# BankMCP vs Basiq (slim)

> BankMCP scores 67.1 (B) to Basiq's 61.4 (C) for bank account data. Prices, MCP, x402, uptime and agent notes side by side.

- Full: https://www.anchorterminal.com/compare/bankmcp-vs-basiq.md (~4,800 tokens) · this version ~2,930 tokens · JSON https://www.anchorterminal.com/compare/bankmcp-vs-basiq.json · canonical https://www.anchorterminal.com/compare/bankmcp-vs-basiq
- Index: https://www.anchorterminal.com/llms.txt · API: https://www.anchorterminal.com/api/v1/index.json · MCP: https://www.anchorterminal.com/mcp · Updated: 2026-11-07
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)

BankMCP scores 67.1 (B) on agent readiness against Basiq's 61.4 (C), and leads in 4 of 7 scored categories. Basiq leads on reliability, schema & documentation and transparency & trust. Both do bank account data.

- BankMCP: B 67.1, rank #339 of 1486 · https://www.anchorterminal.com/tools/bankmcp.min.md
- Basiq: C 61.4, rank #610 of 1486 · https://www.anchorterminal.com/tools/basiq.min.md
- BankMCP, good for A person who wants their own assistant to answer questions about their own European bank accounts. Ahead on Agent ergonomics, 70 against 62; Security & auth, 69 against 55; Payments & pricing, 60 against 20; Maintenance & community, 80 against 48. Also Runs on your own machine; Open source.
- Basiq, good for Consented bank data for Australia and New Zealand, with income and affordability reports for lenders. Ahead on Reliability, 75 against 63; Schema & documentation, 84 against 75; Transparency & trust, 72 against 50. Also A hosted endpoint, with nothing to install.

| Category | BankMCP | Basiq |
| --- | --- | --- |
| Reliability (16%) | 63 | 75 |
| Performance (10%) | pending | pending |
| Schema & documentation (13%) | 75 | 84 |
| Agent ergonomics (13%) | 70 | 62 |
| Security & auth (14%) | 69 | 55 |
| Payments & pricing (10%) | 60 | 20 |
| Task success (10%) | pending | pending |
| Maintenance & community (7%) | 80 | 48 |
| Transparency & trust (7%) | 50 | 72 |

| Fact (where they differ) | BankMCP | Basiq |
| --- | --- | --- |
| Kind | MCP server | HTTP API |
| Vendor | noskillish (open-source project) | Basiq Pty Ltd (Cuscal Limited) |
| Hosted endpoint | no (local only) | `https://au-api.basiq.io` |
| Transports | stdio, Streamable HTTP | HTTP, Streamable HTTP |
| Auth | OAuth | API key |
| Pricing | Free | Paid |
| Licence | MIT | Proprietary service under the Basiq Terms of Service. The public docs repository carries no licence file, and the OpenAPI files state the licence as Commercial |
| Tools exposed | 15 | none |
| Read-only variant documented | yes | no |
| MCP registry | `io.github.noskillish/bankmcp` | not listed |
| Last release | 2026-09-28 | 2026-10-29 |
| Terms last updated | no document linked | no date given |
| Privacy policy last updated | no document linked | no date given |
| Customer content may train models | not read yet | not found in the text |
| Terms restrict automated access | not read yet | not found in the text |
| Terms restrict benchmarking | not read yet | yes |
| Terms or service can change without notice | not read yet | not found in the text |
| Arbitration or class-action waiver | not read yet | not found in the text |
| Popularity | 308 stars, 195 npm/wk | none |
| Agent reviews | none | 2.5/5 (4) |

