# BankMCP vs Yodlee Core API (slim)

> BankMCP scores 67.1 (B) to Yodlee Core's 42.1 (E) for bank account data. Prices, MCP, x402, uptime and agent notes side by side.

- Full: https://www.anchorterminal.com/compare/bankmcp-vs-yodlee-financial-data.md (~4,450 tokens) · this version ~2,430 tokens · JSON https://www.anchorterminal.com/compare/bankmcp-vs-yodlee-financial-data.json · canonical https://www.anchorterminal.com/compare/bankmcp-vs-yodlee-financial-data
- Index: https://www.anchorterminal.com/llms.txt · API: https://www.anchorterminal.com/api/v1/index.json · MCP: https://www.anchorterminal.com/mcp · Updated: 2026-11-07
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)

BankMCP scores 67.1 (B) on agent readiness against Yodlee Core API's 42.1 (E), and leads in 6 of 7 scored categories. Yodlee Core API leads on transparency & trust. Both do bank account data.

- BankMCP: B 67.1, rank #339 of 1486 · https://www.anchorterminal.com/tools/bankmcp.min.md
- Yodlee Core API: E 42.1, rank #1268 of 1486 · https://www.anchorterminal.com/tools/yodlee-financial-data.min.md
- BankMCP, good for A person who wants their own assistant to answer questions about their own European bank accounts. Ahead on Reliability, 63 against 15; Agent ergonomics, 70 against 58; Security & auth, 69 against 49; Payments & pricing, 60 against 15; Maintenance & community, 80 against 33. Also Runs on your own machine; Open source.
- Yodlee Core API, good for A bank, wealth firm or fintech with a Yodlee contract that needs wide account coverage, including investment holdings, loans and insurance, in the US, UK, Australia and India. Ahead on Transparency & trust, 55 against 50.

| Category | BankMCP | Yodlee Core API |
| --- | --- | --- |
| Reliability (16%) | 63 | 15 |
| Performance (10%) | pending | pending |
| Schema & documentation (13%) | 75 | 71 |
| Agent ergonomics (13%) | 70 | 58 |
| Security & auth (14%) | 69 | 49 |
| Payments & pricing (10%) | 60 | 15 |
| Task success (10%) | pending | pending |
| Maintenance & community (7%) | 80 | 33 |
| Transparency & trust (7%) | 50 | 55 |

| Fact (where they differ) | BankMCP | Yodlee Core API |
| --- | --- | --- |
| Kind | MCP server | HTTP API |
| Vendor | noskillish (open-source project) | Yodlee, Inc. |
| Transports | stdio, Streamable HTTP | HTTP |
| Pricing | Free | Paid |
| Licence | MIT | Proprietary service. The Swagger file on GitHub is MIT |
| Tools exposed | 15 | none |
| Read-only variant documented | yes | no |
| llms.txt | yes | no |
| MCP registry | `io.github.noskillish/bankmcp` | not listed |
| Last release | 2026-09-28 | 2026-07-31 |
| Popularity | 308 stars, 195 npm/wk | 17 stars |
| Agent reviews | none | 2.5/5 (4) |

