open-banking-io MCP Server
open-banking.io MCP server
一个轻量、只读的 Model Context Protocol 服务器,用于 open-banking.io PSD2 API。它让 AI 代理(Claude Desktop、Cursor 以及任何 MCP 客户端)能够针对你自己的银行账户回答诸如*“我的余额是多少?”和“总结上个月的交易”*之类的问题。
它封装了官方的 open-banking-io Python SDK,并继承了其零知识特性:服务只返回密文,所有敏感字段(IBAN、所有者姓名、金额、交易对手)都在进程内使用你导出的私钥解密。明文永远不会接触第三方——包括 LLM 也只能看到你的 MCP 客户端发送给它的内容。
工具
工具 | 参数 | 描述 |
| — | 银行账户:银行、国家、IBAN、所有者、显示名称、货币、余额、 |
|
| 单个账户的 ISO 20022 余额( |
|
| 对账单行,最新优先,包含交易对手和汇款详情 |
| — | 银行连接/授权:状态、 |
所有工具都是只读的。有意不提供同步、支付发起或授权管理工具——参见 限制。
Related MCP server: saldo-mcp
配置
环境变量 | 必需 | 含义 |
| 首选 | 从 open-banking.io 应用导出的凭据包路径(或内联 JSON)——包含 |
| 备选 | API 密钥,如果你不使用凭据包 |
| 备选 | 与 |
| 与备选搭配 | API 基础 URL(凭据包中的 |
在应用中导出凭据 → 设置 → 凭据 即可获取凭据包文件。
Claude Desktop
claude_desktop_config.json(Claude → 设置 → 开发者 → 编辑配置):
{
"mcpServers": {
"open-banking-io": {
"command": "uvx",
"args": [
"--from", "git+https://github.com/open-banking-io/mcp-server.git",
"obi-mcp"
],
"env": {
"OBI_CREDENTIALS": "/absolute/path/to/credentials.json"
}
}
}
}Cursor
.cursor/mcp.json:
{
"mcpServers": {
"open-banking-io": {
"command": "uvx",
"args": [
"--from", "git+https://github.com/open-banking-io/mcp-server.git",
"obi-mcp"
],
"env": {
"OBI_CREDENTIALS": "/absolute/path/to/credentials.json"
}
}
}
}需要 uv(curl -LsSf https://astral.sh/uv/install.sh | sh)。一旦发布到 PyPI,就可以去掉 --from git+… 参数。
本地运行 / 从源码运行
git clone https://github.com/open-banking-io/mcp-server.git
cd mcp-server
uv venv && uv pip install -e '.[dev]' --python .venv/bin/python
OBI_CREDENTIALS=/path/to/credentials.json .venv/bin/obi-mcp # speaks MCP over stdio
.venv/bin/python tests/smoke.py # network-free smoke test
uv run --python .venv/bin/python pytest -q # full test suite给代理的示例问题
“显示每个账户的已记账余额。”
“我七月份在食品杂货上花了多少钱?”(
get_transactions+ 分组)“我的哪些银行连接即将过期?”(
list_connections)
设计说明
构造上只读。 只暴露 SDK 的
get_*方法。sync/sync_all在 SDK 中存在,但有意不提供;代理无法通过此服务器移动资金或更改授权。精确金额。 金额以精确的十进制字符串返回(
"1234.56"),绝不用浮点数。清晰的错误。 缺少凭据、日期错误、未知账户 ID 以及上游 HTTP 错误都会以可操作的错误形式呈现(例如在未命中时列出有效的账户 ID)。
上下文友好。
get_transactions默认为 50 条,并限制在 500 条以内,以保护代理的上下文窗口;使用offset进行分页。
限制(如实列出)
没有写工具:没有同步、没有支付发起、没有授权创建/续期。授权续期始终在 open-banking.io 应用(PSD2 SCA)中完成。
没有银行/机构目录工具:上游 API(SDK v1.0.0)不暴露公开的 ASPSP 搜索端点——如果 API 添加了该端点,则 TODO。
尚未发布到 PyPI——通过
uvx --from git+…(见上文)或从源码安装。计划以open-banking-io-mcp发布到 PyPI。数据最小化是你的责任:交易包含交易对手和汇款文本;只将此服务器指向你信任的 MCP 客户端,并出于隐私考虑,优先选择本地 MCP 客户端(Claude Desktop / Cursor)而不是托管客户端。
封装的 API 表面
SDK 调用 | HTTP(SDK 底层) |
|
|
|
|
|
|
认证:X-Api-Key 请求头。响应携带零知识信封(ECDH P-256 → HKDF-SHA256 → AES-256-GCM),由 SDK 在本地解密。完整线上格式:clients 仓库 · THREAT_MODEL.md。
许可证
MIT — 与 clients SDK 仓库相同。
Available Tools
4 toolsget_balancesA
Get the balances (booked, available, ...) of one account.
