n26-mcp
Provides read-only access to N26 account data via PSD2/Enable Banking: lists consented accounts, fetches balances and transactions, detects recurring charges, and reports consent status and expiry.
Can be configured as an alternative bank target via Enable Banking by setting EB_BANK=Revolut, using the same read-only balance, transaction, and recurring-charge tools.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@n26-mcpshow my N26 balance and this month's transactions"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
n26-mcp
N26 has no AI API, and with PSD2 you don't need one. A tiny read-only MCP lets your agent read your own N26 account: you approve once in the N26 app, the agent never gets your password, and there is no payment code. MIT.

Demo data, not a real account. Rendered from n26-eb demo on a made-up fixture (Example Hausverwaltung, StreamCo, a weekly veggie box). No bank was contacted, and this is not a recording of a live chat.
Your transactions are sent to whichever AI model or client you connect. Read-only means this server cannot move money. It does not mean the conversation stays on your machine.
n26-mcp: stdio MCP server for Claude Desktop, Claude Code, Cursor and any other MCP client. It importseb.py. It does not contain a second client.n26-eb: the same client as a CLI, includingconnect(bank consent) anddemo(the fixture above).SKILL.md: an agent skill (Grok Bot, Claude skills, OpenClaw) for when to use it, and the safety rules.
There is no payment code in this repo. The consent covers balances and transactions only. A recurring series needs 3 charges (2 for quarterly or yearly). It will miss a yearly bill that has only happened once, and it is not a list of every subscription.
vs bankmcp
noskillish/bankmcp is the broader Enable Banking MCP: more banks, more tools, a hosted connector. Use that if you want the larger surface.
This one is small and exercised against N26. The part worth having is the EU rule. PSD2 lets you give an agent legal read access to your own account through a licensed account-information provider (Enable Banking), without the bank shipping an AI API, without your password, and without scraping a private API. You approve in the N26 app. The process runs on your machine. There is no payment code in it.
This (PSD2 AIS via Enable Banking) | Unofficial N26 API / scrapers | |
Legal basis | EU PSD2 account information through a licensed provider | Reverse-engineered private API |
Your password | Never shared: you approve in the N26 app | The client needs your login and 2FA |
Bank terms | The sanctioned route | Breaks N26's terms and can get the account locked |
Access | Read-only, time-boxed (max 180 days), revocable | Whatever the login can do |
Where it runs | On your machine | Depends on the scraper |
Related MCP server: C6 Bank MCP
What it costs
Enable Banking's restricted production mode is free when you link your own accounts for personal, non-commercial use. The Control Panel and the API under those terms are free of charge. Every user creates their own Enable Banking application. Never share an app ID plus key. It is a tool for someone who will be their own developer, not a consumer app you can hand to someone else.
Setup (about 25 minutes)
Python 3.10+.
Install
git clone https://github.com/s-c-h-a-f-e-r/n26-agent-skill && cd n26-agent-skill python3 -m venv .venv && . .venv/bin/activate pip install -e .Or, without a checkout:
uvx --from git+https://github.com/s-c-h-a-f-e-r/n26-agent-skill n26-eb --helpCreate the Enable Banking app. Sign up at https://enablebanking.com and open the Control Panel, then API applications, new application. The form asks for a description, a privacy-policy URL, a terms-of-service URL and a data-protection email. Restricted mode does not check those URLs, but you should use addresses you control. Environment: Production. Redirect URL:
https://enablebanking.com/. Use: personal.Download the private key (
.pem) and note the application ID.First N26 approval. In the Control Panel, activate the app by linking your own account. That is you approving read access inside N26. Restricted mode only returns data for accounts you have linked. Business use and other people's accounts are out of scope.
Put the key where the installed command can see it. A checkout looks next to
eb.py. An install via pip, pipx or uvx looks in~/.config/n26-mcp(or$XDG_CONFIG_HOME/n26-mcp).mkdir -p ~/.config/n26-mcp/keys mv ~/Downloads/<your-key>.pem ~/.config/n26-mcp/keys/private.pem chmod 600 ~/.config/n26-mcp/keys/private.pem export EB_APP_ID=<your-application-id> # a checkout can instead use keys/private.pem and config.json, see config.example.json # another bank: export EB_BANK="Revolut" EB_COUNTRY=DECheck the key, then the second N26 approval.
n26-eb application # key and app ID work n26-eb aspsps # N26 is listed n26-eb connect # prints a link; approve in the N26 app; paste the redirect URLconnectisauthplussession. If you are not at a terminal, it prints the link and you finish withn26-eb session '<the URL you landed on>'.Point your MCP client at it with absolute paths (snippets below). Balances and transactions are cached for the UTC day under
~/.cache/n26-mcp.
python eb.py … still works from a checkout. The installed command is n26-eb.
