BankMCP vs Yapily

BankMCP 60

Free software you run yourself with nothing to buy, by the self-hosted rule (20 + 20 + 20). No payment protocol (0). Enable Banking registration is free for the owner's own accounts, per the project's site. 60.

Yapily 10

No x402, MPP or L402 (0). Pricing is tailored with a contact form (0). A free, self-serve Console account with the Modelo sandbox bank and no card mentioned; no free live tier (10 of 20). A person signs up in the Console (0). 0 + 0 + 10 + 0 = 10.

BankMCP 69

Hosted mode is an OAuth 2.1 server with PKCE, dynamic registration limited to known client redirect hosts, hashed tokens, lockouts and an attestation-only grant; local mode trusts whoever can run processes on the machine (24 of 30). Read-only with no payment tools, attestation off by default and watch notifications fixed to the operator's webhook (18 of 20). Server instructions tell the assistant to treat payee text as data (12 of 15). Every successful sign-in is logged and can be sent to the operator; tool calls aren't logged per call (7 of 15). SECURITY.md with private GitHub reporting; no bounty or audit (8 of 20). 24 + 18 + 12 + 7 + 8 = 69.

Yapily 37

HTTP basic auth with an application id and secret, one pair per application, and a secret can be revoked and regenerated with the id unchanged; no scopes or permissions per application found (20 of 30). Consents are per account-auth-request and cover the scopes asked for, but revocation happens only at the bank and one application secret can call data and payments (10 of 20). Returns bank records with merchant-written descriptions; no guidance on treating them as untrusted (7 of 15). No operator request log found (0 of 15). No security.txt on www.yapily.com (still 404 on 4 November), /security returns 404, and no disclosure policy, bug bounty or certification found (0 of 20). 20 + 10 + 7 + 0 + 0 = 37.

BankMCP 50

MIT, source public (30). The README and site say what is stored (consents, account ids, watches, hashed tokens) and that balances and transactions aren't, and that data passes through Enable Banking (25 of 30). No deprecation policy for a 0.1 project (3 of 20). The README says it sends no telemetry (20). 30 + 25 + 3 + 20 = 78.

Yapily 76

Closed service with published website terms, end-user terms and a Data Handling Agreement. The Node SDK repo carries an MIT LICENCE while its package.json says Unlicense (15). Privacy notice, Data Handling Agreement and a subprocessor list are all public; no retention periods found on the pages we read (20 of 30). Breaking changes are flagged in the changelog, such as legacy Cajasur consents invalidated in June 2026, and deprecated endpoints are marked, but the categorisation feature's deprecation says Date TBC and there's no notice-period policy (10 of 20). Ten subprocessors with locations, dated 01/10/2026, including Google Cloud in London with backup in Belgium and two US processors under standard contractual terms (20). Regulatory standing counts here as an addition to the checklist (+5 for a named regulator with a register number, +3 for a named regulator alone). The legal page, re-read on 4 November, says Yapily Connect Ltd is FCA-regulated under 827001 and Yapily Connect UAB by the Bank of Lithuania under LB002045, while Yapily Ltd, the contracting parent, isn't regulated (+5). 15 + 20 + 10 + 20 + 5 = 70.

BankMCP 75

All 15 tools have typed zod input schemas (25). bankmcp.dk serves llms.txt, and the README documents each tool (10). Descriptions say what each tool returns and how to chain them, such as passing the exact bank name to start_consent (15 of 20). Typed inputs with lengths and optional filters (12 of 15). README examples and prompts; errors come back as plain text that says what to do, without a documented catalogue (8 of 15). Version tags and GitHub releases, no changelog (5 of 15). 25 + 10 + 15 + 12 + 8 + 5 = 75.

Yapily 88

OpenAPI file at docs.yapily.com/openapi-converted.json, per the 30 September check (25). llms.txt (353 lines, re-read on 4 November), llms-full.txt and a docs MCP server (10). Reference pages state purpose; deprecated endpoints are marked, such as Get Categorised Transactions (15 of 20). Typed inputs with limits, for example transactions limit between 1 and 1000 and a sort enum, in the spec-generated SDK (12 of 15). The errors page documents two error formats with tracingId, source (USER, INSTITUTION or YAPILY) and nine HTTP statuses (14 of 15). A changelog with entries every month to October 2026 and an RSS feed with publication dates and breaking changes flagged; no versioning policy page found (12 of 15). 25 + 10 + 15 + 12 + 14 + 12 = 88.

BankMCP 80

Newest tag v0.1.15 on 28 September 2026, 39 days ago, and npm 0.1.14 on 16 September (20). Sixteen tags from 8 to 28 September (20). Pull requests from outside contributors were merged on 22 October and the one issue we read was fixed (18 of 25). In the official MCP registry as io.github.noskillish/bankmcp (15). CI on push, current MCP SDK, but the published package lags the repository (7 of 10). 20 + 20 + 18 + 15 + 7 = 80.

Yapily 67

The changelog's RSS feed dates its newest entries 28 October 2026 (Santander Germany for AIS and PIS), 27 October (Italian PIS upgraded) and 12 October (German Volksbanken institution changes) (30). Thirteen dated feed entries from 19 August to 28 October, including a new endpoint for extending commercial VRP consents in September (20). Closed service with a public changelog and support; GitHub issue replies weren't sampled (12 of 15). The Node SDK's newest tag is 1.259.0 from January 2022, though the code was regenerated on 30 June 2025, and the Python SDK's last commit is from November 2022, both confirmed in clones on 4 November (3 of 15). No CI workflow in the Node SDK repo (2 of 10). 30 + 20 + 12 + 3 + 2 = 67.

BankMCP 63

Read with the local-software lines. Installs from npm as bankmcp with Node 24 or later stated (20). CI runs typecheck and tests on every push and pull request, with 12 test files; we didn't see the run results (18 of 25). Few issues, and the one we saw (scoping OAuth tokens for attestation) was fixed by a merged pull request on 22 October (20 of 25). Tags follow 0.1.x, but there is no changelog file and npm's latest (0.1.14) lags the newest tag (0.1.15) (5 of 15). Pre-1.0 (0). 20 + 18 + 20 + 5 + 0 = 63.

Yapily 55

status.yapily.com now runs on incident.io with components for the API Platform, Payments, Account Information, Data, Data Plus, Validate, Yapily Connect and the Console, read on 4 November from the page, its RSS feed and the incident pages (20). In the 90 days from 6 August, one major, a full outage of the API Platform, Payments and Account Information on 20 October from 06:05 to 07:53 UTC, with some API requests failing again after a first fix and a fix deployed by 08:59 UTC, traced to the cloud infrastructure provider, with a published write-up. The rest touched one product or one group of calls, which we read as partial: Payments on 17 August (10:32 to 12:10 UTC), GET Users on 7 October, Verification of Payee on 2 November (18:34 to 20:21 UTC), the GET Transactions total count on 2 November, and two Console incidents (2 and 9 October). One major outage (10 of 30). No rate limit numbers published; the errors page documents a 429 with code 10002 for the banks' unattended limit (3 of 15). The errors page gives a Fibonacci backoff for polling (1, 1, 2, 3, 5, 8, 13, 21 and 34 seconds) and says to wait on 10002, and the payment execution guide covers idempotency keys (12 of 15). No SLA found (0). Generally available (10). 20 + 10 + 3 + 12 + 0 + 10 = 55.