BankMCP vs Salt Edge Account Information

BankMCP 60

Free software you run yourself with nothing to buy, by the self-hosted rule (20 + 20 + 20). No payment protocol (0). Enable Banking registration is free for the owner's own accounts, per the project's site. 60.

Salt Edge Account Information 10

No x402, MPP or L402 (0). No published prices; the product page points to a sales form (0). Free Test status with fake providers and bank sandboxes, no card mentioned; no free live tier (10 of 20). A person signs up in the dashboard and Live needs approval (0).

BankMCP 50

MIT, source public (30). The README and site say what is stored (consents, account ids, watches, hashed tokens) and that balances and transactions aren't, and that data passes through Enable Banking (25 of 30). No deprecation policy for a 0.1 project (3 of 20). The README says it sends no telemetry (20). 30 + 25 + 3 + 20 = 78.

Salt Edge Account Information 82

Closed service under General Terms of Service last revised 14 September 2023 (15). The privacy policy, last revised 14 September 2023, keeps log files at least five years after deletion from production servers and names its processors (20 of 30). The versioning section gives a 12-month window to move off a deprecated version, and the changelog carries dated notices, such as Payment Initiation API V5 deprecated on 2 January 2025 and deleted on 2 January 2026 (20). Processors named with countries, Hetzner in Germany and Finland, AWS in Ireland, SendGrid in the US and Yandex for analytics; EU and EEA data stays in the EU, other data may be accessed from Canada, the UK or Moldova (18 of 20). Regulatory standing counts here as an addition to the checklist (+5 for a named regulator with a register number, +3 for a named regulator alone). Salt Edge Limited is FCA-authorised under 822499 per the 30 September check; the pages we read name no EU authorisation (+5). 15+20+20+18+5 = 78.

BankMCP 69

Hosted mode is an OAuth 2.1 server with PKCE, dynamic registration limited to known client redirect hosts, hashed tokens, lockouts and an attestation-only grant; local mode trusts whoever can run processes on the machine (24 of 30). Read-only with no payment tools, attestation off by default and watch notifications fixed to the operator's webhook (18 of 20). Server instructions tell the assistant to treat payee text as data (12 of 15). Every successful sign-in is logged and can be sent to the operator; tool calls aren't logged per call (7 of 15). SECURITY.md with private GitHub reporting; no bounty or audit (8 of 20). 24 + 18 + 12 + 7 + 8 = 69.

Salt Edge Account Information 51

App-id and Secret headers, and Live applications must also sign each call with a private key over Expires-at, method, URL and body, with Expires-at at most an hour ahead; the docs say to regenerate the key and update the public key after a breach. No scopes on the app credential (24 of 30). Consents carry scopes (holder_info, accounts, transactions) and period_days, PUT /consents/{id}/revoke ends one, and Test and Pending apps can't reach real banks (15 of 20). Returns bank records with merchant-written descriptions; no guidance on treating them as untrusted (7 of 15). No operator request log found (0 of 15). The security page at /company/security says Salt Edge is ISO 27001 certified for developing, managing and providing financial IT services and PCI DSS compliant, runs internal and external penetration tests, and names SOC 2 among its standards. No certificate or report is linked, security.txt answers 404, and no disclosure policy, reporting address or bug bounty was found, so the line takes the value for certifications with no disclosure route (5 of 20). 24+15+7+0+5 = 51.

BankMCP 80

Newest tag v0.1.15 on 28 September 2026, 39 days ago, and npm 0.1.14 on 16 September (20). Sixteen tags from 8 to 28 September (20). Pull requests from outside contributors were merged on 22 October and the one issue we read was fixed (18 of 25). In the official MCP registry as io.github.noskillish/bankmcp (15). CI on push, current MCP SDK, but the published package lags the repository (7 of 10). 20 + 20 + 18 + 15 + 7 = 80.

Salt Edge Account Information 62

The docs changelog at docs.saltedge.com/v6/changelog/ has dated entries, newest 28 October 2026 (error_class and error_message on failed Payments), 8 days before this check (30). Entries on 19 August (VRP consent revoke endpoint), 22 September (partially_executed bulk payment status), 30 September (new transaction categories), 7 October (parallel session limits, documentation only, half) and 28 October fall in the 90 days from 7 August (20). Closed service with a public changelog and RSS feed, support through a project manager and a 24/7 incident reporting channel for clients (12 of 15). No official SDKs (0). No package to judge (0). 30+20+12+0+0 = 62.

BankMCP 63

Read with the local-software lines. Installs from npm as bankmcp with Node 24 or later stated (20). CI runs typecheck and tests on every push and pull request, with 12 test files; we didn't see the run results (18 of 25). Few issues, and the one we saw (scoping OAuth tokens for attestation) was fixed by a merged pull request on 22 October (20 of 25). Tags follow 0.1.x, but there is no changelog file and npm's latest (0.1.14) lags the newest tag (0.1.15) (5 of 15). Pre-1.0 (0). 20 + 18 + 20 + 5 + 0 = 63.

Salt Edge Account Information 57

Status page at saltedgestatus.com with components for the Account Information API, Payments API and Partners API under Open Banking Gateway, among others (20). Its history.atom feed, read on 5 November, holds four incidents in the 90 days from 7 August. On 21 August a data centre network issue made every component unavailable from 09:27 to 09:37 UTC, marked critical, a full outage and so a major. The others were partial, a five-minute interruption for some customers on 29 September, a Revolut-side outage on 20 October and four minutes of degraded Payments API availability on 4 November. One major (10). Per-second limits are published for the reference endpoints, 10 a second on providers, countries, rates and categories and 5 on POST merchants and categories/learn, and since 7 October the docs give a default of 10 parallel Widget sessions (15). Requests over the per-second limits get 429 and parallel sessions over the limit get HTTP 406 RateLimitExceeded, with no Retry-After, backoff or idempotency guidance (2 of 15, an earlier partial kept). No SLA found (0). API v6 generally available (10). 20+10+15+2+0+10 = 57.