Rate limits
N26, like many banks under PSD2, allows about 4 unattended balance or transaction fetches per account per day. Enable Banking treats a call as unattended when it has no PSU headers (the headers that say a person is at the keyboard). The next one comes back as HTTP 429, often ASPSP_RATE_LIMIT_EXCEEDED, for about 6 hours.
This client stores each account and date range for the UTC day, mode 0600, so a chat that asks for a balance, then spending, then subscriptions does not call the bank again. A 429 falls back to the last cached copy when there is one, and the tool says so. EB_CACHE=0 skips the cache.
When you are the one asking, set both of these so the call is marked online. Sending only one of them makes Enable Banking return 422, so neither is sent unless both are set:
export EB_PSU_IP=<your current IP>
export EB_PSU_USER_AGENT='<the user agent of the browser you are using>'A cron job or other schedule must set EB_PSU_PRESENT=0 so it does not pretend you are online. Do not poll more than about 4 times a day.
MCP server
stdio. Claude Desktop, Claude Code and Cursor start it as a local process. Every tool is marked read-only (readOnlyHint). There is no payment tool and no consent tool on the server. Connecting the bank stays on n26-eb connect, because you approve that in the N26 app.
get_transactions follows pagination, then returns the newest 50 matching rows (200 maximum). Narrow it with date_from, date_to, search (payee or remittance text) and offset. For a summary, use recurring_charges or the resource n26://spending/YYYY-MM instead of asking for every row.
Tool | What the model gets |
| Consented accounts: uid, currency, last 4 IBAN characters. Local session only. |
| Balance type, amount, currency, reference date. Cached for the day. |
| Newest rows in a date range, with |
| Cadence, typical amount, next expected date, monthly equivalent, and |
| Expiry, days left, and a warning. |
There is a prompt, monthly_spending_summary. Show balances and payees only to yourself.
Claude Desktop
claude_desktop_config.json (macOS: ~/Library/Application Support/Claude/, Windows: %APPDATA%\Claude\, Linux: ~/.config/Claude/):
{
"mcpServers": {
"n26": {
"command": "uvx",
"args": ["--from", "git+https://github.com/s-c-h-a-f-e-r/n26-agent-skill", "n26-mcp"],
"env": {
"EB_APP_ID": "your-application-id",
"EB_KEY_PATH": "/absolute/path/to/private.pem",
"EB_SESSION_PATH": "/absolute/path/to/session.json",
"EB_PSU_IP": "your-ip",
"EB_PSU_USER_AGENT": "your-browser-user-agent",
"EB_BANK": "N26",
"EB_COUNTRY": "DE"
}
}
}
}Claude Code
--transport stdio has to sit between the last --env and the server name, otherwise the name is parsed as another variable.
claude mcp add \
--env EB_APP_ID=your-application-id \
--env EB_KEY_PATH=/absolute/path/to/private.pem \
--env EB_SESSION_PATH=/absolute/path/to/session.json \
--env EB_BANK=N26 \
--env EB_COUNTRY=DE \
--transport stdio n26 \
-- uvx --from git+https://github.com/s-c-h-a-f-e-r/n26-agent-skill n26-mcpCursor
.cursor/mcp.json in the project, or ~/.cursor/mcp.json for every project. ${env:NAME} keeps the secret out of the file.
{
"mcpServers": {
"n26": {
"type": "stdio",
"command": "uvx",
"args": ["--from", "git+https://github.com/s-c-h-a-f-e-r/n26-agent-skill", "n26-mcp"],
"env": {
"EB_APP_ID": "${env:EB_APP_ID}",
"EB_KEY_PATH": "${env:EB_KEY_PATH}",
"EB_SESSION_PATH": "${env:EB_SESSION_PATH}",
"EB_BANK": "N26",
"EB_COUNTRY": "DE"
}
}
}
}After pip install -e ., the same block can use "command": "n26-mcp" and no args. python3 -m n26_mcp works too.
Consent renewal
N26 consents last at most 180 days. Run n26-eb status weekly. Exit 0 means it is fine, exit 2 means it expires within 14 days, exit 3 means it has expired. Renew with n26-eb connect. The 4-a-day cap above still applies. The status check itself does not fetch transactions.
Privacy
Keys,
config.json,session.json,data/and the cache are not for git. The cache is outside the repo, under~/.cache/n26-mcp.Show balances, transactions and payees only to yourself, never in a shared channel (
SKILL.md). Do not add this server to a shared Cursor or Claude project if other people can read tool output.Your transactions are sent to whichever AI model or client you connect.