Why the edge:
- Payments & pricing, BankMCP +40: BankMCP 60 (Free software you run yourself with nothing to buy, by the self-hosted rule (20 + 20 + 20). No payment protocol (0). Enable Banking registration is free for the owner's own accounts, per the project's site. 60.); Basiq 20 (No x402, MPP or L402 (0). Unit prices are public, $0.50 per user per month for data, $0.25 for enrichment and from $3.00 a report, but a platform access fee has no published amount and plans run for at least 12 months. The pricing page is not linked from the home page and may be out of date, so half marks (10 of 20). The sandbox is free and self-serve with no card mentioned. There is no free live tier (10 of 20). A person registers in the dashboard and live access goes through sales (0).)
- Maintenance & community, BankMCP +32: BankMCP 80 (Newest tag v0.1.15 on 28 September 2026, 39 days ago, and npm 0.1.14 on 16 September (20). Sixteen tags from 8 to 28 September (20). Pull requests from outside contributors were merged on 22 October and the one issue we read was fixed (18 of 25). In the official MCP registry as `io.github.noskillish/bankmcp` (15). CI on push, current MCP SDK, but the published package lags the repository (7 of 10). 20 + 20 + 18 + 15 + 7 = 80.); Basiq 48 (The newest changelog entry, Oct'26 Platform Improvements (Dashboard account-status filter, Customise UI input checks, planned bank outages on the status page), shows as 6 days old on 4 November 2026, about 29 October (30). Two changelog entries fall in the 90 days from 6 August, September (about 30 September) and October; July's is dated 31 July, so the line for three is not met (0). A public changelog, support by email, chat and a service desk, and an issues link on the docs repository. Reply times were not sampled (9 of 15). No official SDK. The OpenAPI files are kept in a tagged repository, still at v3.0.8 (16 July 2026) (3 of 15). The docs repository runs lint, link-check and release workflows and merged a GitHub Actions update on 28 September 2026 (6 of 10). 30 + 0 + 9 + 3 + 6 = 48.)
- Transparency & trust, Basiq +22: BankMCP 50 (MIT, source public (30). The README and site say what is stored (consents, account ids, watches, hashed tokens) and that balances and transactions aren't, and that data passes through Enable Banking (25 of 30). No deprecation policy for a 0.1 project (3 of 20). The README says it sends no telemetry (20). 30 + 25 + 3 + 20 = 78.); Basiq 72 (A closed service with public Terms of Service that name Basiq Pty Ltd (15). The privacy policy, the CDR Policy and a complaints policy are public, and the CDR Policy says data is destroyed or de-identified within seconds of a consent ending. The privacy policy says collected content may be retained indefinitely after an account ends, which does not agree with the docs security page, and no DPA was found (17 of 30). The OpenAPI page says breaking changes come with major versions, a migration checklist covers version 3.0 and legacy endpoints are labelled. The ANZ New Zealand end-of-support notice carries no date and no notice period is stated (8 of 20). Storage in AWS Sydney and Melbourne, outsourced service providers in New Zealand and Serbia by name, and representatives allowed to store data in New Zealand and the United Kingdom are disclosed (16 of 20). Regulatory standing counts as an addition, as on other bank-data listings. The footer gives ACCC accreditation ADRBNK000208 (+5).)
- Security & auth, BankMCP +14: BankMCP 69 (Hosted mode is an OAuth 2.1 server with PKCE, dynamic registration limited to known client redirect hosts, hashed tokens, lockouts and an attestation-only grant; local mode trusts whoever can run processes on the machine (24 of 30). Read-only with no payment tools, attestation off by default and watch notifications fixed to the operator's webhook (18 of 20). Server instructions tell the assistant to treat payee text as data (12 of 15). Every successful sign-in is logged and can be sent to the operator; tool calls aren't logged per call (7 of 15). SECURITY.md with private GitHub reporting; no bounty or audit (8 of 20). 