Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type @ followed by the MCP server name and your instructions, e.g., "@plaid-devx-mcp create a sandbox test item and list its accounts"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
A sandbox-first Model Context Protocol server for developers integrating Plaid. Twenty tools in two groups:
13 sandbox integration tools. Create a test Item, read accounts, balances, auth numbers, identity, sync transactions with cursor paging, break and repair the login, fire webhooks, search institutions, create Link tokens. Built on the official plaid Node SDK. Access tokens stay in a server-side vault; the model only ever sees an item_id.
7 docs-quality tools. Search and describe every endpoint from the official OpenAPI spec, generate minimal curl and Node requests, search and fetch plaid.com/docs as Markdown, and run a drift check that cross-references the OpenAPI spec, the official Postman collection and the docs site. No credentials needed for this group.
No keys are stored in this repo. The server reads PLAID_CLIENT_ID and PLAID_SECRET from the environment and refuses PLAID_ENV=production unless you also set PLAID_ALLOW_PRODUCTION=1.
Plaid's Developer Relations team owns the docs, the sample apps, the Postman collection and the feedback loop from developers back to Product. Every one of those is a thing that drifts: an endpoint ships in the OpenAPI spec before its docs anchor exists, a Postman request keeps calling an endpoint after it is deprecated, a externalDocs link points at a page that now 404s. Plaid's own MCP server (the Dashboard MCP) covers production diagnostics; the twenty-odd community plaid-mcp repos all do the same thing, connect my bank and read my transactions. Nothing covered the developer's first hour in sandbox, and nothing treated the docs surface as something you can test. This server does both, and the drift check is the release checklist I would run at Plaid every week.
Related MCP server: OpsMCP
Requires Node 20+.
git clone https://github.com/ExpertVagabond/plaid-devx-mcp
cd plaid-devx-mcp
npm install
npm run buildFree sandbox credentials: sign up at dashboard.plaid.com/signup, open Developers > Keys, copy the client_id and the Sandbox secret. Sandbox is free and needs no production approval.
Claude Desktop / Claude Code / Cursor config:
{
"mcpServers": {
"plaid-devx": {
"command": "node",
"args": ["/absolute/path/to/plaid-devx-mcp/dist/index.js"],
"env": {
"PLAID_CLIENT_ID": "your_client_id",
"PLAID_SECRET": "your_sandbox_secret",
"PLAID_ENV": "sandbox"
}
}
}
}Leave the env block out and the seven docs tools still work; the sandbox tools return a message telling you where to get keys.
Environment variables:
variable | default | purpose |
| unset | Plaid API keys. Sandbox secret recommended. |
|
|
|
|
| Disk cache for the OpenAPI spec (3 MB), Postman collection (1.6 MB) and llms-full.txt (6.5 MB); 24 h TTL, stale copy used if offline. |
tool | Plaid endpoint(s) | what it does |
|
| One call to a working Item. Supports |
| (local) | Items created this session, no tokens printed. |
|
| Accounts with type, subtype, mask, balances. |
|
| Real-time balances, optional |
|
| Follows |
|
| ACH, wire, EFT, BACS numbers. |
|
| Account-holder names, emails, phones, addresses. |
|
| Item status, products, consent expiry, current error. |
|
| Invalidates the token and forgets it. |
|
| Fire |
|
| Force |
|
| Find |
|
| For the real Link UI flow (web/mobile). |
Every Plaid error comes back as error_type / error_code / error_message / request_id with a link to the errors reference, not as a stack trace.
tool | source | what it does |
| OpenAPI | Keyword search across path, summary, description. Deprecated hidden by default. |
| OpenAPI | Request fields with required flag, type, enum; 200 example; docs link; deprecation. |
| OpenAPI | Minimal valid body from the required fields, rendered as curl and as |
| OpenAPI | Spec version, live/deprecated/hidden counts, all 31 sandbox-only endpoints. |
| plaid.com/docs/llms.txt | Search the page index Plaid publishes for LLMs. |
| plaid.com/docs/*/index.html.md | Fetch any docs page as Markdown, paged by offset. |
| OpenAPI + Postman + docs | Endpoints missing from Postman, Postman hitting deprecated or unknown endpoints, placeholder or missing |
Plus one MCP prompt (plaid-quickstart) and one resource (plaid-devx://quickstart).
With the server connected and sandbox keys set, ask your MCP client:
"Create a sandbox Item at First Platypus Bank with transactions and auth."
plaid_sandbox_item_create runs /sandbox/public_token/create then /item/public_token/exchange and returns item_id.
"List its accounts and the routing numbers for the checking account."
plaid_accounts_get then plaid_auth_get. Sandbox routing number is 011401533.
