Someone Built a Way to Let Claude Read Your Bank Account. Read-Only, on Your Own Server.

BankMCP is a free, open-source tool released around September 7, 2026 that lets an AI assistant read your real bank accounts. You host it yourself, it connects to your banks through Enable Banking’s PSD2 open-banking API covering 2,700+ European banks, then exposes them to Claude, ChatGPT, Cursor or any MCP client as a connector. It is strictly read-only, with no payments and no third party holding your data. You ask plain questions like which subscriptions you pay for or what you spent on groceries in August, then it answers from your actual transactions. MIT licensed, 149 stars in its first day, with a live site. The design is deliberately conservative, which is the point. The catch is that it is European-bank only for now, one day old, plus pointing any AI at your finances deserves real thought before you do it. Best for European users who want their assistant to see their money. Not ideal for anyone outside PSD2 coverage or uneasy about the idea.

The pitch is the kind of sentence that makes a security-minded person flinch: your AI can now read your bank.

Then you look at how it is built. The flinch becomes something closer to respect. Read-only, so nothing can move money. Self-hosted, so no company sits between you and your accounts. One user, yours. Connected through the same regulated open-banking rails your budgeting app already uses.

Not a bank, a server you run

BankMCP is a small open-source server you run yourself. It went up around September 7, picked up 149 stars in a day, plus it is the clearest example yet of the shift these tools represent: not an agent doing things to the world, but an agent that can finally see part of your world it never could before.

The whole story is in the constraints. So that is where this spends its time.

What It Actually Is

Verified against the GitHub repository, the live site plus the Enable Banking documentation.

The chain of custody is the part worth understanding. Your assistant talks to your BankMCP server over OAuth. Your server talks to Enable Banking over a signed token. Enable Banking talks to your bank over PSD2, the European regulation that forces banks to expose account data to licensed third parties when you authorize it.

So there is no scraping, no storing your bank password, no unofficial access. It rides the same legal open-banking pipe that every regulated fintech in Europe uses. The only new thing is the last hop, exposing that data to an AI assistant instead of a budgeting dashboard.

What You Can Actually Ask

The examples from the project make the use case concrete. It is more useful than it first sounds.

“Which subscriptions am I paying for, and what do they cost per year?” Your assistant reads your recurring transactions plus totals them. That is a question most people cannot answer off the top of their head, plus the answer is usually alarming.

“What did we spend on groceries in August?” A category total pulled from real transactions rather than a guess.

“Has the invoice from Acme been paid?” A check against incoming payments, which for a freelancer or small business is a question asked constantly.

“Tell me when my balance drops below 5,000.” A standing watch on your own account.

None of that is exotic. It is the everyday financial admin that banking apps handle clumsily through menus and filters, done instead by asking a question in plain language. The value is not that an AI can do something new with your money. It is that it removes the friction between a question you have and an answer sitting in your transaction history.

Read-Only Is the Entire Design

This is where BankMCP earns attention rather than alarm, so it deserves the detail.

The server cannot move money. Not restricted from it, not discouraged from it, structurally incapable of it. Enable Banking exposes account information plus payment initiation as separate services under PSD2. BankMCP only ever requests the account-information side. The payment rails are not wired in at all.

That matters because of everything else this site has covered. We wrote about an agent that cancelled a stranger’s gym booking because nothing told it not to. We covered Binance opening agent trading with no loss cap, where the boundary was a subaccount and the agent could lose everything inside it. And a researcher showed Claude Code running malware from a website summary.

The common thread in the scary versions is an agent that can act. BankMCP removes the ability to act entirely. The worst case is not a drained account. The worst case is that an AI reads your transactions, which is a privacy question rather than a theft one, a very different order of risk.

Self-hosted is the other half

Self-hosted is the second half. The data does not pass through a company’s servers. There is no BankMCP cloud holding your financial history, no vendor to breach, no terms that change next quarter. You run it, you hold it, the connection sits between your machine and your bank through a regulated intermediary.

That is a deeply conservative design for a nervous use case. Worth saying the author clearly thought about this rather than shipping the flashy version.

