Akoya vs BankMCP

Akoya 23

Per the 8 October check, not re-read on 4 November (akoya.com hosts paused on the terms). The data API specification is marked "Updated 08/05/2026", read as 5 August 2026, and the newest changelog entry is about 31 July 2026. Both are more than 90 days before 4 November, so the last dated change falls within 180 days (20 to 10, cause time). Two dated changes in the last 90 days as read on 8 October, none since 6 August as recorded (0). A public changelog and a support centre with ticketing inside the Hub. No public community channel was found (8 of 15). No official SDK. A Postman workspace is the only client tooling (3 of 15). Six current OpenAPI specifications, with no packages to assess (2 of 10). Total 23.

BankMCP 80

Newest tag v0.1.15 on 28 September 2026, 39 days ago, and npm 0.1.14 on 16 September (20). Sixteen tags from 8 to 28 September (20). Pull requests from outside contributors were merged on 22 October and the one issue we read was fixed (18 of 25). In the official MCP registry as io.github.noskillish/bankmcp (15). CI on push, current MCP SDK, but the published package lags the repository (7 of 10). 20 + 20 + 18 + 15 + 7 = 80.

Akoya 10

Per the 8 October check, not re-read on 4 November (akoya.com hosts paused on the terms). No x402, MPP or L402 (0). The pricing page names Standard and Enterprise plans by monthly connections with no figures, and says a set-up fee may apply (0). The sandbox is free and self-service with test data and no card mentioned. There is no free live tier (10 of 20). A person requests a Data Recipient Hub account and sets up MFA, and production needs a security review and a signed agreement (0). Total 10.

BankMCP 60

Free software you run yourself with nothing to buy, by the self-hosted rule (20 + 20 + 20). No payment protocol (0). Enable Banking registration is free for the owner's own accounts, per the project's site. 60.

Akoya 28

Graded as a hosted service. Akoya's Terms of Use (20 December 2024, section 7(b)(iv)) bar automated systems on akoya.com, so its hosts were not requested beyond robots.txt and the terms on 4 November, and every reading below is per the 8 October check, not re-read on 4 November. No public status page was found then. status.akoya.com did not connect, and the docs place network availability and provider outages inside the Data Recipient Hub, behind a login (0). No readable incident history (5). The only number is a recommended maximum of 5 calls a second on the Apps Management API, with none for the data APIs (5 of 15, partial kept). The docs name 429 with code 1207 and say to slow bulk requests, and advise three retries with exponential backoff on 5xx. No Retry-After header and no idempotency key for app creation were found (8 of 15, partial kept). No SLA is published. The home page's 99.9%+ network availability is a vendor claim, not a commitment (0). The v3 data APIs have been in production since 23 February 2026, with only the Tax product marked beta (10). Total 28.

BankMCP 63

Read with the local-software lines. Installs from npm as bankmcp with Node 24 or later stated (20). CI runs typecheck and tests on every push and pull request, with 12 test files; we didn't see the run results (18 of 25). Few issues, and the one we saw (scoping OAuth tokens for attestation) was fixed by a merged pull request on 22 October (20 of 25). Tags follow 0.1.x, but there is no changelog file and npm's latest (0.1.14) lags the newest tag (0.1.15) (5 of 15). Pre-1.0 (0). 20 + 18 + 20 + 5 + 0 = 63.

Akoya 61

Closed service. The Terms of Use, re-read on 4 November, are still dated 20 December 2024. The data access agreement that governs production is not published (12 of 30). Per the 8 October check, not re-read on 4 November, the privacy policy of 9 June 2025 gives no retention periods, the security page says Akoya passes data through without storing consumer financial data while the docs say tokenised account number mappings are kept in a vault, and no DPA was found (12 of 30). A version timeline gives release, deprecation and sunset dates under a written six-month sunset rule, a written policy with a stated notice period (17 to 20, the settled deprecation reading). The privacy policy names Google Analytics. No subprocessor list or data location was found (3 of 20). Regulatory standing counts here as an addition to the checklist (+5 for a named regulator with a register number, +3 for a named regulator alone). Akoya names no regulator on the pages read (+0). Total 47.

BankMCP 50

MIT, source public (30). The README and site say what is stored (consents, account ids, watches, hashed tokens) and that balances and transactions aren't, and that data passes through Enable Banking (25 of 30). No deprecation policy for a 0.1 project (3 of 20). The README says it sends no telemetry (20). 30 + 25 + 3 + 20 = 78.

Akoya 59

Per the 8 October check, not re-read on 4 November (akoya.com hosts paused on the terms). OAuth 2.0 authorisation code grant with OpenID Connect. Tokens are issued per consumer and per app, ID tokens last 15 minutes to 24 hours, refresh tokens rotate, and /revoke ends a grant. Scopes are fixed, and access is narrowed by product subscriptions and the consumer's account selection (26 of 30). The data APIs are read-only, and the Hub has admin and viewer roles with mandatory MFA (17 of 20). The APIs return bank-written transaction descriptions, and no guidance on treating them as untrusted was found (7 of 15). Each response carries x-akoya-interaction-id for tracing. No per-call log for the operator was found (4 of 15). The security page states SOC 2 Type 2 and a security review of every participant, with no report, security.txt, disclosure policy, reporting route or bug bounty found. A certification claim with no report or disclosure route takes 5, as on teller and shippypro (10 to 5). Total 59.

BankMCP 69

Hosted mode is an OAuth 2.1 server with PKCE, dynamic registration limited to known client redirect hosts, hashed tokens, lockouts and an attestation-only grant; local mode trusts whoever can run processes on the machine (24 of 30). Read-only with no payment tools, attestation off by default and watch notifications fixed to the operator's webhook (18 of 20). Server instructions tell the assistant to treat payee text as data (12 of 15). Every successful sign-in is logged and can be sent to the operator; tool calls aren't logged per call (7 of 15). SECURITY.md with private GitHub reporting; no bounty or audit (8 of 20). 24 + 18 + 12 + 7 + 8 = 69.

Akoya 70

Per the 8 October check, not re-read on 4 November (akoya.com hosts paused on the terms). OpenAPI 3.1 specifications are published for all six APIs, as YAML code blocks shown on docs pages with no raw file address or download link (20 of 25, kept as a partial). No llms.txt or Markdown docs. docs.akoya.com/llms.txt returned the HTML docs page (0). Each endpoint states its purpose, and guides say which product fits a use case, such as preferring customer information over /contacts (14 of 20). Parameters are typed and the data spec carries 73 enums, but limit is typed as a string and the docs warn that providers may return unknown enum values (10 of 15). The spec carries response examples, and an error reference lists codes with causes (13 of 15). The major version is in the path, with a version timeline and a changelog of eight entries since early 2025 (13 of 15). Total 70.

BankMCP 75

All 15 tools have typed zod input schemas (25). bankmcp.dk serves llms.txt, and the README documents each tool (10). Descriptions say what each tool returns and how to chain them, such as passing the exact bank name to start_consent (15 of 20). Typed inputs with lengths and optional filters (12 of 15). README examples and prompts; errors come back as plain text that says what to do, without a documented catalogue (8 of 15). Version tags and GitHub releases, no changelog (5 of 15). 25 + 10 + 15 + 12 + 8 + 5 = 75.