Starling Bank Mcp — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Starling Bank Mcp (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
MCP server for Starling Bank API integration, providing tools to interact with Starling Bank's developer API for account management and transactions.
https://github.com/user-attachments/assets/c2b23c22-bd23-487e-a4f5-c62e02280052
This is a 3rd party integration, and is not affiliated with Starling Bank.
[!WARNING] At time of writing, models make frequent mistakes and are vulnerable to prompt injections. As this MCP server gives the model some control of your bank account, mistakes could be costly. Use with caution and at your own risk.
Follow the instructions on install-mcp, which generates the right config for your MCP client (Claude Code, Claude Desktop, Cursor, Cline, VS Code, and more).
You'll need a Starling Bank personal access token. To create one:
Set it as STARLING_BANK_ACCESS_TOKEN (replacing the placeholder in the generated config). It'll probably begin something like eyJhbGciOiJQUzI1NiIsInppcCI6IkdaSVAifQ., and be moderately long.
If you want to be able to send payments, also see PAYMENT_SIGNING_SETUP.md.
By default, the server uses stdio transport (for Claude Desktop, Cursor, etc.). You can also run it as an HTTP server:
STARLING_BANK_ACCESS_TOKEN=eyJhb... MCP_TRANSPORT=http PORT=3000 npx starling-bank-mcpThe MCP endpoint will be available at http://localhost:3000/mcp.
[!WARNING] The HTTP transport has no authentication. Other processes on your machine—including websites in your browser—could potentially access the endpoint and control your bank account. Only use HTTP transport behind a reverse proxy or in another secured setup.
Pull requests are welcomed on GitHub! To get started:
npm installnpm run test to run testsnpm run buildVersions follow the semantic versioning spec.
To release:
npm version <major | minor | patch> to bump the versiongit push --follow-tags to push with tags~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.