Skip to main content
Glama
frbarreto

Glass Bank

by frbarreto
OverviewSchemaSourceRelated ServersDiscussionsAdmin
TypeScript
Remote

Glass Bank

pipeline

A public remote MCP server for a fictional bank, plus an X-ray dashboard that shows in real time everything the server observes about a session: which tools were listed and called, with which arguments and rationale, what came back, how long it took, the auth and session facts behind it, and which of five actors - client app, model, this server, our engine, this page - authored each value.

Every bank operation is mocked. Data is generated deterministically from a seed and lives in memory, with a per-grant SQLite scratch database for the Ramp-style "load, then SQL" pattern. The tool surface, scope model and OAuth shape follow Ramp's public MCP work; the observability layer is ours.

State (2026-09-26): deployed on Cloud Run (service mcp-bank, project lake-fraude) by the GitHub Actions pipeline of https://github.com/frbarreto/glassbank on every push to main; live at https://mcp-bank-520283334162.us-central1.run.app (/mcp, /xray, /health). npm run check green, contracts v0.6. Next: the hostname glassbank-mcp.abovethefog.app, then real clients (Codex and ChatGPT connected earlier through a tunnel; no claude.ai account yet). See docs/BUILD_PLAN.md.

Try it

npm ci
npm run build && npm start        # http://localhost:8080  (/mcp, /authorize, /.well-known/*, /xray)
npm run login -- --write          # opens the mock login and consent pages, writes .glass-bank-token.json
npm run e2e                       # 151 scripted checks: OAuth, read flow, write flow, step-up, dashboard API

Open http://localhost:8080/xray/?fixture=1 to see the dashboard replay a recorded session, or connect a real MCP client to http://localhost:8080/mcp and ask it for xray_get_session_link. docs/LOCAL_TESTING.md is the full walkthrough; infra/local/cloudflared.md exposes the laptop to a remote client.

Related MCP server: Meridian Bank MCP Server

How it fits together

flowchart LR
  C["MCP client (claude.ai, Claude Code, Codex, Inspector)"] -->|"OAuth 2.1 + MCP over HTTPS"| S
  B["Browser"] -->|"HTTPS + SSE"| S
  subgraph S["one process, one origin, one Cloud Run instance"]
    A["mcp-server: mock OAuth AS, /mcp transport, 17 tools, bank-core, scratch SQLite"]
    X["xray: event log, SSE stream, JSON API, static dashboard under /xray"]
    A -. "XrayEvent (in-process emitter)" .-> X
  end

Documents

Document

Answers

CLAUDE.md

Conventions, invariants, verified commands, and the full document index

docs/LOCAL_TESTING.md

Running it and driving it end to end

docs/ARCHITECTURE.md

Blocks, stack, auth sequence, decisions (ADR-x)

docs/TOOL_CATALOG.md, docs/XRAY_EVENT_MODEL.md

The 17 tools; the event contract and dashboard

docs/DEPLOYMENT.md

Cloud Run mcp-bank in lake-fraude / us-central1, operations, env knobs

docs/blocks/

One page per block

docs/RAMP_REFERENCE.md, docs/ASSUMPTIONS.md

What was copied from Ramp; numbered assumptions and decisions

MIT licensed; Ramp's notice and the copied fragments are listed in THIRD_PARTY_NOTICES.md. Everything in the repository is in English.

This server cannot be deployed

One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

Maintenance

ActivityMaintained
ResponsivenessNo issues

Resources

Related MCP Connectors

Related MCP Servers

  • poke-bank

    kacperkwapisz
    F
    license
    Not graded
    quality
    D
    maintenance
    An MCP server that exposes Enable Banking API tools for interacting with bank accounts through Open Banking. It enables users to authenticate sessions, list accounts, and fetch transaction history or balances via a secure self-hosted server.
    2
    -

  • Meridian Bank MCP Server

    saivarmadpr
    F
    license
    Not graded
    quality
    B
    maintenance
    A production-grade MCP server for a fictional digital bank, exposing tools for an AI copilot to service customers across the full risk spectrum from read-only lookups to money movement and destructive admin actions, with OAuth 2.1 security and a realistic dataset.
    3 npm
    1
    -

  • test-dcr-mcp-server

    LOUPZ-DE
    A
    license
    Not graded
    quality
    A
    maintenance
    A spec-compliant remote MCP server with built-in OAuth 2.1 and Dynamic Client Registration, enabling Notion Custom Agents to connect via 'Sign in with OAuth' without bearer tokens. It supports SSO federation to Google and Microsoft Entra, and includes basic tools like whoami, echo, and slow_task.
    MIT

  • BizBankingConnect

    mbdev4F
    F
    license
    Not graded
    quality
    B
    maintenance
    Remote MCP server for Deutsche Bank BizBank/SME API, enabling secure OAuth with PKCE and tools for account and transaction management.
    -