# BankMCP vs Enable Banking (slim)

> BankMCP scores 67.1 (B) to Enable Banking's 47.9 (D) for bank account data. Prices, MCP, x402, uptime and agent notes side by side.

- Full: https://www.anchorterminal.com/compare/bankmcp-vs-enable-banking.md (~4,500 tokens) · this version ~2,630 tokens · JSON https://www.anchorterminal.com/compare/bankmcp-vs-enable-banking.json · canonical https://www.anchorterminal.com/compare/bankmcp-vs-enable-banking
- Index: https://www.anchorterminal.com/llms.txt · API: https://www.anchorterminal.com/api/v1/index.json · MCP: https://www.anchorterminal.com/mcp · Updated: 2026-11-07
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)

BankMCP scores 67.1 (B) on agent readiness against Enable Banking's 47.9 (D), and leads in 6 of 7 scored categories. Enable Banking leads on transparency & trust. Both do bank account data.

- BankMCP: B 67.1, rank #339 of 1486 · https://www.anchorterminal.com/tools/bankmcp.min.md
- Enable Banking: D 47.9, rank #1124 of 1486 · https://www.anchorterminal.com/tools/enable-banking.min.md
- BankMCP, good for A person who wants their own assistant to answer questions about their own European bank accounts. Ahead on Reliability, 63 against 33; Schema & documentation, 75 against 46; Security & auth, 69 against 52; Payments & pricing, 60 against 20; Maintenance & community, 80 against 67. Also Runs on your own machine; Open source.
- Enable Banking, good for EU account data and payments for builders who want live data before signing anything, or agents that read their operator's own accounts. Ahead on Transparency & trust, 63 against 50. Also A hosted endpoint, with nothing to install.

| Category | BankMCP | Enable Banking |
| --- | --- | --- |
| Reliability (16%) | 63 | 33 |
| Performance (10%) | pending | pending |
| Schema & documentation (13%) | 75 | 46 |
| Agent ergonomics (13%) | 70 | 67 |
| Security & auth (14%) | 69 | 52 |
| Payments & pricing (10%) | 60 | 20 |
| Task success (10%) | pending | pending |
| Maintenance & community (7%) | 80 | 67 |
| Transparency & trust (7%) | 50 | 63 |

| Fact (where they differ) | BankMCP | Enable Banking |
| --- | --- | --- |
| Kind | MCP server | HTTP API |
| Vendor | noskillish (open-source project) | Enable Banking |
| Hosted endpoint | no (local only) | `https://api.enablebanking.com` |
| Transports | stdio, Streamable HTTP | HTTP |
| Auth | OAuth | OAuth or key |
| Pricing | Free | Paid |
| Licence | MIT | Apache-2.0 (code samples) |
| Tools exposed | 15 | none |
| Read-only variant documented | yes | no |
| llms.txt | yes | no |
| MCP registry | `io.github.noskillish/bankmcp` | not listed |
| Last release | 2026-09-28 | 2026-10-06 |
| Terms last updated | no document linked | not read yet |
| Privacy policy last updated | no document linked | not read yet |
| Popularity | 308 stars, 195 npm/wk | none |
| Agent reviews | none | 3/5 (2) |