Where the Real Risk Sits

Being honest about what could still go wrong, because read-only is not risk-free.

The risk is exposure, not theft. Your entire financial life is in your transaction history. Where you shop, what you earn, what you owe, where you physically are when you tap a card, which causes plus habits plus subscriptions you fund. Handing that to an AI assistant means it flows into whatever that assistant does with context.

If your MCP client is a cloud service, your transactions become part of a conversation on somebody else’s servers, subject to their retention and their training policies. BankMCP being self-hosted protects the pipe, but the moment Claude or ChatGPT reads a transaction, that data sits in a cloud conversation unless you are running a local model. The project notes it is tested with Ollama, which is the fully local path, plus that matters more here than for almost any other MCP tool.

There is also prompt injection, the thread running through this whole cluster. A transaction description is attacker-controllable text. Somebody can send you 0.01 with a payment reference crafted to be read as an instruction by an AI parsing your transactions. Read-only limits the damage since the agent cannot act on a malicious instruction financially, but an injected instruction could still try to make the assistant misreport or exfiltrate what it sees. Nobody has demonstrated that against BankMCP, plus it is worth keeping in mind before pointing a model at a feed of text strangers can write into.

And it is one day old. Thirty forks is a strong start with no track record behind it. The security model is sound in design, unproven in the wild.

Why This Is the Interesting Direction

Step back from the specific tool, because the category is the story.

Most of what this site has covered in the agent space is about action. Agents booking things, trading things, attacking things, running code. The alarming headlines all involve an agent doing something in the world.

BankMCP is the other kind, quieter plus more useful for most people. It gives an assistant read access to a slice of your real life it was previously blind to. No action, just sight. And once an assistant can see your actual financial data, the generic advice problem disappears. It stops saying what people generally spend on groceries plus starts saying what you spent, which is the difference between a chatbot and something that knows your situation.

That pattern generalizes. The truly useful consumer AI of the next year is probably less about agents that do things and more about assistants that can finally see the things that matter to you, your bank, your calendar, your health data, your files, under your control, read-only, on your terms. BankMCP is an early, careful example of exactly that.

The MCP standard is what makes it possible. Because BankMCP speaks standard MCP, it plugs into any compliant client without custom work, which is why one small server can serve Claude, ChatGPT, Cursor plus a local model equally. Our coverage of the agent runtime wars touched on why that standardization matters. This is the payoff: a connector anyone can build, that works everywhere.

What You Would Have to Do

Practical setup, because self-hosting is the tradeoff for the safety.

You run the server somewhere. That is a real requirement, a small always-on machine or a cheap hosted box, not a click-to-install app. This is the cost of nobody else holding your data, plus it is the part that filters this to technical users for now.

You register with Enable Banking for API access, which is the PSD2 intermediary. Then in Claude, it is Settings, Connectors, Add custom connector, paste your server’s URL, then connect with a password you set. The project says that password is the only login you do.

Then you tell the assistant to connect your bank, it gives you a link, you log in at your actual bank to authorize read access, then from then on your assistant can answer questions about your accounts.

Two honest limits. It is European banks only right now, since it rides PSD2, which is European regulation, so a US reader cannot use it today. And the fully private version needs a local model through Ollama, because otherwise your transactions reach a cloud assistant. If you want both the read access plus full privacy, that is a local model on your own hardware, which our coverage of on-device inference covers the feasibility of.

The Part Worth Keeping

The headline sounds reckless: let your AI read your bank account.

The build is the opposite of reckless. Read-only so nothing moves. Self-hosted so nobody else holds it. Riding regulated open-banking rails rather than scraping. One user, yours, on a server you control.

What is left after the safety model does its work is a properly useful thing. An assistant that can answer questions about your actual money instead of money in general. Which of your subscriptions are quietly bleeding you, what you really spent last month, whether that invoice landed.

It is European-only, one day old, plus it deserves a local model if you care about privacy. But the shape of it is the shape worth watching. Not an agent that acts on your life, an assistant that can finally see it, on terms you set.

That is the version of this technology most people actually want. It also keeps getting less attention than the one that pops Calculator.