BankMCP: Letting AI Read Your Bank Safely

BankMCP is a self-hosted MCP server that lets an AI assistant read your bank accounts, and it went from first commit to 202 GitHub stars in six days. The repository appeared on 7 September 2026; the tagline on bankmcp.dk is "Your AI now reads your bank." If your first reaction to that sentence was to close the tab, that's the correct instinct, and it's also why the project is worth reading carefully rather than dismissing.

The short version: BankMCP is read-only, it runs on hardware you control, and the bank connection goes through a licensed European open-banking provider rather than through anything that scrapes your login. The longer version has one hop in it that isn't on your machine, and the project's own README says so before you ask.

What BankMCP actually is

It's a small TypeScript server, published on npm as bankmcp, that speaks the Model Context Protocol. You run it; your assistant connects to it as a connector; the assistant can then call tools that fetch balances and transactions. The demo on the homepage shows the shape of it: you ask whether a client has paid an invoice, the model calls get_transactions scoped to one account and the last fourteen days, and answers from what comes back.

The second turn in that demo is the interesting one. You say yes, and the assistant calls create_watch to sit on incoming credits matching a name. That's the difference between a chatbot with a bank plugin and something worth wiring up: not answering one question, but leaving a standing question running.

The chain, hop by hop

Four parties touch your data, and the README lays them out in order: your assistant talks to your BankMCP server over OAuth, your server talks to Enable Banking with a JWT, and Enable Banking talks to your bank over PSD2.

Your server holds three things: the Enable Banking application key, the bank consents, and your account identifiers. It does not store balances or transactions, and it sends no telemetry. State lives in ~/.bankmcp, and deleting that folder forgets everything.

Enable Banking is where the honesty lives. It's a Finnish company, a registered Account Information Service Provider supervised by FIN-FSA, and it sells one PSD2 API covering what it claims is 2,700-plus banks across 30 European countries. Every balance and transaction you ask for travels through their servers on the way to yours. They don't store it, and they never see your bank credentials, because you log in at your own bank's site during consent. The README's phrasing is blunt: this hop is how PSD2 works, and it is the one part of the chain that is not on your machine.

I'd rather read that sentence in a README than find it myself in a network trace. Compare it to the usual framing, where "self-hosted" gets stretched to imply nothing leaves the building, and the aggregator in the middle appears in a footnote or not at all.

Read-only, self-hosted, one user

Each of those three words buys you something different, and it helps to separate them.

Read-only means no payment initiation. PSD2 splits account information from payment initiation into two regulated services with two separate authorisations, and BankMCP only uses the first. An assistant that goes off the rails can tell you an embarrassing thing about your spending; it cannot move money, because there is no code path that does.

Self-hosted means the server process and its state sit on hardware you picked. No vendor operates an account for you, and no app maker sees the results of your queries. The limit of that claim is the Enable Banking hop above.

One user means exactly that. There is no tenancy model, no roles, no shared instance, and the site puts it bluntly under a heading reading "Software, not a service": there is no hosted version, you deploy your own copy, and you are the only user. If two people want this, that's two deployments.

The trust boundary that's left is worth naming plainly: you are trusting the code you installed from npm, and you are trusting the consent scope you granted at your own bank's login page. Read that consent screen. It's the only place where the scope of access is set by someone other than the software.

Europe only, and that's structural

BankMCP is built on PSD2, which is European payment-services regulation, through an aggregator licensed in Finland whose coverage is stated as European. If you bank in the United States, Canada, or most of Asia, this project does not work for you, and no amount of configuration will change that.

That isn't an oversight on the maintainer's part. The reason BankMCP can offer read access through an official channel at all is that European regulation obliges banks to expose one. Where that obligation doesn't exist, the equivalent tools end up scraping or storing credentials, which is a substantially worse security posture wearing the same marketing. Take the geographic limit as a sign the project chose the legitimate path rather than as a missing feature.

Two ways to run it

Locally is the easy one. You need Node 24 or newer, and for Claude Code the whole setup is claude mcp add bankmcp -- npx -y bankmcp. Claude Desktop gets a downloadable .mcpb bundle you open like an extension; Cursor and other stdio clients take the same npx -y bankmcp command. Nothing to deploy and no password.

