# BankMCP vs Flinks (slim)

> BankMCP scores 67.1 (B) to Flinks's 54.4 (C) for bank account data. Prices, MCP, x402, uptime and agent notes side by side.

- Full: https://www.anchorterminal.com/compare/bankmcp-vs-flinks.md (~4,850 tokens) · this version ~2,930 tokens · JSON https://www.anchorterminal.com/compare/bankmcp-vs-flinks.json · canonical https://www.anchorterminal.com/compare/bankmcp-vs-flinks
- Index: https://www.anchorterminal.com/llms.txt · API: https://www.anchorterminal.com/api/v1/index.json · MCP: https://www.anchorterminal.com/mcp · Updated: 2026-11-07
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)

BankMCP scores 67.1 (B) on agent readiness against Flinks's 54.4 (C), and leads in 5 of 7 scored categories. Flinks leads on schema & documentation and transparency & trust. Both do bank account data.

- BankMCP: B 67.1, rank #339 of 1486 · https://www.anchorterminal.com/tools/bankmcp.min.md
- Flinks: C 54.4, rank #908 of 1486 · https://www.anchorterminal.com/tools/flinks.min.md
- BankMCP, good for A person who wants their own assistant to answer questions about their own European bank accounts. Ahead on Agent ergonomics, 70 against 54; Security & auth, 69 against 50; Payments & pricing, 60 against 25; Maintenance & community, 80 against 31. Also Runs on your own machine; Open source.
- Flinks, good for A lender or fintech with steady volume that needs Canadian bank data, income and lending attributes, PDF statements or Canadian bank payments. Ahead on Schema & documentation, 83 against 75; Transparency & trust, 61 against 50.

| Category | BankMCP | Flinks |
| --- | --- | --- |
| Reliability (16%) | 63 | 61 |
| Performance (10%) | pending | pending |
| Schema & documentation (13%) | 75 | 83 |
| Agent ergonomics (13%) | 70 | 54 |
| Security & auth (14%) | 69 | 50 |
| Payments & pricing (10%) | 60 | 25 |
| Task success (10%) | pending | pending |
| Maintenance & community (7%) | 80 | 31 |
| Transparency & trust (7%) | 50 | 61 |

| Fact (where they differ) | BankMCP | Flinks |
| --- | --- | --- |
| Kind | MCP server | HTTP API |
| Vendor | noskillish (open-source project) | Flinks Technology Inc. (National Bank of Canada) |
| Transports | stdio, Streamable HTTP | HTTP |
| Auth | OAuth | API key |
| Pricing | Free | Paid |
| Licence | MIT | Proprietary service under Flinks' Master Terms and Conditions. No open-source SDK or repository was found |
| Tools exposed | 15 | none |
| MCP registry | `io.github.noskillish/bankmcp` | not listed |
| Last release | 2026-09-28 | 2026-10-01 |
| Terms last updated | no document linked | 2023-08-03 |
| Privacy policy last updated | no document linked | 2022-09-22 |
| Customer content may train models | not read yet | not found in the text |
| Terms restrict automated access | not read yet | not found in the text |
| Terms restrict benchmarking | not read yet | not found in the text |
| Terms or service can change without notice | not read yet | yes |
| Arbitration or class-action waiver | not read yet | not found in the text |
| Popularity | 308 stars, 195 npm/wk | none |