Tests
python3 -m unittest discover -s tests # offline; sample/transactions.json and a mocked API
python3 tests/make_sample.py # regenerate the synthetic sample and the bundled fixture
python3 scripts/make_demo_gif.py # regenerate docs/demo.gif from that fixtureGitHub Actions runs the suite on Python 3.10–3.13 and checks that the package builds (.github/workflows/tests.yml).
Publishing
The PyPI name to claim is n26-mcp. Nothing in this repo uploads it.
python -m pip install build twine
python -m build
twine check dist/*
# twine upload dist/* # only when you mean to publish.github/workflows/release.yml publishes to PyPI when a GitHub Release is published, via trusted publishing. It does not run on pull requests. Create the PyPI project and the GitHub pypi environment first.
Until then:
uvx --from git+https://github.com/s-c-h-a-f-e-r/n26-agent-skill n26-mcp
pipx install git+https://github.com/s-c-h-a-f-e-r/n26-agent-skillCredits
noskillish/bankmcp: the leading Enable Banking MCP. This repo is the small, N26-tested, read-only one.
Enable Banking API samples, which the client is based on.
Disclaimer
Not affiliated with N26 or Enable Banking. Not financial advice. Check your bank's and Enable Banking's terms before connecting.
License
MIT, see LICENSE.
Available Tools
5 toolsconsent_statusConsent statusARead-onlyIdempotent
Read-only consent expiry: valid until, days left, and a warning.
N26 consents last at most 180 days. state is ok, renew_soon, expired or
unknown. This does not renew the consent and cannot move money. Renew with
n26-eb connect. Show the result only to the account owner.
| Name | Required | Description | Default |
|---|---|---|---|
| remote | No | Also ask Enable Banking for the live session status. | |
| warn_days | No | Warn when this many days or fewer remain. |
Output Schema
| Name | Required | Description |
|---|---|---|
| bank | No | |
| state | Yes | ok, renew_soon, expired or unknown. |
| warning | No | |
| accounts | Yes | How many accounts the consent covers. |
| days_left | No | |
| owner_only | Yes | |
| valid_until | No | |
| remote_status | No | Enable Banking session status, only when remote is true. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With annotations already covering read-only/idempotent safety, the description adds substantial domain context: the 180-day consent ceiling, the four possible state values, and a privacy constraint ('Show the result only to the account owner'). None of that is recoverable from the structured fields.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Four short lines, front-loaded with purpose before the exclusions and the privacy note. The line-broken fragment style is slightly choppy, but no sentence is wasted.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return-value documentation is unnecessary, yet the description still enumerates the state values an agent must branch on. Combined with the scope limits and privacy rule, nothing needed to call this correctly is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so both `remote` and `warn_days` are fully documented in the schema. The description nods at the warning concept but adds no format, unit, or interaction detail beyond what the schema already states; baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Opens with a specific verb+resource+return: 'Read-only consent expiry: valid until, days left, and a warning.' It is immediately distinguishable from siblings like get_balances or get_transactions, which deal with money rather than consent state.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly bounds usage: 'This does not renew the consent and cannot move money. Renew with `n26-eb connect`.' It names the alternative tool for the adjacent task an agent might confuse this with, which is exactly the routing guidance needed.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_balancesGet balancesARead-onlyIdempotent
Read-only balances for the consented accounts.
Shows balance type, amount, currency and reference date. There is no payment action. Show the result only to the account owner.
| Name | Required | Description | Default |
|---|---|---|---|
| account | No | Account uid from list_accounts. Omit for every consented account. |
Output Schema
| Name | Required | Description |
|---|---|---|
| accounts | Yes | |
| owner_only | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Beyond the annotations (readOnlyHint), it provides crucial behavioral context regarding data fields returned (type, amount, currency, date) and a necessary authorization constraint (only shown to the account owner).
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is brief and front-loaded, though the second sentence slightly over-explains the basic data structure that is often inferred from an output schema.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
It is extremely complete for a read-only, scoped query. It defines the boundaries (consented accounts), the scope of the result (owner only), and the data included (fields).
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Since schema coverage is 100%, the description adds value by reinforcing the meaning of the 'account' parameter—that omitting it retrieves balances for all consented accounts, which is the core functionality.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly identifies the resource (balances) and the action (read-only), distinguishing it from siblings like list_accounts by specifying the operational scope.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It guides usage by explaining that the results are tied to consented accounts, and explicitly notes that no payment action is possible, helping the agent avoid misuse.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_transactionsGet transactionsARead-onlyIdempotent
Read-only transactions for a date range.
