# BankMCP vs Yapily (slim)

> BankMCP scores 67.1 (B) to Yapily's 55.1 (C) for bank account data. Prices, MCP, x402, uptime and agent notes side by side.

- Full: https://www.anchorterminal.com/compare/bankmcp-vs-yapily.md (~4,550 tokens) · this version ~2,730 tokens · JSON https://www.anchorterminal.com/compare/bankmcp-vs-yapily.json · canonical https://www.anchorterminal.com/compare/bankmcp-vs-yapily
- Index: https://www.anchorterminal.com/llms.txt · API: https://www.anchorterminal.com/api/v1/index.json · MCP: https://www.anchorterminal.com/mcp · Updated: 2026-11-07
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)

BankMCP scores 67.1 (B) on agent readiness against Yapily's 55.1 (C), and leads in 4 of 7 scored categories. Yapily leads on schema & documentation, agent ergonomics and transparency & trust. Both do bank account data.

- BankMCP: B 67.1, rank #339 of 1486 · https://www.anchorterminal.com/tools/bankmcp.min.md
- Yapily: C 55.1, rank #878 of 1486 · https://www.anchorterminal.com/tools/yapily.min.md
- BankMCP, good for A person who wants their own assistant to answer questions about their own European bank accounts. Ahead on Reliability, 63 against 55; Security & auth, 69 against 37; Payments & pricing, 60 against 10; Maintenance & community, 80 against 67. Also Runs on your own machine; Open source; No incidents deducted, where Yapily loses 3 points for them.
- Yapily, good for UK and EEA data and payments from one API, for builders who want docs an agent can read in one fetch. Ahead on Schema & documentation, 88 against 75; Agent ergonomics, 77 against 70; Transparency & trust, 76 against 50. Also A hosted endpoint, with nothing to install.

| Category | BankMCP | Yapily |
| --- | --- | --- |
| Reliability (16%) | 63 | 55 |
| Performance (10%) | pending | pending |
| Schema & documentation (13%) | 75 | 88 |
| Agent ergonomics (13%) | 70 | 77 |
| Security & auth (14%) | 69 | 37 |
| Payments & pricing (10%) | 60 | 10 |
| Task success (10%) | pending | pending |
| Maintenance & community (7%) | 80 | 67 |
| Transparency & trust (7%) | 50 | 76 |

| Fact (where they differ) | BankMCP | Yapily |
| --- | --- | --- |
| Kind | MCP server | HTTP API |
| Vendor | noskillish (open-source project) | Yapily |
| Hosted endpoint | no (local only) | `https://api.yapily.com` |
| Transports | stdio, Streamable HTTP | HTTP, Streamable HTTP |
| Auth | OAuth | API key |
| Pricing | Free | Paid |
| Licence | MIT | MIT (SDKs) |
| Tools exposed | 15 | none |
| Read-only variant documented | yes | no |
| MCP registry | `io.github.noskillish/bankmcp` | not listed |
| Last release | 2026-09-28 | 2025-06-30 |
| Terms last updated | no document linked | 2022-12-05 |
| Privacy policy last updated | no document linked | no date given |
| Customer content may train models | not read yet | yes |
| Terms restrict automated access | not read yet | not found in the text |
| Terms restrict benchmarking | not read yet | not found in the text |
| Terms or service can change without notice | not read yet | not found in the text |
| Arbitration or class-action waiver | not read yet | not found in the text |
| Popularity | 308 stars, 195 npm/wk | 14 stars, 50 npm/wk |
| Agent reviews | none | 2.5/5 (2) |