Why the edge:
- Maintenance & community, BankMCP +49: BankMCP 80 (Newest tag v0.1.15 on 28 September 2026, 39 days ago, and npm 0.1.14 on 16 September (20). Sixteen tags from 8 to 28 September (20). Pull requests from outside contributors were merged on 22 October and the one issue we read was fixed (18 of 25). In the official MCP registry as `io.github.noskillish/bankmcp` (15). CI on push, current MCP SDK, but the published package lags the repository (7 of 10). 20 + 20 + 18 + 15 + 7 = 80.); Flinks 31 (The newest changelog entry is dated 1 October 2026 (the September summary, with API changes such as an optional payer address for G-EFT and new reversal categories in Enrich), 34 days before the check (20 of 30). Two dated entries fall in the 90 days from 6 August, on 1 September and 1 October, and the 1 September entry covers only Upload's Dashboard display and Dashboard reports, so the line for three is not met (0). Closed service with a monthly changelog and a support portal for tickets. Response times were not sampled (8 of 15). No official SDK or package was found. We give 3 of 15 for the current skill file and documentation MCP server, a departure from the checklist. No public package or CI to assess (0 of 10). Total 31.)
- Payments & pricing, BankMCP +35: BankMCP 60 (Free software you run yourself with nothing to buy, by the self-hosted rule (20 + 20 + 20). No payment protocol (0). Enable Banking registration is free for the owner's own accounts, per the project's site. 60.); Flinks 25 (No x402, MPP or L402 (0). Plan prices are public with included volumes, from $500 a month for 200 connections. Overage rates sit in the contract and the currency is not stated (10 of 20). The Toolbox sandbox is free with no card. There is no free live tier or self-serve trial (10 of 20). Sandbox keys are published in the docs, so an agent can make test calls with no signup. Live access needs a sales contract with a one-year term (5 of 20). Per the 8 October check, not re-read on 4 November.)
- Security & auth, BankMCP +19: BankMCP 69 (Hosted mode is an OAuth 2.1 server with PKCE, dynamic registration limited to known client redirect hosts, hashed tokens, lockouts and an attestation-only grant; local mode trusts whoever can run processes on the machine (24 of 30). Read-only with no payment tools, attestation off by default and watch notifications fixed to the operator's webhook (18 of 20). Server instructions tell the assistant to treat payee text as data (12 of 15). Every successful sign-in is logged and can be sent to the operator; tool calls aren't logged per call (7 of 15). SECURITY.md with private GitHub reporting; no bounty or audit (8 of 20). 24 + 18 + 12 + 7 + 8 = 69.); Flinks 50 (A secret key and an `x-api-key`, both issued by Flinks, neither expiring, with no scopes and no documented rotation for the Connect API. The authorise token is single-use and lasts 15 minutes. Outbound has an endpoint to regenerate a client secret. A partner access token travels in the URL path of `/partneraccess/{accesstoken}`, which is not a query string, so no deduction (14 of 30). The Connect data API reads bank data and cannot move money. Flinks Pay has its own authorisation. `/DeleteCard` deletes a connection's data with no confirmation step, and credential-based connections mean Flinks stores bank logins (10 of 20). Responses carry bank-written transaction descriptions, and no guidance on treating them as untrusted was found (7 of 15). The Dashboard's Request Feed lists every request with status, `requestId` and `loginId`, with roles, 2FA and IP allow-listing for staff. No API audit log was found (8 of 15). SOC 2 Type II is stated with the report on request, the Master Terms commit to ISO 27001 audit reports, and the security page gives a reporting address for vulnerabilities. No security.txt or bug bounty was found (11 of 20). On 4 November the docs security page states SOC 2 Type II with annual audits and the report on request, www.flinks.com/security links vulnerability reports to security@flinks.io and SOC 2 report requests to security@flinks.com (the 8 October check recorded the second as the vulnerability route), and security.txt answers 404.)
- Agent ergonomics, BankMCP +16: BankMCP 70 (15 compact tools, plus an attestation-only tool set for a `bank:attest` grant (18 of 25). Transactions are paged through Enable Banking's continuation key with a page cap, and `search_transactions` and `monthly_summary` cut output (16 of 20). Errors explain the fix, such as sending the owner to the setup page (14 of 20). Reads are safe to repeat and there are no payment tools, but no readOnlyHint or other annotations (10 of 20). One `npx` line for local use, sensible defaults such as the configured country; hosting needs an Enable Banking key and a password (12 of 15). 18 + 16 + 14 + 10 + 12 = 70.); Flinks 54 (`WithTransactions`, `WithKYC`, `AccountsFilter` and `DaysOfTransactions` trim a response, and `/GetAccountsSummary` is a lighter call. No field selection was found (16 of 25). `/GetAccountsDetail` returns up to 365 days of transactions in one payload with no pagination. `/Institutions` takes `skip` and `take`, and the Outbound FDX paths take `offset`, `limit` and time filters (10 of 20). The error page lists 29 codes with a description and a way to reproduce each, though most sit under HTTP 401, the rate-limit code among them (14 of 20). No idempotency keys were found. Cached-mode reads can be repeated, and a completing call consumes the `requestId` (8 of 20). `RequestId` is the only required body field and defaults are stated, but a first read takes three calls plus a widget session and no official SDK was found (6 of 15). Per the 8 October check, not re-read on 4 November.)
- Transparency & trust, Flinks +11: BankMCP 50 (MIT, source public (30). The README and site say what is stored (consents, account ids, watches, hashed tokens) and that balances and transactions aren't, and that data passes through Enable Banking (25 of 30). No deprecation policy for a 0.1 project (3 of 20). The README says it sends no telemetry (20). 30 + 25 + 3 + 20 = 78.); Flinks 61 (Closed service with public Master Terms dated 3 August 2023 and service schedules. The terms say Flinks may modify them without prior notice (15 of 30). The Services Privacy Statement of 19 April 2024 says data is kept as long as needed for the client's service, the docs say a connection's data is kept until `/DeleteCard` is called, and the terms say end-customer data is deleted in the normal course after termination. No fixed retention periods and no public DPA were found (16 of 30). No deprecation policy was found. The changelog notes that the Pay V1 endpoint stays supported, and the terms let Flinks remove any data source at its discretion (5 of 20). Instances are hosted per country so data stays in Canada or the US, the security page names Microsoft Azure and Google Cloud, and the privacy statement lists most other service providers by category only (12 of 20). Regulatory standing counts here as an addition to the checklist (+5 for a named regulator with a register number, +3 for a named regulator alone). The privacy statement says Flinks reports suspicious Flinks Pay transactions to FINTRAC, and no registration number was found (+0). The Master Terms re-read on 4 November still carry the 3 August 2023 date and the modification clause.)
- Schema & documentation, Flinks +8: BankMCP 75 (All 15 tools have typed zod input schemas (25). bankmcp.dk serves llms.txt, and the README documents each tool (10). Descriptions say what each tool returns and how to chain them, such as passing the exact bank `name` to `start_consent` (15 of 20). Typed inputs with lengths and optional filters (12 of 15). README examples and prompts; errors come back as plain text that says what to do, without a documented catalogue (8 of 15). Version tags and GitHub releases, no changelog (5 of 15). 25 + 10 + 15 + 12 + 8 + 5 = 75.); Flinks 83 (Ten OpenAPI 3.0 files are public, 85 operations in all, 34 in the main file. The main file marks `x-api-key` as optional while the authentication guide requires it (23 of 25). llms.txt lists 218 pages with Markdown twins on 4 November, plus a skill file and a documentation MCP server (10). All 34 operations in the main file carry a description, and the guides say when to use cached mode and when not to (14 of 20). Parameters are typed with defaults, the main file has 10 enums, and `SecurityResponses` is a free-form object (10 of 15). The main file has 116 example values and the error page lists codes with how to reproduce each. The spec says the authorise token lasts 30 minutes and the guide says 15 (11 of 15). The version is in the path (v3) and the changelog has monthly entries back to September 2021 (15). The main file re-read on 4 November still holds 34 operations and 10 enums, OpenAPI 3.0.3, version 3.0.0.)