Glass Bank

A public remote MCP server for a fictional bank, plus an X-ray dashboard that shows in real time everything the server observes about a session: which tools were listed and called, with which arguments and rationale, what came back, how long it took, the auth and session facts behind it, and which of five actors - client app, model, this server, our engine, this page - authored each value.

Every bank operation is mocked. Data is generated deterministically from a seed and lives in memory, with a per-grant SQLite scratch database for the Ramp-style "load, then SQL" pattern. The tool surface, scope model and OAuth shape follow Ramp's public MCP work; the observability layer is ours.

State (2026-09-26): deployed on Cloud Run (service mcp-bank, project lake-fraude) by the GitHub Actions pipeline of https://github.com/frbarreto/glassbank on every push to main; paused between demos (make pause / make resume, about 45 s to come back); when up, live at https://glassbank-mcp.abovethefog.app: the landing page at / gives the MCP URL (/mcp) and opens the dashboard (/xray/); /health for status; the run.app URL also answers. The repository is private; only the site is public. npm run check green, contracts v0.6. Next: real clients (Codex and ChatGPT connected earlier through a tunnel; no claude.ai account yet), then ORIGIN_POLICY=allowlist. See docs/BUILD_PLAN.md.

Try it

npm ci
npm run build && npm start        # http://localhost:8080  (/mcp, /authorize, /.well-known/*, /xray)
npm run login -- --write          # opens the mock login and consent pages, writes .glass-bank-token.json
npm run e2e                       # 151 scripted checks: OAuth, read flow, write flow, step-up, dashboard API

Open http://localhost:8080/ for the landing page, or http://localhost:8080/xray/?fixture=1 to see the dashboard replay a recorded session, or connect a real MCP client to http://localhost:8080/mcp and ask it for xray_get_session_link. docs/LOCAL_TESTING.md is the full walkthrough; infra/local/cloudflared.md exposes the laptop to a remote client.

Related MCP server: Meridian Bank MCP Server

How it fits together

flowchart LR
  C["MCP client (claude.ai, Claude Code, Codex, Inspector)"] -->|"OAuth 2.1 + MCP over HTTPS"| S
  B["Browser"] -->|"HTTPS + SSE"| S
  subgraph S["one process, one origin, one Cloud Run instance"]
    A["mcp-server: mock OAuth AS, /mcp transport, 17 tools, bank-core, scratch SQLite"]
    X["xray: event log, SSE stream, JSON API, static dashboard under /xray"]
    A -. "XrayEvent (in-process emitter)" .-> X
  end

Documents

MIT licensed; Ramp's notice and the copied fragments are listed in THIRD_PARTY_NOTICES.md. Everything in the repository is in English.