BankMCP vs GoCardless Bank Account Data

BankMCP 80

Newest tag v0.1.15 on 28 September 2026, 39 days ago, and npm 0.1.14 on 16 September (20). Sixteen tags from 8 to 28 September (20). Pull requests from outside contributors were merged on 22 October and the one issue we read was fixed (18 of 25). In the official MCP registry as io.github.noskillish/bankmcp (15). CI on push, current MCP SDK, but the published package lags the repository (7 of 10). 20 + 20 + 18 + 15 + 7 = 80.

GoCardless Bank Account Data 3

No changelog and no dated API change found; the last dated public change is the April 2025 notice that the client libraries are no longer maintained (0). No releases or dated entries in the last 90 days (0). Closed service with no public changelog; support goes through GoCardless (3 of 15). Official SDKs unsupported since 7 April 2025 (0). nordigen-node's last tag is v1.1.1 from 11 August 2022 (0).

BankMCP 60

Free software you run yourself with nothing to buy, by the self-hosted rule (20 + 20 + 20). No payment protocol (0). Enable Banking registration is free for the owner's own accounts, per the project's site. 60.

GoCardless Bank Account Data 10

No x402, MPP or L402 (0). No published price; gocardless.com/pricing covers Direct Debit only (0). The sandbox institution SANDBOXFINANCE_SFIN0000 is free and the quickstart sends new users to manage-sandbox.gocardless.com/sign-up, with no card mentioned; the overview says new accounts start non-verified and verification comes with a paid plan, and the Nordigen free plan isn't mentioned (10 of 20). A person signs up in a browser (0).

BankMCP 75

All 15 tools have typed zod input schemas (25). bankmcp.dk serves llms.txt, and the README documents each tool (10). Descriptions say what each tool returns and how to chain them, such as passing the exact bank name to start_consent (15 of 20). Typed inputs with lengths and optional filters (12 of 15). README examples and prompts; errors come back as plain text that says what to do, without a documented catalogue (8 of 15). Version tags and GitHub releases, no changelog (5 of 15). 25 + 10 + 15 + 12 + 8 + 5 = 75.

GoCardless Bank Account Data 54

No public OpenAPI file for this API. docs.gocardless.com/openapi-schema-public.json covers the payments API at api.gocardless.com, the portal's Swagger UI is blocked to crawlers, and there's a Postman collection (8 of 25). docs.gocardless.com/llms.txt exists and lists nine Bank Account Data pages; the listing had none (10). The quickstart and output pages explain each step and field (12 of 20). Input constraints aren't checkable without a spec; the agreement fields and defaults are documented (7 of 15). A statuses and error codes page gives the summary, detail and status_code body and the causes per HTTP status, and the quickstart has request examples (12 of 15). Versioned by path (/api/v2) with no changelog found (5 of 15).

BankMCP 63

Read with the local-software lines. Installs from npm as bankmcp with Node 24 or later stated (20). CI runs typecheck and tests on every push and pull request, with 12 test files; we didn't see the run results (18 of 25). Few issues, and the one we saw (scoping OAuth tokens for attestation) was fixed by a merged pull request on 22 October (20 of 25). Tags follow 0.1.x, but there is no changelog file and npm's latest (0.1.14) lags the newest tag (0.1.15) (5 of 15). Pre-1.0 (0). 20 + 18 + 20 + 5 + 0 = 63.

GoCardless Bank Account Data 44

GoCardless runs a Statuspage at gocardless-status.com, but none of its components covers Bank Account Data (5 of 20). The incident feed runs from 3 February 2025 with 20 incidents and none mentions Bank Account Data, Nordigen, account information or requisitions, so there's no readable history for this product (5). Every response carries rate limit headers with limit, remaining and reset, per client and per account, and the docs say banks cap some accounts at 4 calls a day; the numbers live in headers more than in the docs (12 of 15). A 429 RateLimitError comes with the account reset header saying how long to wait, and the docs say to poll an account until READY; the API is read only, so retries don't double-write (12 of 15). No SLA found (0). Generally available (10).

BankMCP 69

Hosted mode is an OAuth 2.1 server with PKCE, dynamic registration limited to known client redirect hosts, hashed tokens, lockouts and an attestation-only grant; local mode trusts whoever can run processes on the machine (24 of 30). Read-only with no payment tools, attestation off by default and watch notifications fixed to the operator's webhook (18 of 20). Server instructions tell the assistant to treat payee text as data (12 of 15). Every successful sign-in is logged and can be sent to the operator; tool calls aren't logged per call (7 of 15). SECURITY.md with private GitHub reporting; no bounty or audit (8 of 20). 24 + 18 + 12 + 7 + 8 = 69.

GoCardless Bank Account Data 50

A secret_id and secret_key pair from the portal exchanges for a 24-hour access JWT and a 30-day refresh token; no scopes on the developer credential (20 of 30). The API can only read, and each end user agreement limits access_scope to balances, details or transactions and caps history and access days; requisitions can be deleted (15 of 20). Returns bank records with merchant-written descriptions; no guidance on treating them as untrusted (7 of 15). Audit or request logs not found, as the portal blocks crawlers (0 of 15). gocardless.com security.txt names vuln-disc@gocardless.com and a policy but has no Expires field per the 30 September check; no bug bounty or certification found on the pages we read (8 of 20).

BankMCP 70

15 compact tools, plus an attestation-only tool set for a bank:attest grant (18 of 25). Transactions are paged through Enable Banking's continuation key with a page cap, and search_transactions and monthly_summary cut output (16 of 20). Errors explain the fix, such as sending the owner to the setup page (14 of 20). Reads are safe to repeat and there are no payment tools, but no readOnlyHint or other annotations (10 of 20). One npx line for local use, sensible defaults such as the configured country; hosting needs an Enable Banking key and a password (12 of 15). 18 + 16 + 14 + 10 + 12 = 70.

GoCardless Bank Account Data 57

Responses are small JSON objects per account, split into balances, details and transactions; date filters on transactions weren't confirmed on the pages we read (12 of 25). Institutions filter by country; no transaction pagination found (10 of 20). Errors carry summary, detail and status_code, and the docs list each cause by status code and say to use the status for control flow (16 of 20). Read-only calls are safe to repeat; creating a requisition isn't idempotent (12 of 20). The agreement step is optional with 90-day defaults, but the official SDKs have been unsupported since April 2025 (7 of 15).