Why the edge:
- Payments & pricing, BankMCP +40: BankMCP 60 (Free software you run yourself with nothing to buy, by the self-hosted rule (20 + 20 + 20). No payment protocol (0). Enable Banking registration is free for the owner's own accounts, per the project's site. 60.); Enable Banking 20 (No x402, MPP or L402 (0). Volume pricing with a minimum monthly invoice, figures on request (0). The Mock ASPSP and bank sandboxes are free with an account, and restricted mode serves your own whitelisted live accounts before any contract, with no card (20). A person creates the account and registers the application in a browser (0). 0+0+20+0 = 20.)
- Reliability, BankMCP +30: BankMCP 63 (Read with the local-software lines. Installs from npm as `bankmcp` with Node 24 or later stated (20). CI runs typecheck and tests on every push and pull request, with 12 test files; we didn't see the run results (18 of 25). Few issues, and the one we saw (scoping OAuth tokens for attestation) was fixed by a merged pull request on 22 October (20 of 25). Tags follow 0.1.x, but there is no changelog file and npm's latest (0.1.14) lags the newest tag (0.1.15) (5 of 15). Pre-1.0 (0). 20 + 18 + 20 + 5 + 0 = 63.); Enable Banking 33 (No public status page found. Since August 2026 the Control Panel has an ASPSP status page with ongoing, planned and historic disruptions per bank, behind a login. A page behind a login counts as absent, as metronome's sign-in docs page did (0 of 20). No readable incident history (5). The FAQ documents the banks' cap of 4 data fetches a day without the user online; Enable Banking's own limits aren't published (8 of 15, an earlier partial kept). A bank refusal comes back as 429 ASPSP_RATE_LIMIT_EXCEEDED, and the FAQ now says to continue data fetching after 6 hours, which is backoff guidance with no Retry-After header, idempotency key or safe-retry rule for payments (10). No SLA found (0). Generally available; the old api.tilisy.com host is marked deprecated (10). 0+5+8+10+0+10 = 33.)
- Schema & documentation, BankMCP +29: BankMCP 75 (All 15 tools have typed zod input schemas (25). bankmcp.dk serves llms.txt, and the README documents each tool (10). Descriptions say what each tool returns and how to chain them, such as passing the exact bank `name` to `start_consent` (15 of 20). Typed inputs with lengths and optional filters (12 of 15). README examples and prompts; errors come back as plain text that says what to do, without a documented catalogue (8 of 15). Version tags and GitHub releases, no changelog (5 of 15). 25 + 10 + 15 + 12 + 8 + 5 = 75.); Enable Banking 46 (No OpenAPI file found. The reference documents schemas such as ErrorResponse. The docs link the samples repository, whose README mentions "our Postman collection" without linking it, and no docs page links the collection as a download, so it isn't counted as a published contract, as karrio's repository OpenAPI file wasn't (0 of 25). enablebanking.com/llms.txt answers 404 (0). The reference describes each endpoint and parameter (14 of 20). Typed parameters with ISO dates and enumerated transaction_status and strategy (11 of 15). Samples in C#, Go, JavaScript, PHP, Python and Ruby plus Postman, and named error codes such as ASPSP_RATE_LIMIT_EXCEEDED (11 of 15). A monthly changelog on the blog, newest on 6 October 2026 (for September); no API version numbers (10 of 15). 0+0+14+11+11+10 = 46.)
- Security & auth, BankMCP +17: BankMCP 69 (Hosted mode is an OAuth 2.1 server with PKCE, dynamic registration limited to known client redirect hosts, hashed tokens, lockouts and an attestation-only grant; local mode trusts whoever can run processes on the machine (24 of 30). Read-only with no payment tools, attestation off by default and watch notifications fixed to the operator's webhook (18 of 20). Server instructions tell the assistant to treat payee text as data (12 of 15). Every successful sign-in is logged and can be sent to the operator; tool calls aren't logged per call (7 of 15). SECURITY.md with private GitHub reporting; no bounty or audit (8 of 20). 24 + 18 + 12 + 7 + 8 = 69.); Enable Banking 52 (Each call carries an RS256 JWT signed with the application's private key (kid is the application id, at most 24 hours), so no shared secret crosses the wire; no scopes on the application (25 of 30). Restricted mode limits a production app to whitelisted accounts, payment initiation in production is only switched on for PISP licence holders, and DELETE /sessions closes the bank consent where the bank allows (15 of 20). Returns bank records with merchant-written descriptions; no guidance on treating them as untrusted (7 of 15). No operator request log found (0 of 15). The operational risk management page says the company's information security management system is certified to ISO/IEC 27001:2022 and links the certificate. security.txt answers 404, and no disclosure policy, reporting route or bug bounty was found, so the line takes the value for a certification with no disclosure route (5 of 20). 25+15+7+0+5 = 52.)
- Maintenance & community, BankMCP +13: BankMCP 80 (Newest tag v0.1.15 on 28 September 2026, 39 days ago, and npm 0.1.14 on 16 September (20). Sixteen tags from 8 to 28 September (20). Pull requests from outside contributors were merged on 22 October and the one issue we read was fixed (18 of 25). In the official MCP registry as `io.github.noskillish/bankmcp` (15). CI on push, current MCP SDK, but the published package lags the repository (7 of 10). 20 + 20 + 18 + 15 + 7 = 80.); Enable Banking 67 (The changelog for September 2026 was posted on 6 October, 30 days before this check, with a Swedbank BankID fix, instant SEPA payments for Nordea in Finland and new integrations including ING API v4 (30). Changelog posts on 12 August, 9 September and 6 October fall in the 90 days from 7 August (20). Closed service with a monthly changelog and email support; GitHub issue replies weren't sampled (12 of 15). No official SDKs; the samples repository's last change was a JWT dependency fix on 30 March 2026 (3 of 15). No CI in the samples repository (2 of 10). 30+20+12+3+2 = 67.)
- Transparency & trust, Enable Banking +13: BankMCP 50 (MIT, source public (30). The README and site say what is stored (consents, account ids, watches, hashed tokens) and that balances and transactions aren't, and that data passes through Enable Banking (25 of 30). No deprecation policy for a 0.1 project (3 of 20). The README says it sends no telemetry (20). 30 + 25 + 3 + 20 = 78.); Enable Banking 63 (Closed service. The footer links Terms of Service, but the page renders only with JavaScript and couldn't be read; samples are Apache-2.0 (8 of 30). The FAQ says Enable Banking doesn't store, cache or process account data except to deliver it to the authorised application, and the operational risk page says the same. The privacy notice (17 March 2025, Enable Banking Oy, company ID 2988499-7) covers the website and Control Panel and says that personal data is retained indefinitely. No DPA or retention period for API session data was found (15 of 30). Dated deprecations in the changelog, such as the UI widgets moving origin with a January 2027 timeline, and api.tilisy.com marked deprecated, with no stated notice period (15 of 20). The privacy notice names eight service providers with their processing locations, and the operational risk page says API infrastructure runs in GCP europe-west1, europe-west4 and europe-north1 with backups on AWS. There's no sub-processor list for account data processed through the API (15 of 20). Regulatory standing counts here as an addition to the checklist (+5 for a named regulator with a register number, +3 for a named regulator alone). The site says Enable Banking is a registered AISP supervised by the Finnish FIN-FSA, with no register number we could read (+3). 8+15+15+15+3 = 56.)