The rough edge is TLS. Enable Banking requires HTTPS for the bank redirect, so the server generates a certificate for localhost and your browser complains once. The README's way around that is mkcert, pointing TLS_CERT_PATH and TLS_KEY_PATH at the files it produces, and it notes that BankMCP never touches your system trust store itself.

Running it on a server is the other mode, and it's what you need for claude.ai or for asking from your phone. Any container host works: the documented paths are Railway, Fly.io and Docker Compose behind a TLS terminator, with a persistent volume at /data and a public HTTPS address. Then you register an application at Enable Banking using the values the setup page prints.

That second mode is where the project quietly stops being a desktop toy. A server that has to be reachable and awake so a standing watch can fire is an always-on machine, and a laptop is not one. Zentor covers that shape directly: a hosted cloud AI computer that keeps running, so the assistant, the MCP server and the watch all live somewhere that doesn't shut when the lid does.

What you can actually ask it

The README's own examples set the range better than a feature list would: whether an invoice from a named company has been paid, what you spent on groceries in August, which subscriptions are running and what they cost per year, and a standing alert for when a balance drops below a threshold.

Notice what those have in common. Each is a question your banking app can technically answer and makes annoying to ask, because the answer lives across a search box, a date filter and a category screen that doesn't quite match how you think about your own money. Handing the raw transactions to a model that can filter and total them is a genuinely better interface for that class of question, and it's a smaller, more defensible claim than "AI for your finances".

What it won't do well is anything needing state the bank doesn't hold. It has no idea which grocery line was for the office, and no memory of last year unless the consent window reaches back that far. Treat it as a query layer over your statements rather than a bookkeeping system, and it behaves. If you're comparing this against running the whole assistant stack yourself, our breakdown of self-hosted AI agent costs covers where the hosting bill actually lands, and the wider self-hosted agent guide covers the maintenance side.

What BankMCP doesn't claim

The maintainer is careful about this, and the restraint is the most encouraging signal in the repository. It is not a bank, and the README says so in its second sentence. A project that wanted a funding round would have put payment initiation on the roadmap and called it agentic finance; this one shipped the half of PSD2 that can't cost you money and stopped there. It doesn't do budgeting, forecasting, or categorisation beyond what the model infers from raw transactions. It doesn't hold your money or move it.

It's also six days old. Releases v0.1.1 through v0.1.5 all shipped on 8 September 2026, the licence is MIT, and there were 202 stars and 34 forks when we checked on 13 September. Version numbers that low mean the interfaces will move. Nobody has published a third-party security review of the code, and we didn't find a compliance assessment beyond the PSD2 framing the project provides for itself. If you're weighing this for anything beyond your own accounts, that gap is the thing to close first.

FAQ

Can AI access my bank account safely?

Through a read-only account-information connection under PSD2, with consent you grant at your own bank, the access is narrower than most people assume: an assistant can read balances and transactions and cannot initiate payments. The risk that remains is what the model does with the data it reads, and who can reach the server holding the consent.

Is BankMCP free and open source?

Yes, MIT licensed, with the source on GitHub and the package on npm as bankmcp. "BankMCP" itself is presented as a trademark.

What is an MCP server?

A small program that exposes tools to an AI assistant over the Model Context Protocol. The assistant discovers what the server can do, calls those tools, and gets structured results back. BankMCP's tools read accounts; other servers read calendars, repositories, or databases.

Which banks does BankMCP support?

Whatever Enable Banking covers, which the project states as more than 2,700 banks in 30 European countries. There is no supported path for banks outside that footprint.

Does BankMCP store my transactions?

The README says the server holds the Enable Banking application key, the bank consents and your account ids, and does not store balances or transactions or send telemetry. Everything it keeps lives in ~/.bankmcp, and deleting that directory clears it.

Worth watching, not yet worth trusting blindly

BankMCP is the most careful version of an idea that usually shows up careless. It picked the regulated channel instead of scraping, it stayed read-only when payment initiation was available, and it wrote down the one hop where the data leaves your hardware instead of burying it.

Six days and v0.1.5 is still six days and v0.1.5. If you bank in Europe, run developer tooling comfortably, and want to try it against one account with a narrow consent, the setup is about ten minutes. If you want a security audit before you connect anything, that audit doesn't exist yet, and waiting is the reasonable call.

Facts here were checked against the GitHub API, the project README and Enable Banking's own regulatory disclosures on 13 September 2026.