Enable Banking

Enable Banking MCP server

Read, search and export your bank statements and balances from your AI assistant, through Enable Banking, a licensed PSD2 provider for banks across Europe. It moves no money: besides reading, it only starts, stores and ends consents. start_auth is its one money tool, because it asks your bank for 180 days of read access; your client asks you before each call.

You need an Enable Banking application (its id, a registered redirect URL and its private key), and the account holder, to approve each consent in their bank's app every 180 days. A bank allows about four reads of an account a day without the holder present, shared by every program on that consent, so read a period once and narrow it here.

What you can ask

• "Which bank consents do we have, and when does each one run out?"
• "What did we pay Example Supplier SRL this year?"
• "Show incoming payments over 1,000 RON in September, across all our accounts."
• "What is the available balance on our EUR account?"
• "Export last quarter's transactions as CSV for our accountant."
• "Our consent with Example Bank ends next week. Renew it."

Install

%2C%20when%20app.json%20does%20not%20name%20it.%22%7D%5D&config=%7B%22command%22%3A%22npx%22%2C%22args%22%3A%5B%22-y%22%2C%22%40foreverworks%2Fmcp-enable-banking%22%5D%2C%22env%22%3A%7B%22ENABLE_BANKING_CONFIG%22%3A%22%24%7Binput%3Aenable_banking_config%7D%22%2C%22ENABLE_BANKING_KEY%22%3A%22%24%7Binput%3Aenable_banking_key%7D%22%7D%7D)

With Claude Code:

claude mcp add enable-banking -e ENABLE_BANKING_CONFIG="<path to Enable Banking app.json>" -- npx -y @foreverworks/mcp-enable-banking

Claude Desktop (Settings, Developer, Edit Config) and most other clients read the same command as JSON:

{

"mcpServers": { "enable-banking": { "command": "npx", "args": ["-y", "@foreverworks/mcp-enable-banking"], "env": { "ENABLE_BANKING_CONFIG": " " } } } }

Each runs the published package on Node 22.19 or newer. VS Code and the Claude Desktop bundle ask for each setting as they add the server; leave an optional one empty. Cursor reads each from your environment instead (${env:ENABLE_BANKING_CONFIG} and so on), so set them before you start Cursor. The commands above set only what is required; Configuration has the rest.

From a clone

git clone https://github.com/foreverworks/mcps.git && cd mcps

npm ci && npm run build claude mcp add enable-banking -e ENABLE_BANKING_CONFIG=" " -- node "$PWD/servers/enable-banking/dist/index.js"

In a JSON configuration, the command is node and its one argument the full path of servers/enable-banking/dist/index.js. To share one running copy between several clients over HTTP, see docs/deploying.md.

Configuration

app.json holds the application's details from the control panel:

{

"application_id": "aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee", "application_name": "Example Books", "environment": "sandbox", "redirect_url": "https://example.com/bank-callback", "private_key": "aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee.pem" }

application_id and redirect_url are required, and private_key too unless ENABLE_BANKING_KEY is set. redirect_url must match a registered one exactly. application_name and environment only label health's answer; the application_id decides sandbox or production. api_base overrides https://api.enablebanking.com for tests or a proxy; other keys are ignored. Under systemd, a credentials directory renames files to their credential names, so set ENABLE_BANKING_KEY there. The variables every server shares are in docs/configuration.md.

Getting the application and its key

1. In Enable Banking's Control Panel, open API applications from the top menu. In "Add a new application", keep the Sandbox environment: its test banks let you try every tool without a real account.
2. Name the application (the account holder sees the name) and enter a redirect URL. Any page you control works: complete_auth only needs the address the browser lands on.
3. Keep the default private key option and press Register. Your browser generates the key and saves it as .pem; move it where only this server can read it, and write app.json beside it.

Production is a second application, registered with the Production environment. It starts Inactive; "Activate by linking accounts" makes it active in restricted mode, which reads only your own linked accounts until you sign a contract with Enable Banking.

First run

1. Ask your assistant to run Enable Banking's health check. It names the application, its environment, whether it is active and its redirect URLs, and counts the stored consents. A key that does not belong to the application_id fails here.
2. Find your bank with list_aspsps for its country. start_auth takes its name; psuTypes lists its account types (business, personal), and maxConsentDays its longest consent.
3. Ask for start_auth with that name, the country and the psu_type, and approve it. The link it returns is for the account holder: plan five minutes with the phone that holds the bank's app.
4. Open the link, sign in to the bank, and tick every account it offers. The request names no accounts, which asks for all of them.
5. The bank sends you back to the redirect URL with ?code=.... Give that address (or the code) to complete_auth at once: the code works once, for minutes. Its answer lists the accounts and the consent's end date.

To renew a consent (list_stored_sessions says how many days it has left), repeat steps 3 to 5 with its bank, country and type. Without a label, the new consent takes the old one's place and label.

From a shell, node dist/index.js --health prints one ENABLEBANKING: line and exits 1 when a person has to act or 2 when Enable Banking was unwell, which suits a daily timer.

Tools

read changes nothing at the bank or in the stored consents (an export writes only its file); write changes the stored consents; money asks a bank for access to your accounts.

Money

start_auth moves no money, but it grants 180 days of read access, which only the account holder should decide. It is marked money in tools/list, so your client asks you before each call (Claude Code does, in every permission mode). With MCP_CONFIRM=elicit the server asks you itself, in one line computed from the arguments:

enable-banking: Bank consent (PSD2, read-only: balances and transactions) with Example Bank (DE), personal accounts, every account the bank offers, valid 180 days: until 2030-07-01 if confirmed today

The end date is computed when you are asked and again when the call runs, so a later confirmation moves it by the delay. Access starts when the account holder approves in their bank.

Troubleshooting

`config`: "ENABLE_BANKING_CONFIG is not set", or a message naming app.json. Set ENABLE_BANKING_CONFIG to a readable app.json, and ENABLE_BANKING_KEY (or private_key) to the key.

`auth`: "cannot use the private key at ...". The key file is missing, unreadable or not an RS256 private key. Point ENABLE_BANKING_KEY or private_key at the .pem the control panel saved; the next call reads it again, with no restart.

`api` with status 401 or 403. Enable Banking refused the signed token: the key does not belong to the application_id (a sandbox key beside a production id, say).

`api` with `reason` `EXPIRED_SESSION`, `REVOKED_SESSION`, `CLOSED_SESSION` or `SESSION_DOES_NOT_EXIST`, or status 422 or 404, on a call that worked the day before. The consent lapsed or was revoked in the bank's app, and retrying will not bring it back. Renew it with steps 3 to 5 of First run.

`api` from `complete_auth` with `reason` `EXPIRED_AUTHORIZATION_CODE`, `WRONG_AUTHORIZATION_CODE` or `outcome_unknown`. The code works once, for minutes, and a dropped excha