BankMCP vs MX Platform API

BankMCP 60

Free software you run yourself with nothing to buy, by the self-hosted rule (20 + 20 + 20). No payment protocol (0). Enable Banking registration is free for the owner's own accounts, per the project's site. 60.

MX Platform API 15

No x402, MPP or L402 (0). No prices anywhere on mx.com. /pricing/ returns 404 and product pages ask for a demo (0). Developer keys are free and reach the integration environment with up to 100 users. The sign-up form is drawn by script, so we could not confirm that it asks for no card (15 of 20). A person signs up in a browser, verifies an email address, allowlists an IP and asks MX for production keys (0).

BankMCP 63

Read with the local-software lines. Installs from npm as bankmcp with Node 24 or later stated (20). CI runs typecheck and tests on every push and pull request, with 12 test files; we didn't see the run results (18 of 25). Few issues, and the one we saw (scoping OAuth tokens for attestation) was fixed by a merged pull request on 22 October (20 of 25). Tags follow 0.1.x, but there is no changelog file and npm's latest (0.1.14) lags the newest tag (0.1.15) (5 of 15). Pre-1.0 (0). 20 + 18 + 20 + 5 + 0 = 63.

MX Platform API 77

Graded as a hosted API. status.mx.com, now on incident.io, lists 15 components, the Platform API among them, with history and an RSS feed (20). From 4 August to 2 November 2026 it posts three incidents. Its incident history starts on 17 August, after the move, and its 90-day uptime chart from 4 August shows every component operational from 4 to 15 August, with maintenance on 16 August. On 2 October an incident posted from 20:49 to 21:26 UTC recorded every component as a partial outage for 30 minutes, and the resolution says it hit "some of our overall traffic" with elevated errors and latency. On 14 October Instant Account Verification had intermittent failures, a partial outage for 67 minutes and degraded performance for three hours after. On 21 August some customers couldn't load Customer Analytics dashboards. Each hit a share of traffic or one product, so minor only (20). The 1 August incident (about 89 minutes) has left the window, and the earlier reading of it came from the status page's JSON API, which this run doesn't use. Rate limits published per method and environment, 2,000 GET and 750 POST a second in production (15). A 429 has no Retry-After, but the docs say limits reset each second and ask for exponential backoff, and a client-set id is documented as the way to create a resource only once, answering 409 on a repeat, safe-retry guidance without an idempotency key (12 of 15). No SLA found (0). The Platform API is generally available at v20260929 (10). 20 + 20 + 15 + 12 + 0 + 10 = 77.

BankMCP 50

MIT, source public (30). The README and site say what is stored (consents, account ids, watches, hashed tokens) and that balances and transactions aren't, and that data passes through Enable Banking (25 of 30). No deprecation policy for a 0.1 project (3 of 20). The README says it sends no telemetry (20). 30 + 25 + 3 + 20 = 78.

MX Platform API 64

Closed service. The only terms on mx.com are an end-user Terms of Use dated 15 January 2020, and the agreement a client signs is not public. SDKs and OpenAPI files are MIT (8 of 30). The privacy statement of 30 September 2025 says it does not cover data MX processes for clients. The trust page says all data is hosted in US data centres, and the API docs say deleted objects are purged after about two weeks. No DPA or retention schedule is public (10 of 30). Written version policy with 18 months of support and 12 of deprecation, plus a deprecations page with dates and RFC 9745 and RFC 8594 headers (20). US-only hosting is stated on the trust page (confirmed on 2 November), and Akamai was named for DDoS scrubbing per the 8 October check (not found on the trust page on 2 November). No sub-processor list found (8 of 20).

BankMCP 75

All 15 tools have typed zod input schemas (25). bankmcp.dk serves llms.txt, and the README documents each tool (10). Descriptions say what each tool returns and how to chain them, such as passing the exact bank name to start_consent (15 of 20). Typed inputs with lengths and optional filters (12 of 15). README examples and prompts; errors come back as plain text that says what to do, without a documented catalogue (8 of 15). Version tags and GitHub releases, no changelog (5 of 15). 25 + 10 + 15 + 12 + 8 + 5 = 75.

MX Platform API 85

OpenAPI 3.0 files for v20260929, v20250224 and v20111101 are linked from llms.txt. The current one has 135 paths and 183 operations on 2 November (133 and 181 on 8 October), still with nine deprecated operations (25). llms.txt and a Markdown twin of each page (10). Descriptions say what each endpoint does, and the nine deprecated operations name their replacements, with little guidance on when not to call one (15 of 20). Parameters are typed, with 53 enums, but use_case is a plain string and metadata a free string (10 of 15). The file carries 938 examples but lists only 2xx responses, so error shapes live on the Errors page alone (10 of 15). Dated versions set by Accept-Version, an upgrade guide and a dated changelog (15).

BankMCP 69

Hosted mode is an OAuth 2.1 server with PKCE, dynamic registration limited to known client redirect hosts, hashed tokens, lockouts and an attestation-only grant; local mode trusts whoever can run processes on the machine (24 of 30). Read-only with no payment tools, attestation off by default and watch notifications fixed to the operator's webhook (18 of 20). Server instructions tell the assistant to treat payee text as data (12 of 15). Every successful sign-in is logged and can be sent to the operator; tool calls aren't logged per call (7 of 15). SECURITY.md with private GitHub reporting; no bounty or audit (8 of 20). 24 + 18 + 12 + 7 + 8 = 69.

MX Platform API 60

Basic auth with a client_id and api_key in a header, never in the URL. Development and production keys are separate, rotation keeps the old key alive for 30 days, every calling IP must be allowlisted, and mutual TLS is optional. No scopes (22 of 30). No read-only key and no confirmation on deletes. data_request.products limits what a member aggregates, and deleted members sit soft-deleted for about two weeks (6 of 20). Responses carry bank-written text, and the docs warn that strings can hold characters such as < and ask clients to sanitise before display, with nothing on model input (6 of 15). Client Dashboard logs show request and response payloads for seven days in production, with a per-user lookup (11 of 15). Signed security.txt valid to 31 December 2030, SOC 2 Type II and PCI DSS named on the trust page, a public SOC 3 report, no bug bounty found, all confirmed on 2 November (15 of 20).

BankMCP 80

Newest tag v0.1.15 on 28 September 2026, 39 days ago, and npm 0.1.14 on 16 September (20). Sixteen tags from 8 to 28 September (20). Pull requests from outside contributors were merged on 22 October and the one issue we read was fixed (18 of 25). In the official MCP registry as io.github.noskillish/bankmcp (15). CI on push, current MCP SDK, but the published package lags the repository (7 of 10). 20 + 20 + 18 + 15 + 7 = 80.

MX Platform API 71

v20260929 was released on 29 September 2026, and its OpenAPI file was replaced on 28 October 2026 by its Last-Modified header, with 135 paths against 133 on 8 October, so a published API change sits within 30 days (30). Four dated changelog entries in the last 90 days, on 24 August and 3, 16 and 29 September (20); none since. A dated changelog and a support desk that states a first reply within about 24 business hours. On GitHub, issues on mx-platform-node, mx-platform-java and openapi sat open for months or years with no reply, per the 8 October check, not re-read on 2 November (8 of 15). Five official SDKs, last released 29 January to 18 February 2026 (tags confirmed on 2 November), and the public mxenabled/openapi repository has no v20260929 file (8 of 15). The Node SDK has generate, test and publish workflows. Dependency pull requests on the Java SDK have been open since 2023, per the 8 October check (5 of 10). 30 + 20 + 8 + 8 + 5 = 71.