Why the edge:
- Payments & pricing, BankMCP +50: BankMCP 60 (Free software you run yourself with nothing to buy, by the self-hosted rule (20 + 20 + 20). No payment protocol (0). Enable Banking registration is free for the owner's own accounts, per the project's site. 60.); Yapily 10 (No x402, MPP or L402 (0). Pricing is tailored with a contact form (0). A free, self-serve Console account with the Modelo sandbox bank and no card mentioned; no free live tier (10 of 20). A person signs up in the Console (0). 0 + 0 + 10 + 0 = 10.)
- Security & auth, BankMCP +32: BankMCP 69 (Hosted mode is an OAuth 2.1 server with PKCE, dynamic registration limited to known client redirect hosts, hashed tokens, lockouts and an attestation-only grant; local mode trusts whoever can run processes on the machine (24 of 30). Read-only with no payment tools, attestation off by default and watch notifications fixed to the operator's webhook (18 of 20). Server instructions tell the assistant to treat payee text as data (12 of 15). Every successful sign-in is logged and can be sent to the operator; tool calls aren't logged per call (7 of 15). SECURITY.md with private GitHub reporting; no bounty or audit (8 of 20). 24 + 18 + 12 + 7 + 8 = 69.); Yapily 37 (HTTP basic auth with an application id and secret, one pair per application, and a secret can be revoked and regenerated with the id unchanged; no scopes or permissions per application found (20 of 30). Consents are per account-auth-request and cover the scopes asked for, but revocation happens only at the bank and one application secret can call data and payments (10 of 20). Returns bank records with merchant-written descriptions; no guidance on treating them as untrusted (7 of 15). No operator request log found (0 of 15). No security.txt on www.yapily.com (still 404 on 4 November), /security returns 404, and no disclosure policy, bug bounty or certification found (0 of 20). 20 + 10 + 7 + 0 + 0 = 37.)
- Transparency & trust, Yapily +26: BankMCP 50 (MIT, source public (30). The README and site say what is stored (consents, account ids, watches, hashed tokens) and that balances and transactions aren't, and that data passes through Enable Banking (25 of 30). No deprecation policy for a 0.1 project (3 of 20). The README says it sends no telemetry (20). 30 + 25 + 3 + 20 = 78.); Yapily 76 (Closed service with published website terms, end-user terms and a Data Handling Agreement. The Node SDK repo carries an MIT LICENCE while its package.json says `Unlicense` (15). Privacy notice, Data Handling Agreement and a subprocessor list are all public; no retention periods found on the pages we read (20 of 30). Breaking changes are flagged in the changelog, such as legacy Cajasur consents invalidated in June 2026, and deprecated endpoints are marked, but the categorisation feature's deprecation says Date TBC and there's no notice-period policy (10 of 20). Ten subprocessors with locations, dated 01/10/2026, including Google Cloud in London with backup in Belgium and two US processors under standard contractual terms (20). Regulatory standing counts here as an addition to the checklist (+5 for a named regulator with a register number, +3 for a named regulator alone). The legal page, re-read on 4 November, says Yapily Connect Ltd is FCA-regulated under 827001 and Yapily Connect UAB by the Bank of Lithuania under LB002045, while Yapily Ltd, the contracting parent, isn't regulated (+5). 15 + 20 + 10 + 20 + 5 = 70.)
- Schema & documentation, Yapily +13: BankMCP 75 (All 15 tools have typed zod input schemas (25). bankmcp.dk serves llms.txt, and the README documents each tool (10). Descriptions say what each tool returns and how to chain them, such as passing the exact bank `name` to `start_consent` (15 of 20). Typed inputs with lengths and optional filters (12 of 15). README examples and prompts; errors come back as plain text that says what to do, without a documented catalogue (8 of 15). Version tags and GitHub releases, no changelog (5 of 15). 25 + 10 + 15 + 12 + 8 + 5 = 75.); Yapily 88 (OpenAPI file at docs.yapily.com/openapi-converted.json, per the 30 September check (25). llms.txt (353 lines, re-read on 4 November), llms-full.txt and a docs MCP server (10). Reference pages state purpose; deprecated endpoints are marked, such as Get Categorised Transactions (15 of 20). Typed inputs with limits, for example transactions limit between 1 and 1000 and a sort enum, in the spec-generated SDK (12 of 15). The errors page documents two error formats with tracingId, source (USER, INSTITUTION or YAPILY) and nine HTTP statuses (14 of 15). A changelog with entries every month to October 2026 and an RSS feed with publication dates and breaking changes flagged; no versioning policy page found (12 of 15). 25 + 10 + 15 + 12 + 14 + 12 = 88.)
- Maintenance & community, BankMCP +13: BankMCP 80 (Newest tag v0.1.15 on 28 September 2026, 39 days ago, and npm 0.1.14 on 16 September (20). Sixteen tags from 8 to 28 September (20). Pull requests from outside contributors were merged on 22 October and the one issue we read was fixed (18 of 25). In the official MCP registry as `io.github.noskillish/bankmcp` (15). CI on push, current MCP SDK, but the published package lags the repository (7 of 10). 20 + 20 + 18 + 15 + 7 = 80.); Yapily 67 (The changelog's RSS feed dates its newest entries 28 October 2026 (Santander Germany for AIS and PIS), 27 October (Italian PIS upgraded) and 12 October (German Volksbanken institution changes) (30). Thirteen dated feed entries from 19 August to 28 October, including a new endpoint for extending commercial VRP consents in September (20). Closed service with a public changelog and support; GitHub issue replies weren't sampled (12 of 15). The Node SDK's newest tag is 1.259.0 from January 2022, though the code was regenerated on 30 June 2025, and the Python SDK's last commit is from November 2022, both confirmed in clones on 4 November (3 of 15). No CI workflow in the Node SDK repo (2 of 10). 30 + 20 + 12 + 3 + 2 = 67.)
- Reliability, BankMCP +8: BankMCP 63 (Read with the local-software lines. Installs from npm as `bankmcp` with Node 24 or later stated (20). CI runs typecheck and tests on every push and pull request, with 12 test files; we didn't see the run results (18 of 25). Few issues, and the one we saw (scoping OAuth tokens for attestation) was fixed by a merged pull request on 22 October (20 of 25). Tags follow 0.1.x, but there is no changelog file and npm's latest (0.1.14) lags the newest tag (0.1.15) (5 of 15). Pre-1.0 (0). 20 + 18 + 20 + 5 + 0 = 63.); Yapily 55 (status.yapily.com now runs on incident.io with components for the API Platform, Payments, Account Information, Data, Data Plus, Validate, Yapily Connect and the Console, read on 4 November from the page, its RSS feed and the incident pages (20). In the 90 days from 6 August, one major, a full outage of the API Platform, Payments and Account Information on 20 October from 06:05 to 07:53 UTC, with some API requests failing again after a first fix and a fix deployed by 08:59 UTC, traced to the cloud infrastructure provider, with a published write-up. The rest touched one product or one group of calls, which we read as partial: Payments on 17 August (10:32 to 12:10 UTC), GET Users on 7 October, Verification of Payee on 2 November (18:34 to 20:21 UTC), the GET Transactions total count on 2 November, and two Console incidents (2 and 9 October). One major outage (10 of 30). No rate limit numbers published; the errors page documents a 429 with code 10002 for the banks' unattended limit (3 of 15). The errors page gives a Fibonacci backoff for polling (1, 1, 2, 3, 5, 8, 13, 21 and 34 seconds) and says to wait on 10002, and the payment execution guide covers idempotency keys (12 of 15). No SLA found (0). Generally available (10). 20 + 10 + 3 + 12 + 0 + 10 = 55.)