BankMCP vs Basiq

BankMCP 60

Free software you run yourself with nothing to buy, by the self-hosted rule (20 + 20 + 20). No payment protocol (0). Enable Banking registration is free for the owner's own accounts, per the project's site. 60.

Basiq 20

No x402, MPP or L402 (0). Unit prices are public, $0.50 per user per month for data, $0.25 for enrichment and from $3.00 a report, but a platform access fee has no published amount and plans run for at least 12 months. The pricing page is not linked from the home page and may be out of date, so half marks (10 of 20). The sandbox is free and self-serve with no card mentioned. There is no free live tier (10 of 20). A person registers in the dashboard and live access goes through sales (0).

BankMCP 80

Newest tag v0.1.15 on 28 September 2026, 39 days ago, and npm 0.1.14 on 16 September (20). Sixteen tags from 8 to 28 September (20). Pull requests from outside contributors were merged on 22 October and the one issue we read was fixed (18 of 25). In the official MCP registry as io.github.noskillish/bankmcp (15). CI on push, current MCP SDK, but the published package lags the repository (7 of 10). 20 + 20 + 18 + 15 + 7 = 80.

Basiq 48

The newest changelog entry, Oct'26 Platform Improvements (Dashboard account-status filter, Customise UI input checks, planned bank outages on the status page), shows as 6 days old on 4 November 2026, about 29 October (30). Two changelog entries fall in the 90 days from 6 August, September (about 30 September) and October; July's is dated 31 July, so the line for three is not met (0). A public changelog, support by email, chat and a service desk, and an issues link on the docs repository. Reply times were not sampled (9 of 15). No official SDK. The OpenAPI files are kept in a tagged repository, still at v3.0.8 (16 July 2026) (3 of 15). The docs repository runs lint, link-check and release workflows and merged a GitHub Actions update on 28 September 2026 (6 of 10). 30 + 0 + 9 + 3 + 6 = 48.

BankMCP 50

MIT, source public (30). The README and site say what is stored (consents, account ids, watches, hashed tokens) and that balances and transactions aren't, and that data passes through Enable Banking (25 of 30). No deprecation policy for a 0.1 project (3 of 20). The README says it sends no telemetry (20). 30 + 25 + 3 + 20 = 78.

Basiq 72

A closed service with public Terms of Service that name Basiq Pty Ltd (15). The privacy policy, the CDR Policy and a complaints policy are public, and the CDR Policy says data is destroyed or de-identified within seconds of a consent ending. The privacy policy says collected content may be retained indefinitely after an account ends, which does not agree with the docs security page, and no DPA was found (17 of 30). The OpenAPI page says breaking changes come with major versions, a migration checklist covers version 3.0 and legacy endpoints are labelled. The ANZ New Zealand end-of-support notice carries no date and no notice period is stated (8 of 20). Storage in AWS Sydney and Melbourne, outsourced service providers in New Zealand and Serbia by name, and representatives allowed to store data in New Zealand and the United Kingdom are disclosed (16 of 20). Regulatory standing counts as an addition, as on other bank-data listings. The footer gives ACCC accreditation ADRBNK000208 (+5).

BankMCP 69

Hosted mode is an OAuth 2.1 server with PKCE, dynamic registration limited to known client redirect hosts, hashed tokens, lockouts and an attestation-only grant; local mode trusts whoever can run processes on the machine (24 of 30). Read-only with no payment tools, attestation off by default and watch notifications fixed to the operator's webhook (18 of 20). Server instructions tell the assistant to treat payee text as data (12 of 15). Every successful sign-in is logged and can be sent to the operator; tool calls aren't logged per call (7 of 15). SECURITY.md with private GitHub reporting; no bounty or audit (8 of 20). 24 + 18 + 12 + 7 + 8 = 69.