"Sync all transactions and total the spend by category."
plaid_transactions_sync pages through has_more; the model sums personal_finance_category.primary. On a brand-new Item the first sync can be empty for a few seconds while Plaid fetches history; ask again.
"Simulate the user changing their bank password, then show me the Item error and what my app should do."
plaid_sandbox_reset_login then plaid_item_get shows ITEM_LOGIN_REQUIRED; the fix is Link update mode with a new link_token (plaid_link_token_create with an access_token).
"Run the docs drift check and give me the three fixes you would ship first."
plaid_drift_check with live: true. See the findings below for what it returns today.
Or use the plaid-quickstart prompt, which sends all five in order.
Full report: reports/drift-2026-09-14.md. Highlights:
92 live endpoints have no request in the official Postman collection (262 requests, 210 unique paths, against 296 live endpoints). The whole /cashflow_report/*, /protect/*, /cra/loans/* and /fdx/* families are absent.
5 Postman requests call endpoints the spec marks deprecated (/categories/get, three /cra/monitoring_insights/*, /credit/bank_income/refresh), and 1 Postman request calls a path that is not in the spec at all (/transfer/platform/document/submit).
15 live endpoints have externalDocs: none as a placeholder and 18 have no externalDocs at all, so SDKs generated from the spec ship without a docs link for 33 endpoints.
4 externalDocs pages return 404 (/api/products/beta/, /api/products/issues, /api/profile/), covering 10 endpoints.
36 externalDocs anchors do not exist on the page they point at. The four /cashflow_report/* endpoints use camelCase anchors (#cashflowReportGet) while every other anchor on that page is lowercase; /cashflow_report does not appear anywhere in docs/llms-full.txt either.
76 live endpoints are never mentioned in docs/llms-full.txt, the file Plaid publishes for LLM consumption.
Three docs pages are referenced both with and without a trailing slash (/api/products/auth, /api/products/issues, /api/products/signal).
Method note: "anchor missing" means the id is absent from the server-rendered HTML of a page that does contain ids for its other endpoints. Deprecated and x-hidden-from-docs endpoints are excluded from every count.
$ npm test
✓ tests/spec-units.test.ts (7 tests) 8ms
✓ tests/sandbox-tools.test.ts (21 tests) 132ms
✓ tests/docs-tools.test.ts (12 tests) 123ms
Test Files 3 passed (3)
Tests 40 passed (40)
$ npx tsc --noEmit # cleanThe sandbox tools are tested end to end through a real MCP client over an in-memory transport against a local node:http mock of sandbox.plaid.com (tests/helpers/mock-plaid.ts), so request bodies, headers and error mapping are asserted, not stubbed. The docs tools run against a 14-endpoint subset of the real spec (tests/fixtures/mini-openapi.yml, generated by scripts/make-fixture.py) and a fake fetcher.
Live sandbox: PLAID_CLIENT_ID=... PLAID_SECRET=... npm run smoke runs the five-prompt walkthrough against sandbox.plaid.com and prints PASS/FAIL per step. npm run drift regenerates the report from live sources.
The access token is never returned in a tool result. Tools take item_id; the vault is process memory and dies with the server.
plaid_docs_fetch only fetches https://plaid.com/ URLs.
Production is opt-in twice (PLAID_ENV=production and PLAID_ALLOW_PRODUCTION=1).
Balance calls are billable in production; the tool description says so.
MIT. Not affiliated with Plaid Inc. Plaid, the OpenAPI spec and the Postman collection are Plaid's; this project only reads them.
Calls /accounts/get. Returns account ids, names, types, subtypes, masks and balances.
Inputs: item_id (required).
Request fields (required flag, type, enum, one-line description), a 200 response example from the spec, deprecation status and the docs link for a path such as /transactions/sync.
Inputs: path (required), include_response_fields.
Builds the smallest valid request body for an endpoint from the OpenAPI required fields, then renders it as a curl command and a plaid-node snippet against sandbox.plaid.com. Override fields with body.
Inputs: path (required), body, format.
Keyword search over every endpoint in the official Plaid OpenAPI spec (path, summary, description). Deprecated endpoints are hidden unless asked for.
Inputs: query (required), limit, include_deprecated.
Version of the OpenAPI spec in use, endpoint counts (live, deprecated, hidden, sandbox-only) and the full list of sandbox-only endpoints.
Inputs: no named parameters.
Calls /auth/get. Returns ACH (and wire/BACS/EFT where present) numbers for depository accounts on the Item.
Inputs: item_id (required).
Calls /accounts/balance/get, the only endpoint that always hits the institution for a fresh balance (billable per call in production).
Inputs: item_id (required), account_ids.