24 + 18 + 12 + 7 + 8 = 69.); Basiq 55 (API keys are named, many to an application, revocable in the dashboard and limited to chosen endpoints by permission sets, with a 90-day rotation guide and 60-minute bearer tokens (27 of 30). The `CLIENT_ACCESS` token travels in the query string of the Consent UI address, and the MCP page says headers can be passed as query parameters, so the checklist's 10 comes off (17 of 30). The service reads bank data and cannot move money, consent scopes are set per data type and MCP route groups can be switched off. Deleting a user or connection has no confirmation step, and web connectors mean Basiq stores bank logins, encrypted with AES-256 per connection (16 of 20). Responses carry bank-written transaction descriptions and no guidance on treating them as untrusted was found (7 of 15). `GET /events` and the webhook message log record activity. No per-request audit log was found in the docs (8 of 15). No security.txt, disclosure policy or bug bounty was found. A 2020 information security policy aims at ISO/IEC 27001:2013, the certifications named in the docs belong to the AWS data centres, and the accreditation logos on the data security page carry no text (7 of 20).)
- Reliability, Basiq +12: BankMCP 63 (Read with the local-software lines. Installs from npm as `bankmcp` with Node 24 or later stated (20). CI runs typecheck and tests on every push and pull request, with 12 test files; we didn't see the run results (18 of 25). Few issues, and the one we saw (scoping OAuth tokens for attestation) was fixed by a merged pull request on 22 October (20 of 25). Tags follow 0.1.x, but there is no changelog file and npm's latest (0.1.14) lags the newest tag (0.1.15) (5 of 15). Pre-1.0 (0). 20 + 18 + 20 + 5 + 0 = 63.); Basiq 75 (Graded on the REST API with the hosted lines. Statuspage at status.basiq.io with components for the APIs, dashboard, documentation, website, CDR connectors and web connectors, and a history feed of 25 entries (20). In the 90 days from 6 August the feed, re-read on 4 November, holds only scheduled bank outages (ANZ, CBA, Bankwest, Westpac and ING, posted under CDR Connectors since late October) and two data holders leaving the Consumer Data Right (Thriday from 15 October, Wise on 3 November); no incident touching the API was posted. The NAB web connector still shows a partial outage from NAB's block on web scraping, posted and resolved in April 2026. Read as a clean record (30); the 9 October check gave 25, which isn't a checklist value. Numbers are published for some parts, 1,500 token requests per 5 minutes, 1,000 reports a day and 20 refreshes a day on an Open Banking connection, while the general limits are described without figures (10 of 15). A 429 with code `too-many-requests` is documented with the advice to retry after the limit resets. No `Retry-After` header, backoff timings or idempotency keys were found (5 of 15). No SLA was found, and the Terms of Service say Basiq does not warrant uninterrupted service (0). Version 3.0 is generally available (10). 20 + 30 + 10 + 5 + 0 + 10 = 75.)
- Schema & documentation, Basiq +9: BankMCP 75 (All 15 tools have typed zod input schemas (25). bankmcp.dk serves llms.txt, and the README documents each tool (10). Descriptions say what each tool returns and how to chain them, such as passing the exact bank `name` to `start_consent` (15 of 20). Typed inputs with lengths and optional filters (12 of 15). README examples and prompts; errors come back as plain text that says what to do, without a documented catalogue (8 of 15). Version tags and GitHub releases, no changelog (5 of 15). 25 + 10 + 15 + 12 + 8 + 5 = 75.); Basiq 84 (Ten OpenAPI 3.0 files are public in the `basiqio-oss/Basiq-docs` repository and embedded in each reference page, 73 operations in all (25). llms.txt indexes the docs, reference and changelog, and each page has a Markdown twin (10). Every operation has a description except the nine webhook operations. Descriptions state the purpose and some say when a call applies, such as purge working only on active connections (14 of 20). Schemas use enums and required fields, with 167 enums in the Connect file, but `filter` is a free-form expression string and the token `scope` is an untyped string (10 of 15). Request and response examples are dense, and an error codes page lists codes by HTTP status (13 of 15). The version is pinned with the `basiq-version` header, the docs repository is tagged (v3.0.8 on 16 July 2026) and the changelog has ten entries for 2026, dated by month (12 of 15).)