear rather than the eye, saying only what the briefing says and each thing once. A second pass checks every claim in the script against the briefing's lines; a script that contradicts them is repaired once, and if it still differs it is not used — the lines themselves are read instead, so what you hear is never less true than what you see. With an ElevenLabs key on the server (ELEVENLABS_API_KEY in .env; BRAIN_TTS_VOICE picks the voice) the script becomes a natural voice, made each morning with the briefing so play is instant; the section being read lights up as it goes. Without a key the same script is read by your device's own voice.

Costs

Every question, briefing, newsletter read and categorising pass is metered. The Assistant usage card in the setup drawer shows today's spend, tokens and calls, the month to date against a monthly budget, and the estimated balance left on the model provider's account (a figure you enter; the board subtracts spend from it). Scheduled jobs stop at 90% of the budget and the chat at 100%, with a message instead of a silent failure. Everything else — syncing, pictures, link resolution — is free.

Signing in live

The board opens with a sign-in page: your email address and your password. A browser stays signed in for 30 days after you last used it; sign out is on the Account card in the setup drawer, which also lists the browsers you are signed in on and can sign out all the others.

Changing your password (Account card) asks for the current one and signs you out everywhere else. Forgot it? The server sends no email: ask the person who runs it for a reset link (People card → reset link next to your name). It works once, for 24 hours, and signs out every browser you were signed in on. Too many wrong tries lock signing in for that address for fifteen minutes.

The access token for devices. The phone shortcuts, the Chrome extension and the Android app cannot type a password, so they use a long permanent token instead. It is on the Account card under Access token for devices; seeing it asks for your password again. If a device is lost, make a new token cuts all of them off at once and you paste the new one into the devices you keep. (The token of the person who runs the server is set on the server itself and is changed there.)

First time, before you have a password (the person who runs the server, or anyone who joined earlier): on the sign-in page choose Use an access token instead, open the Account card and set a password. That browser moves to a normal sign-in, and the token keeps working for your devices.

People: inviting others live

One server can hold several boards. The person who runs it sees a People card in the setup drawer: type who the invite is for, press make a link, and send them the link. It works once, for seven days, and is shown only at that moment; an unused invite can be withdrawn.

Opening the link asks for your name, the email address you want to sign in with (nothing is sent to it) and a password of your choice, and opens a new, empty board. From then on you sign in with that email address and password on any device. Then connect your own Google account, plugins and shortcuts like anyone else.

Boards are separate: you cannot see another person's data and they cannot see yours; mail, calendar and files come from each person's own Google sign-in; the background syncing and the daily briefing run for everyone. Two things are shared and belong to the person running the server: the assistant's monthly budget, and their code repositories, which only their own assistant can read. Remove on the People card deletes a person together with everything stored for them; it cannot be undone.

Privacy & limits

• All data sits in your own database on your server. The only outbound traffic is the assistant's questions to the model provider, with the data needed for that answer.
• Every connection is read-only: Google scopes, Open Banking, service keys with the least permission the guide can find. Keys are stored server-side and never shown again.
• Running the board on a home computer means phone shortcuts and bank callbacks only reach it on the same network or via a self-signed https page; a server with a public address and a real certificate removes both limits.
• Banks allow only a few background reads per account per day; the board stays within them.