Every plaid.com/docs page is also served as Markdown at /index.html.md. Returns that text, truncated to max_chars, optionally starting at an offset for paging.
Inputs: url (required), offset, max_chars.
Searches the page index Plaid publishes at plaid.com/docs/llms.txt (guides, API reference, Link, webhooks, errors). Returns page titles and URLs; fetch one with plaid_docs_fetch.
Inputs: query (required), limit.
Cross-checks the official OpenAPI spec against the official Postman collection and plaid.com/docs: endpoints missing from Postman, Postman requests hitting deprecated or unknown endpoints, placeholder or missing externalDocs links, endpoints absent from llms-full.txt and, with live=true, externalDocs pages that 404 and anchors that do not exist on the page. This is the maintenance checklist a DevRel engineer would run before each release.
Inputs: live, format, include_llms_full.
Calls /identity/get. Returns names, emails, phone numbers and addresses the institution holds for each account.
Inputs: item_id (required).
Calls /institutions/search. In sandbox this returns the test banks; in production it searches the full network. Useful for finding institution_id and OAuth status.
Inputs: query (required), products, country_codes.
Calls /item/get. Shows available/billed products, consent expiration, the current error (if any) and webhook URL.
Inputs: item_id (required).
Calls /item/remove, invalidating the access_token, and forgets it in the vault. In production this stops billing for the Item.
Inputs: item_id (required).
Lists item_ids the vault knows about (no tokens are returned).
Inputs: no named parameters.
Calls /link/token/create. Use this when you want the real Link UI (web or mobile) instead of the sandbox shortcut. Pass the returned link_token to Plaid Link on the client; when Link returns a public_token, exchange it with /item/public_token/exchange. Sandbox Link accepts user_good / pass_good.
Inputs: user_id, webhook, language, products, +3 more.
Calls /sandbox/item/fire_webhook so you can exercise your webhook handler. The Item must have been created with a webhook URL.
Inputs: item_id (required), webhook_code.
Creates a test Item without going through Link: calls /sandbox/public_token/create then /item/public_token/exchange. Stores the access_token in the server vault and returns an item_id you pass to every other tool. Sandbox test institutions: ins_109508 (First Platypus Bank, default), ins_109509 (Tartan Bank), ins_109510 (Houndstooth Bank), ins_109511 (Tattersall Federal Credit Union). Use override_username "user_custom" with custom_user_json to shape the data, or "user_transactions_dynamic" for changing transactions.
Inputs: webhook, products, institution_id, override_password, +1 more.
Calls /sandbox/item/reset_login to put the Item into the error state a real user hits when their bank password changes. Use it to test your update-mode Link flow.
Inputs: item_id (required).
Calls /transactions/sync and follows has_more until the update is complete, so you get one consistent snapshot. Pass the returned next_cursor on later calls to get only changes. On a brand-new Item the first call can return zero transactions while Plaid is still fetching; the SYNC_UPDATES_AVAILABLE webhook (or a retry after a few seconds in sandbox) signals data is ready.
Inputs: item_id (required), count, cursor, max_pages.
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
Loading tool schema changelog…
Scored across 20 tools
Each tool targets a distinct resource and action: core data endpoints (accounts, balance, transactions, auth, identity), item lifecycle (create, get, list, remove), sandbox testing controls (fire webhook, reset login), API spec exploration (search, describe, request example, stats), docs access, and a drift check. Even similar tools like accounts_get vs balance_get are clearly differentiated by purpose and description.
All tools consistently use the 'plaid_' prefix followed by a noun phrase and an action verb (e.g., plaid_accounts_get, plaid_transactions_sync, plaid_sandbox_item_create). The naming pattern is uniform and predictable, making it easy to infer tool purpose from the name alone.
With 20 tools, the server covers a broad set of Plaid development features without feeling bloated. Each tool has a clear role in the developer workflow—from item creation to sandbox controls, API exploration, and documentation—so the count is well-scoped and appropriate for the server's purpose.
The tool surface covers the full lifecycle: item creation (via sandbox or Link), data retrieval for accounts, balances, transactions, auth, and identity, item management (get, list, remove), sandbox testing (webhook firing, login reset), API spec introspection, docs access, and release-readiness drift checking. No obvious gaps are apparent for commonly used Plaid endpoints.
Sandbox workspace tools: search, file read, DB queries, integrations. Returns synthetic data.
Sanctions API docs and request validation, with account-linked synthetic sandbox testing.
Email inboxes, webhooks, mock APIs, 2FA codes, approvals and 170 tools for AI agents.
Email inboxes, webhook URLs, mock APIs and 170+ tools for coding agents over one MCP connection.