Basiq 55

API keys are named, many to an application, revocable in the dashboard and limited to chosen endpoints by permission sets, with a 90-day rotation guide and 60-minute bearer tokens (27 of 30). The CLIENT_ACCESS token travels in the query string of the Consent UI address, and the MCP page says headers can be passed as query parameters, so the checklist's 10 comes off (17 of 30). The service reads bank data and cannot move money, consent scopes are set per data type and MCP route groups can be switched off. Deleting a user or connection has no confirmation step, and web connectors mean Basiq stores bank logins, encrypted with AES-256 per connection (16 of 20). Responses carry bank-written transaction descriptions and no guidance on treating them as untrusted was found (7 of 15). GET /events and the webhook message log record activity. No per-request audit log was found in the docs (8 of 15). No security.txt, disclosure policy or bug bounty was found. A 2020 information security policy aims at ISO/IEC 27001:2013, the certifications named in the docs belong to the AWS data centres, and the accreditation logos on the data security page carry no text (7 of 20).

BankMCP 63

Read with the local-software lines. Installs from npm as bankmcp with Node 24 or later stated (20). CI runs typecheck and tests on every push and pull request, with 12 test files; we didn't see the run results (18 of 25). Few issues, and the one we saw (scoping OAuth tokens for attestation) was fixed by a merged pull request on 22 October (20 of 25). Tags follow 0.1.x, but there is no changelog file and npm's latest (0.1.14) lags the newest tag (0.1.15) (5 of 15). Pre-1.0 (0). 20 + 18 + 20 + 5 + 0 = 63.

Basiq 75

Graded on the REST API with the hosted lines. Statuspage at status.basiq.io with components for the APIs, dashboard, documentation, website, CDR connectors and web connectors, and a history feed of 25 entries (20). In the 90 days from 6 August the feed, re-read on 4 November, holds only scheduled bank outages (ANZ, CBA, Bankwest, Westpac and ING, posted under CDR Connectors since late October) and two data holders leaving the Consumer Data Right (Thriday from 15 October, Wise on 3 November); no incident touching the API was posted. The NAB web connector still shows a partial outage from NAB's block on web scraping, posted and resolved in April 2026. Read as a clean record (30); the 9 October check gave 25, which isn't a checklist value. Numbers are published for some parts, 1,500 token requests per 5 minutes, 1,000 reports a day and 20 refreshes a day on an Open Banking connection, while the general limits are described without figures (10 of 15). A 429 with code too-many-requests is documented with the advice to retry after the limit resets. No Retry-After header, backoff timings or idempotency keys were found (5 of 15). No SLA was found, and the Terms of Service say Basiq does not warrant uninterrupted service (0). Version 3.0 is generally available (10). 20 + 30 + 10 + 5 + 0 + 10 = 75.

BankMCP 75

All 15 tools have typed zod input schemas (25). bankmcp.dk serves llms.txt, and the README documents each tool (10). Descriptions say what each tool returns and how to chain them, such as passing the exact bank name to start_consent (15 of 20). Typed inputs with lengths and optional filters (12 of 15). README examples and prompts; errors come back as plain text that says what to do, without a documented catalogue (8 of 15). Version tags and GitHub releases, no changelog (5 of 15). 25 + 10 + 15 + 12 + 8 + 5 = 75.

Basiq 84

Ten OpenAPI 3.0 files are public in the basiqio-oss/Basiq-docs repository and embedded in each reference page, 73 operations in all (25). llms.txt indexes the docs, reference and changelog, and each page has a Markdown twin (10). Every operation has a description except the nine webhook operations. Descriptions state the purpose and some say when a call applies, such as purge working only on active connections (14 of 20). Schemas use enums and required fields, with 167 enums in the Connect file, but filter is a free-form expression string and the token scope is an untyped string (10 of 15). Request and response examples are dense, and an error codes page lists codes by HTTP status (13 of 15). The version is pinned with the basiq-version header, the docs repository is tagged (v3.0.8 on 16 July 2026) and the changelog has ten entries for 2026, dated by month (12 of 15).