type is the ISO 20022 balance code: ITBD = booked (interim), ITAV = available.
account_id comes from list_accounts.
| Name | Required | Description | Default |
|---|---|---|---|
| account_id | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description must carry the behavioral disclosure burden. It explains that the tool returns multiple balance types and defines the type codes. It does not explicitly state that the operation is read-only, but that is implicit and acceptable for a get operation. It adds useful context beyond the schema, such as the source of account_id.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is succinct and front-loaded, using two sentences and a brief code block for the type codes. Every sentence adds value with no redundant text.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given that an output schema exists (not shown in detail), we don't need description of return values. The tool is simple (one required parameter) and the description covers the essential semantics, including the meaning of type codes. It is complete for a straightforward get-balances endpoint.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0%, so the description must compensate. It does explain account_id (source from list_accounts) and defines the type parameter even though 'type' is not present in the provided schema. This discrepancy between description and schema introduces potential confusion about whether the type parameter is actually accepted, lowering the score.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states 'Get the balances (booked, available, ...) of one account' which uses a specific verb and resource, and distinguishes it from sibling tools like list_accounts, get_transactions, and list_connections. The mention of ISO 20022 balance codes adds specificity.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides a clear prerequisite: 'account_id comes from list_accounts', guiding the agent to obtain the identifier from a specific prior step. It also explains the meaning of the optional type parameter, though it does not explicitly state when to use this tool versus alternatives, which is fairly obvious given the sibling set.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_transactionsA
Get statement transactions for one account, newest first.
Args:
account_id: Account id from list_accounts.
date_from: Optional inclusive start date, ISO YYYY-MM-DD.
date_to: Optional inclusive end date, ISO YYYY-MM-DD.
limit: Page size (default 50, max 500 — keep small to protect context).
offset: Skip offset items before the page (for pagination).
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | ||
| offset | No | ||
| date_to | No | ||
| date_from | No | ||
| account_id | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden and does well: it discloses newest-first ordering, inclusive date semantics, page size default and maximum, offset-based pagination, and a practical context-window warning ('keep small to protect context'). This goes well beyond the schema.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The first line is a crisp summary, and the Args section is tightly formatted with no filler. Every sentence earns its place by conveying scope, defaults, limits, or safety guidance.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given that an output schema exists, return fields need not be restated. The description covers prerequisites, date range behavior, pagination, and resource-protection guidance, leaving no meaningful gaps for a read-only transaction listing tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, but the description compensates fully by explaining every parameter: account_id's source, date_from/date_to as optional inclusive ISO dates, limit's default/max/contextual caution, and offset's pagination role. This adds meaning beyond the raw schema types and defaults.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description opens with a specific verb+resource: 'Get statement transactions for one account, newest first.' It clearly identifies that this tool retrieves transactions for a single account and distinguishes itself from siblings like list_accounts, get_balances, and list_connections.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides clear usage context: one account, optional inclusive date range, and pagination. It also points to the prerequisite 'Account id from list_accounts.' While it does not explicitly name alternative tools or exclusions, the purpose and sibling set make the intended use clear.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_accountsA
List the user's bank accounts with balances, IBAN, owner and bank name.
Sensitive fields are decrypted in-process from the zero-knowledge envelopes.
