BankMCP vs Yodlee Core API

BankMCP 63

Read with the local-software lines. Installs from npm as bankmcp with Node 24 or later stated (20). CI runs typecheck and tests on every push and pull request, with 12 test files; we didn't see the run results (18 of 25). Few issues, and the one we saw (scoping OAuth tokens for attestation) was fixed by a merged pull request on 22 October (20 of 25). Tags follow 0.1.x, but there is no changelog file and npm's latest (0.1.14) lags the newest tag (0.1.15) (5 of 15). Pre-1.0 (0). 20 + 18 + 20 + 5 + 0 = 63.

Yodlee Core API 15

Graded as a hosted API. No status page is linked from yodlee.com or the developer portal, and status.yodlee.com did not answer (0). With no incident history to read, 5 of 30. No rate limit with numbers was found in the docs or the Swagger file, which lists no 429 response (0). No 429, backoff or idempotency guidance found (0). No public SLA. The Security FAQ mentions only contracted recovery targets for clients' disaster recovery options (0). The Core API v1.1 is generally available (10).

BankMCP 80

Newest tag v0.1.15 on 28 September 2026, 39 days ago, and npm 0.1.14 on 16 September (20). Sixteen tags from 8 to 28 September (20). Pull requests from outside contributors were merged on 22 October and the one issue we read was fixed (18 of 25). In the official MCP registry as io.github.noskillish/bankmcp (15). CI on push, current MCP SDK, but the published package lags the repository (7 of 10). 20 + 20 + 18 + 15 + 7 = 80.

Yodlee Core API 33

The newest release notes, July Week 3 2026, are dated 31 July 2026, 69 days before the check (20 of 30). That is the only dated entry since 10 July, so the three-in-90-days line is not met (0). Release notes are dated and appear about every two months. On GitHub, seven issues and pull requests on Yodlee/OpenAPI are open, the oldest from April 2021 and the newest from 20 February 2026 with no reply (6 of 15). No official SDKs, and the Swagger file trails the API by four releases (4 of 15). The spec repository has no CI or tests (3 of 10).

BankMCP 60

Free software you run yourself with nothing to buy, by the self-hosted rule (20 + 20 + 20). No payment protocol (0). Enable Banking registration is free for the owner's own accounts, per the project's site. 60.

Yodlee Core API 15

No x402, MPP or L402 (0). No price on yodlee.com or the developer portal, both /pricing addresses return 404 and product pages ask for a demo (0). The sandbox is free on registration with five preconfigured users. The registration page is disallowed by robots.txt, so we could not confirm that it asks for no card (15 of 20). A person registers in a browser and takes credentials from a dashboard (0).

BankMCP 69

Hosted mode is an OAuth 2.1 server with PKCE, dynamic registration limited to known client redirect hosts, hashed tokens, lockouts and an attestation-only grant; local mode trusts whoever can run processes on the machine (24 of 30). Read-only with no payment tools, attestation off by default and watch notifications fixed to the operator's webhook (18 of 20). Server instructions tell the assistant to treat payee text as data (12 of 15). Every successful sign-in is logged and can be sent to the operator; tool calls aren't logged per call (7 of 15). SECURITY.md with private GitHub reporting; no bounty or audit (8 of 20). 24 + 18 + 12 + 7 + 8 = 69.

Yodlee Core API 49

A clientId and secret in a form body, never in the URL, are exchanged for a bearer token that expires after 30 minutes and is bound to one user's loginName or to the admin. Tokens can be revoked, credentials can be replaced on the dashboard, and each environment has its own. No scopes (22 of 30). A user token reads one user's data, datasets are enabled per customer and the Account Profile dataset needs Yodlee Security Office approval. No read-only credential and no confirmation on deletes (9 of 20). Responses carry bank-written text, and no guidance on untrusted content was found beyond a note on escaped quotes (3 of 15). Consent history endpoints and a referenceCode on errors exist. No operator call log was found in public docs, and the dashboard was not read (3 of 15). No security.txt, bug bounty or disclosure address found. The Security FAQ states an annual SOC 2 Type 2 assessment (report under NDA), PCI DSS 4.0.1 Level One and yearly third-party penetration tests (12 of 20).

BankMCP 70

15 compact tools, plus an attestation-only tool set for a bank:attest grant (18 of 25). Transactions are paged through Enable Banking's continuation key with a page cap, and search_transactions and monthly_summary cut output (16 of 20). Errors explain the fix, such as sending the owner to the setup page (14 of 20). Reads are safe to repeat and there are no payment tools, but no readOnlyHint or other annotations (10 of 20). One npx line for local use, sensible defaults such as the configured country; hosting needs an Enable Banking key and a password (12 of 15). 18 + 16 + 14 + 10 + 12 = 70.

Yodlee Core API 58

include adds optional detail, top caps list size at 500, count endpoints exist for transactions and providers, and derived endpoints return net worth and transaction summaries (16 of 25). skip and top paging with next and previous links in the response header, plus date, account, category, keyword and container filters on transactions (17 of 20). Errors return errorCode, errorMessage and referenceCode, and the spec says codes do not change (15 of 20). No idempotency key or retry guidance. Passing an unused loginName to the token call creates a user implicitly, which a retry would not duplicate (4 of 20). Two headers and a token per call. No official server SDK, only client generation from the Swagger file, and FastLink guides for iOS, Android, React Native and Flutter (6 of 15).

BankMCP 50

MIT, source public (30). The README and site say what is stored (consents, account ids, watches, hashed tokens) and that balances and transactions aren't, and that data passes through Enable Banking (25 of 30). No deprecation policy for a 0.1 project (3 of 20). The README says it sends no telemetry (20). 30 + 25 + 3 + 20 = 78.

Yodlee Core API 55

Closed service with no published service agreement or developer terms. The Swagger file names a Yodlee Developer Licence at an address that returns 404. The spec itself is MIT (8 of 30). The privacy notice says it covers Yodlee's direct-to-consumer services and websites, and that a client's own practices govern services delivered through a client. The Security FAQ says client data is kept until the client deletes it by API or written request, is encrypted with AES-256, and is not used in non-production environments. No DPA is public (12 of 30). No written deprecation policy. The Swagger file marks seven operations deprecated and names replacements, without dates (6 of 20). The FAQ says most core services run from colocation data centres with a move to AWS under way. No sub-processor list or named data locations (6 of 20).