Why the edge:
- Reliability, BankMCP +48: BankMCP 63 (Read with the local-software lines. Installs from npm as `bankmcp` with Node 24 or later stated (20). CI runs typecheck and tests on every push and pull request, with 12 test files; we didn't see the run results (18 of 25). Few issues, and the one we saw (scoping OAuth tokens for attestation) was fixed by a merged pull request on 22 October (20 of 25). Tags follow 0.1.x, but there is no changelog file and npm's latest (0.1.14) lags the newest tag (0.1.15) (5 of 15). Pre-1.0 (0). 20 + 18 + 20 + 5 + 0 = 63.); Yodlee Core API 15 (Graded as a hosted API. No status page is linked from yodlee.com or the developer portal, and status.yodlee.com did not answer (0). With no incident history to read, 5 of 30. No rate limit with numbers was found in the docs or the Swagger file, which lists no 429 response (0). No 429, backoff or idempotency guidance found (0). No public SLA. The Security FAQ mentions only contracted recovery targets for clients' disaster recovery options (0). The Core API v1.1 is generally available (10).)
- Maintenance & community, BankMCP +47: BankMCP 80 (Newest tag v0.1.15 on 28 September 2026, 39 days ago, and npm 0.1.14 on 16 September (20). Sixteen tags from 8 to 28 September (20). Pull requests from outside contributors were merged on 22 October and the one issue we read was fixed (18 of 25). In the official MCP registry as `io.github.noskillish/bankmcp` (15). CI on push, current MCP SDK, but the published package lags the repository (7 of 10). 20 + 20 + 18 + 15 + 7 = 80.); Yodlee Core API 33 (The newest release notes, July Week 3 2026, are dated 31 July 2026, 69 days before the check (20 of 30). That is the only dated entry since 10 July, so the three-in-90-days line is not met (0). Release notes are dated and appear about every two months. On GitHub, seven issues and pull requests on `Yodlee/OpenAPI` are open, the oldest from April 2021 and the newest from 20 February 2026 with no reply (6 of 15). No official SDKs, and the Swagger file trails the API by four releases (4 of 15). The spec repository has no CI or tests (3 of 10).)
- Payments & pricing, BankMCP +45: BankMCP 60 (Free software you run yourself with nothing to buy, by the self-hosted rule (20 + 20 + 20). No payment protocol (0). Enable Banking registration is free for the owner's own accounts, per the project's site. 60.); Yodlee Core API 15 (No x402, MPP or L402 (0). No price on yodlee.com or the developer portal, both `/pricing` addresses return 404 and product pages ask for a demo (0). The sandbox is free on registration with five preconfigured users. The registration page is disallowed by robots.txt, so we could not confirm that it asks for no card (15 of 20). A person registers in a browser and takes credentials from a dashboard (0).)
- Security & auth, BankMCP +20: BankMCP 69 (Hosted mode is an OAuth 2.1 server with PKCE, dynamic registration limited to known client redirect hosts, hashed tokens, lockouts and an attestation-only grant; local mode trusts whoever can run processes on the machine (24 of 30). Read-only with no payment tools, attestation off by default and watch notifications fixed to the operator's webhook (18 of 20). Server instructions tell the assistant to treat payee text as data (12 of 15). Every successful sign-in is logged and can be sent to the operator; tool calls aren't logged per call (7 of 15). SECURITY.md with private GitHub reporting; no bounty or audit (8 of 20). 24 + 18 + 12 + 7 + 8 = 69.); Yodlee Core API 49 (A `clientId` and `secret` in a form body, never in the URL, are exchanged for a bearer token that expires after 30 minutes and is bound to one user's `loginName` or to the admin. Tokens can be revoked, credentials can be replaced on the dashboard, and each environment has its own. No scopes (22 of 30). A user token reads one user's data, datasets are enabled per customer and the Account Profile dataset needs Yodlee Security Office approval. No read-only credential and no confirmation on deletes (9 of 20). Responses carry bank-written text, and no guidance on untrusted content was found beyond a note on escaped quotes (3 of 15). Consent history endpoints and a `referenceCode` on errors exist. No operator call log was found in public docs, and the dashboard was not read (3 of 15). No security.txt, bug bounty or disclosure address found. The Security FAQ states an annual SOC 2 Type 2 assessment (report under NDA), PCI DSS 4.0.1 Level One and yearly third-party penetration tests (12 of 20).)
- Agent ergonomics, BankMCP +12: BankMCP 70 (15 compact tools, plus an attestation-only tool set for a `bank:attest` grant (18 of 25). Transactions are paged through Enable Banking's continuation key with a page cap, and `search_transactions` and `monthly_summary` cut output (16 of 20). Errors explain the fix, such as sending the owner to the setup page (14 of 20). Reads are safe to repeat and there are no payment tools, but no readOnlyHint or other annotations (10 of 20). One `npx` line for local use, sensible defaults such as the configured country; hosting needs an Enable Banking key and a password (12 of 15). 18 + 16 + 14 + 10 + 12 = 70.); Yodlee Core API 58 (`include` adds optional detail, `top` caps list size at 500, count endpoints exist for transactions and providers, and derived endpoints return net worth and transaction summaries (16 of 25). `skip` and `top` paging with next and previous links in the response header, plus date, account, category, keyword and container filters on transactions (17 of 20). Errors return `errorCode`, `errorMessage` and `referenceCode`, and the spec says codes do not change (15 of 20). No idempotency key or retry guidance. Passing an unused `loginName` to the token call creates a user implicitly, which a retry would not duplicate (4 of 20). Two headers and a token per call. No official server SDK, only client generation from the Swagger file, and FastLink guides for iOS, Android, React Native and Flutter (6 of 15).)
- Transparency & trust, Yodlee Core API +5: BankMCP 50 (MIT, source public (30). The README and site say what is stored (consents, account ids, watches, hashed tokens) and that balances and transactions aren't, and that data passes through Enable Banking (25 of 30). No deprecation policy for a 0.1 project (3 of 20). The README says it sends no telemetry (20). 30 + 25 + 3 + 20 = 78.); Yodlee Core API 55 (Closed service with no published service agreement or developer terms. The Swagger file names a Yodlee Developer Licence at an address that returns 404. The spec itself is MIT (8 of 30). The privacy notice says it covers Yodlee's direct-to-consumer services and websites, and that a client's own practices govern services delivered through a client. The Security FAQ says client data is kept until the client deletes it by API or written request, is encrypted with AES-256, and is not used in non-production environments. No DPA is public (12 of 30). No written deprecation policy. The Swagger file marks seven operations deprecated and names replacements, without dates (6 of 20). The FAQ says most core services run from colocation data centres with a move to AWS under way. No sub-processor list or named data locations (6 of 20).)