Use an account's id for get_balances / get_transactions.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description must carry the behavioral disclosure burden. It does so by revealing that 'Sensitive fields are decrypted in-process from the zero-knowledge envelopes,' which is non-obvious and important context for the agent. It does not mention every possible behavioral trait, but it covers the most relevant security-sensitive aspect.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is three concise sentences: the first states the purpose and returned fields, the second provides essential security context, and the third gives actionable downstream usage. Every sentence earns its place with no redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool has no parameters, an output schema is present, and the description covers purpose, fields, security behavior, and how to use the result with sibling tools, it is complete enough for an agent to select and invoke it correctly. No significant gaps remain.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema is empty with zero parameters, so the description does not need to explain parameter semantics. Per the zero-parameter baseline, a score of 4 is appropriate since there is nothing ambiguous to clarify.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description starts with a specific verb and resource: 'List the user's bank accounts with balances, IBAN, owner and bank name.' It clearly defines the tool's scope and differentiates it from siblings by noting that account IDs should be used with get_balances/get_transactions.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description tells the agent how to use the output: 'Use an account's ``id`` for get_balances / get_transactions.' This gives downstream usage context, though it does not explicitly contrast with list_connections or state when not to use this tool.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_connectionsA
List the user's bank connections (consents): status, validity, last sync.
A connection with status expired / needs_reconnect means fresh data requires re-consent in the open-banking.io app — this server cannot restore consent.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are present, so the description carries the full burden. It discloses a key behavioral nuance: expired/needs_reconnect connections require re-consent elsewhere and that this server cannot restore consent. This exceeds a bare 'list' complete with an important limitation, though it doesn't cover all potential behaviors (e.g., pagination, filtering).
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, both essential. The first defines the resource and content, the second adds critical status-related caveat. No redundancy or filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple no-parameter list tool with an output schema, the description provides enough context: purpose, key fields, and an important behavioral constraint. It might mention pagination or ordering, but these are likely in the output schema, so the description is complete enough.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters, so the default baseline is 4. The description adds value by specifying the fields returned even though no parameters exist, making the tool's behavior clear without parameter explanations.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Uses a specific verb+resource ('List the user's bank connections (consents)') and enumerates the data returned (status, validity, last sync). Clearly distinguishes from sibling tools focused on accounts, balances, and transactions.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage via the domain (connections vs. accounts) and explains the implication of expired status, but it does not explicitly state when to prefer this tool over alternatives or provide exclusions. Usage context is implied rather than directly stated.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
4 tool updates
v0.1.0- First observed
get_balances - First observed
get_transactions - First observed
list_accounts - First observed
list_connections
TDQS
Scored across 4 tools
Each tool targets a distinct resource: accounts, balances, transactions, and connections. No overlap exists, and the descriptions reinforce clear boundaries.
All tool names follow a consistent verb_noun pattern (list_accounts, get_balances, get_transactions, list_connections), making the API intuitive and predictable.
With exactly 4 tools, the server is well-scoped for a read-only banking API, covering the core data needs without unnecessary bloat or sparsity.
The tool set covers the full read lifecycle: listing accounts, retrieving balances and transactions, and managing connection status. No obvious gaps exist for the stated purpose.
Maintenance
Related MCP Connectors
Read-only finance MCP server. Connects your banks, cards, payment apps, books and payroll into one ledger for your AI. Can't move money. Open source (AGPL-3.0), free during beta.
An MCP server that provides read access to your cloud storage providers, bank accounts and more.
Read-only access to your own bank, card and brokerage accounts for Claude, ChatGPT and other AI agents: balances, transactions, spending, subscriptions, cashflow and investment holdings. It can never move money.
Ask your AI about your own accounts, debts, budgets and goals. OAuth sign-in, read-only by default.
Related MCP Servers
- FlicenseNot gradedqualityDmaintenanceAn MCP Server that provides a conversational interface to the UK Open Banking account information API, allowing agents to interact with bank account data through natural language commands.-
- AlicenseNot gradedqualityDmaintenanceA read-only MCP server that securely connects Swedish/Nordic bank accounts to AI assistants, keeping all financial data local and encrypted.22 npmMIT
- AlicenseBqualityCmaintenanceA read-only MCP server that exposes Turkish open banking data (accounts, balances, transactions, cash flow, and cards) to AI agents via the ÖHVPS 2.0.0 standard.51MIT
- AlicenseAqualityAmaintenanceSelf-hosted MCP server that securely connects your bank accounts via Enable Banking, offering read-only access to balances and transactions for AI assistants.12199 npm296MIT