Follows Enable Banking continuation pages, then returns the newest matching rows only (default 50, maximum 200) so a long history does not fill the context. Filter with search, or narrow date_from and date_to. For a summary, use recurring_charges or the monthly spending resource instead of raising the limit. Debits are negative amounts with direction DBIT. There is no payment action. Show the result only to the account owner.
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | How many matching rows to return, newest first. Default 50. Maximum 200. | |
| offset | No | How many matching rows to skip. Use with limit to page. | |
| search | No | Case-insensitive text match on payee (creditor or debtor) or remittance. | |
| account | No | Account uid from list_accounts. Omit for every consented account. | |
| date_to | No | End date, inclusive, YYYY-MM-DD. Omit to leave the end open. | |
| date_from | Yes | Start date, inclusive, YYYY-MM-DD. |
Output Schema
| Name | Required | Description |
|---|---|---|
| accounts | Yes | |
| owner_only | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already cover read-only, idempotent and non-destructive, and the description still adds substantial behavior: it transparently discloses internal continuation-page traversal, that only the newest matching rows are returned, the context-protection cap (default 50, max 200), the sign convention (debits negative, direction DBIT), the absence of any payment action, and a privacy constraint ('show the result only to the account owner'). These are non-obvious traits an agent could not infer from structured fields.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loaded with the core purpose, then progressive detail on paging, filtering, alternatives and constraints. Every sentence carries actionable information; nothing is filler, and the only repetition (50/200 cap) is restated to justify the context-safety rationale.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a six-parameter, open-world read tool with an output schema, the description covers everything an agent needs: paging behavior, truncation limits, filtering strategy, alternatives, sign conventions and a privacy caution. Return-value structure is correctly left to the output schema.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the baseline is 3, but the description adds rationale the schema lacks: why the limit exists (so a long history does not fill context) and that narrowing dates or searching is preferable to raising it. It does not add syntax or format detail beyond the schema, so it stops short of 5.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource plus scope: 'Read-only transactions for a date range.' It also clarifies the retrieval model (follows Enable Banking continuation pages, then returns newest matching rows) and names the sibling tools to use for a different job, so an agent can separate it from recurring_charges without opening any schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicit routing guidance: 'Filter with search, or narrow date_from and date_to' and 'For a summary, use recurring_charges or the monthly spending resource instead of raising the limit.' It gives both the positive usage pattern and the when-not/alternative, which is exactly the decision an agent faces.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_accountsList accountsARead-onlyIdempotent
Read-only list of accounts covered by the current bank consent.
Returns each account uid, its currency, and the last four IBAN characters from the local session file. It does not call the bank and cannot move money. Show the result only to the account owner.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
| bank | No | |
| accounts | Yes | |
| owner_only | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnly, idempotent, closed-world and non-destructive, so the description adds real value by disclosing that it reads a local session file rather than calling the bank (implying possible staleness) and that it cannot move money. The data-handling restriction is a genuine operational constraint not encoded anywhere in the structured fields.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three short sentences, front-loaded with the read-only/consent scope, then behavior, then the disclosure rule. No filler, and the most decision-relevant fact comes first.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With zero parameters, rich annotations and an output schema, the description covers the remaining gaps: data source (local session file), non-network behavior, and the privacy constraint on displaying results. Only the freshness/refresh semantics of the session file are left implicit.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool takes zero parameters, which is the baseline-4 case; there is nothing for the description to disambiguate. The return-field sentence compensates usefully by describing what the caller gets back.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('read-only list of accounts') plus its scope ('covered by the current bank consent'), and enumerates the returned fields. It is clearly distinct from get_balances/get_transactions by resource, though it never names those siblings to route the agent explicitly.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is implied by the consent-scoped framing, and the disclosure instruction ('show the result only to the account owner') tells the agent how to present output. There is no explicit when-to-use/when-not guidance or comparison to the sibling read tools, so the agent must infer selection.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
recurring_chargesRecurring chargesARead-onlyIdempotent
Read-only detection of subscriptions and other recurring charges.
