BankMCP vs Tink

BankMCP 80

Newest tag v0.1.15 on 28 September 2026, 39 days ago, and npm 0.1.14 on 16 September (20). Sixteen tags from 8 to 28 September (20). Pull requests from outside contributors were merged on 22 October and the one issue we read was fixed (18 of 25). In the official MCP registry as io.github.noskillish/bankmcp (15). CI on push, current MCP SDK, but the published package lags the repository (7 of 10). 20 + 20 + 18 + 15 + 7 = 80.

Tink 26

The changelog's entries were read on 8 October from the content feed its page requests, a site data source this re-check doesn't use, and docs.tink.com now answers robots.txt with its app page, so no changelog date is credited. The newest first-hand dated release is Tink Link for iOS 5.1.0, tagged on 6 May 2026, 180 days before this check (10). No release or dated entry read in the 90 days from 4 August (0). Closed service with a public changelog page whose entries we couldn't read, and support through the Visa Support Hub. Basic Support carries no guaranteed response time, and GitHub issue replies were not sampled (5 of 15). Tink Link for iOS 5.1.0 shipped on 6 May 2026. The Android SDK's newest tag is 3.0.1 from 13 March 2025, with commits to 15 July 2026, and no server-side SDK was found (8 of 15). Neither SDK repository has a public CI workflow (3 of 10).

BankMCP 60

Free software you run yourself with nothing to buy, by the self-hosted rule (20 + 20 + 20). No payment protocol (0). Enable Banking registration is free for the owner's own accounts, per the project's site. 60.

Tink 10

No x402, MPP or L402 (0). The pricing page lists Standard as Contact us and Enterprise as Custom pricing, and the FAQ says there is no pay-per-use option (0). A free, self-serve Console account with sandbox test data and no card mentioned. No free live tier (10 of 20). A person signs up in the Console (0).

BankMCP 50

MIT, source public (30). The README and site say what is stored (consents, account ids, watches, hashed tokens) and that balances and transactions aren't, and that data passes through Enable Banking (25 of 30). No deprecation policy for a 0.1 project (3 of 20). The README says it sends no telemetry (20). 30 + 25 + 3 + 20 = 78.

Tink 81

Closed service with a public Master Service Agreement dated 9 December 2025, governed by Swedish law. The mobile SDKs are MIT (15 of 30). A public DPA, a Privacy and Security Documentation and an end-user privacy notice agree on handling. Customer data is deleted within 30 days of termination and one-time access data after 24 hours. The end-user notice gives no fixed retention periods (24 of 30). The MSA commits to reasonable efforts at 90 days' notice before a product is discontinued. The changelog's dated deprecations, read on 8 October from a content feed, are no longer counted (12 of 20). The sub-processor list of 1 October 2025 names AWS and Google Cloud with EEA processing, and the MSA sets the data region as the EU, EEA and UK (18 of 20). Regulatory standing counts here as an addition to the checklist (+5 for a named regulator with a register number, +3 for a named regulator alone). Tink AB is authorised by the Swedish FSA under 44059 and Tink Financial Services Limited by the FCA under 988456 (+5).

BankMCP 75

All 15 tools have typed zod input schemas (25). bankmcp.dk serves llms.txt, and the README documents each tool (10). Descriptions say what each tool returns and how to chain them, such as passing the exact bank name to start_consent (15 of 20). Typed inputs with lengths and optional filters (12 of 15). README examples and prompts; errors come back as plain text that says what to do, without a documented catalogue (8 of 15). Version tags and GitHub releases, no changelog (5 of 15). 25 + 10 + 15 + 12 + 8 + 5 = 75.

Tink 61

Per the 8 October check, not re-read on 2 November, except where struck. The API reference renders only through a script, and its operation, description and enum counts, read on 8 October from Swagger definitions inside the docs app's JavaScript bundle (a script data source this re-check doesn't use), are struck. No downloadable spec was found, and Postman collections are published per product, as on gocardless-bank-account-data and salt-edge (8 of 25). llms.txt lists about 280 guides, each with a Markdown twin. The API reference is not in it (10). The guides explain what each product does and when to pick one-time or continuous access. The reference's own descriptions weren't read from a page (10 of 20). The guides document query parameters such as pageSize, pageToken and the transaction filters. Types, enums and required fields across the reference weren't read from a page or spec (5 of 15). Guides carry curl requests and JSON responses, and each product has an error page with status and reason tables (13 of 15). The version sits in the path (v1, some v2) and a public changelog is linked from the docs. Its entries were read on 8 October from a content feed the page requests, a source this re-check doesn't use, so no entry count is given (15).

BankMCP 63

Read with the local-software lines. Installs from npm as bankmcp with Node 24 or later stated (20). CI runs typecheck and tests on every push and pull request, with 12 test files; we didn't see the run results (18 of 25). Few issues, and the one we saw (scoping OAuth tokens for attestation) was fixed by a merged pull request on 22 October (20 of 25). Tags follow 0.1.x, but there is no changelog file and npm's latest (0.1.14) lags the newest tag (0.1.15) (5 of 15). Pre-1.0 (0). 20 + 18 + 20 + 5 + 0 = 63.

Tink 72

Graded with the hosted lines. Statuspage at status.tink.com with 14 product components and incident history (20). From 4 August to 2 November 2026 its history lists a 43-minute Payment Initiation incident on 25 September, three Data Enrichment incidents on 6, 7 and 9 October (delays in returning enriched transactions on 9 October), and on 17 October an 80-minute outage of Payment Initiation and Account Check in Austria, Germany, Poland and the Czech Republic. Each hit one or two products, or four markets, so all read as partial and minor. The 16 July critical incident has left the window (20 of 30). Per the 8 October check, not re-read on 2 November, rate limits are stated as per app ID with no numbers (3 of 15), and the reference documents the 429 status and an Idempotency-Key header with 24-hour keys and tells customers to contact support on 429, with no Retry-After or backoff guidance (9 of 15). Published SLAs of 99.7 per cent monthly uptime, a target under Basic Support and a commitment under service levels 1 to 3 (10). The v1 API and the Data v2 accounts and transactions endpoints carry no BETA tag (10).

BankMCP 69

Hosted mode is an OAuth 2.1 server with PKCE, dynamic registration limited to known client redirect hosts, hashed tokens, lockouts and an attestation-only grant; local mode trusts whoever can run processes on the machine (24 of 30). Read-only with no payment tools, attestation off by default and watch notifications fixed to the operator's webhook (18 of 20). Server instructions tell the assistant to treat payee text as data (12 of 15). Every successful sign-in is logged and can be sent to the operator; tool calls aren't logged per call (7 of 15). SECURITY.md with private GitHub reporting; no bounty or audit (8 of 20). 24 + 18 + 12 + 7 + 8 = 69.

Tink 63

OAuth 2.0 client credentials sent in the POST body, scopes named per endpoint, 30-minute client tokens, two-hour user tokens and mutual TLS as an alternative. Secret rotation was not confirmed (27 of 30). Read scopes are separate from write and payment scopes, the account holder consents per bank in Tink Link, and one-time access data is deleted after 24 hours (15 of 20). Responses include bank-written transaction descriptions, and no guidance on treating them as untrusted was found (7 of 15). Every response returns an X-Request-ID and the Console has analytics. No operator audit log was found in the docs (4 of 15). The Privacy and Security Documentation describes controls aligned with ISO/IEC 27002, annual independent audits and penetration tests, and security.txt points to Visa's disclosure policy. No named certificate, bug bounty or security contact was found on the pages read (10 of 20).