Same detector as eb.py recurring: cadence (weekly, lunar, monthly,
quarterly, yearly), typical amount, next expected date and monthly
equivalent. A charge that is overdue is marked lapsed?. Pagination is
handled inside the tool. There is no payment action. Show the result only
to the account owner.
| Name | Required | Description | Default |
|---|---|---|---|
| today | No | Judge lapsed charges as of this YYYY-MM-DD. Defaults to the real date. | |
| account | No | Account uid from list_accounts. Omit for every consented account. | |
| date_to | No | End date, inclusive, YYYY-MM-DD. Omit to leave the end open. | |
| date_from | Yes | How far back to look, inclusive, YYYY-MM-DD. Six to twelve months works well. | |
| min_count | No | Minimum charges before a series counts. Quarterly and yearly series need only 2. | |
| include_credits | No | Also detect recurring incoming payments, such as salary. |
Output Schema
| Name | Required | Description |
|---|---|---|
| as_of | Yes | |
| items | Yes | |
| notice | No | |
| currency | No | |
| owner_only | Yes | |
| monthly_total_out | Yes | Sum of monthly equivalents for active outgoing charges. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint, idempotentHint, non-destructive and openWorld, so the safety profile is covered. The description adds genuinely new behavior: pagination is handled internally, overdue series are marked 'lapsed?', and results are restricted to the account owner — none of which the annotations convey.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The core purpose is front-loaded in the first sentence, followed by output shape and constraints. Slightly terse shorthand ('lapsed?') costs a little clarity, but there is no wasted text.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With an output schema present, return values needn't be re-explained; the description covers what structured fields don't — internal pagination, the no-payment guarantee, and the owner-only disclosure rule. For a read-only detector with full schema coverage, an agent has everything needed to call and present it correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, and every parameter (today, account, date_to, date_from, min_count, include_credits) is already documented in the schema, including the 'six to twelve months works well' hint and the quarterly/yearly min-count exception. The description adds no parameter-level meaning beyond that, so the baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource — 'Read-only detection of subscriptions and other recurring charges' — which is clearly distinct from the sibling list/balance/transaction tools. It also names the underlying detector ('Same detector as `eb.py recurring`') and enumerates the derived outputs, so an agent knows exactly what this produces.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is implied rather than stated: the tool detects recurring series, so an agent infers raw transaction listing belongs to get_transactions, but no sibling is named and no explicit 'use this instead of X when Y' guidance is given. It does include one useful exclusion ('There is no payment action') and a handling rule ('Show the result only to the account owner'), which lifts it above pure absence of guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
5 tool updates
v0.2.0- First observed
consent_status - First observed
get_balances - First observed
get_transactions - First observed
list_accounts - First observed
recurring_charges
TDQS
Scored across 5 tools
Each tool maps to a distinct read-only resource: accounts, balances, transactions, recurring-charge detection, and consent expiry. The only mild overlap is between get_transactions and recurring_charges, since the latter is derived from transaction data, but the descriptions explicitly steer agents (use recurring_charges for summaries rather than raising the transaction limit).
Three tools follow a clean verb_noun pattern (list_accounts, get_balances, get_transactions), while recurring_charges and consent_status are noun-phrase names describing derived resources. The deviation is small and every name is self-explanatory, so predictability remains high.
Five tools is well-scoped for a read-only open-banking surface, and each one covers a genuinely different question (which accounts, what balance, what moved, what recurs, is the consent still valid). There is no filler or redundant tool.
The read-only lifecycle is well covered: discovery, balances, paged/filterable transactions, recurring-charge analysis, and consent health including expiry warning. Minor gaps exist (no account-holder details, no dedicated spending-summary tool — it is only referenced as an external resource), but nothing blocks core agent workflows, and payment operations are intentionally out of scope.
Maintenance
Related MCP Connectors
Read bank accounts, balances and transactions from 10,000+ European banks.
Read-only access to your bank balances and transactions in Germany and the EU. Free trial.
Read-only access to your bank, investment, and crypto accounts: balances, transactions, holdings.
Read-only banking and personal finance for AI agents: accounts, transactions, spending, budgets.
Related MCP Servers
- AlicenseBqualityDmaintenanceEnables read-only access to personal bank accounts via the TrueLayer API, allowing querying of accounts, balances, transactions, and generating financial analytics such as spending by category, subscriptions, and monthly summaries.91MIT
- AlicenseNot gradedqualityDmaintenanceEnables reading C6 Bank account balances, statements, credit card bills, and investments via Open Finance Brasil. It is read-only and regulated by the Central Bank of Brazil.MIT
- AlicenseNot gradedqualityBmaintenanceEnables secure, read-only access to personal European bank accounts through Enable Banking and Cloudflare Workers, allowing MCP clients to list accounts, retrieve balances, search transactions, and summarize cash flow.2MIT
- AlicenseAqualityAmaintenanceEnables read-only access to Banco General accounts, cards, and pension data through MCP, allowing balance checks, transaction searches, and spending summaries without moving funds.1425 npm1MIT