monzo — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited monzo (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Read-only access to Monzo bank data via MCP server. Dual-layer: MCP tools handle API calls, this skill provides domain knowledge.
| Tool | What it does |
|---|---|
monzo_is_authenticated | Verify auth status (live ping to Monzo API) |
monzo_complete_auth | Complete OAuth manually when loopback fails (WSL/Docker) |
monzo_list_accounts | List all accounts (current, joint, flex) |
monzo_get_balance | Balance, total balance, and today's spending |
monzo_list_transactions | Recent transactions with merchant details |
monzo_get_transaction | Full detail on a single transaction |
monzo_list_pots | All pots with balances and goals |
monzo_spending_summary | Aggregated spending by category and merchant |
Strong Customer Authentication (SCA): After re-authenticating in the Monzo app, full transaction history is available for 5 minutes. After that, only the last 90 days are accessible. If the user asks for older data, explain this limitation.
Amounts: All amounts from the API are in minor units (pence for GBP). Divide by 100 and format as pounds (e.g., amount: -4599 → -£45.99). Negative = spending, positive = income/refund.
Rate limits: Monzo enforces rate limits (HTTP 429). The client handles retries automatically, but avoid making many rapid sequential calls. Prefer monzo_spending_summary over fetching transactions one-by-one.
When asked about spending:
monzo_spending_summary — it aggregates by category and merchant in one callmonzo_list_transactions with since/before for specific date rangesCategories Monzo uses: groceries, eating_out, entertainment, transport, shopping, bills, general, expenses, cash, holidays, personal_care, family, charity, finances.
monzo_is_authenticated if other calls fail — it returns needs_login, waiting_for_sca, or authenticatedwaiting_for_sca, stop and tell the user to approve the notification in their Monzo app before retryingsince parameter on transactions can be a timestamp OR a transaction IDmonzo_spending_summary tool handles this)monzo_spending_summary paginates automaticallymonzo_is_authenticated returns needs_login after the user logged in via the browser, ask for the full callback URL from their browser address bar and pass it to monzo_complete_authaccount_id param if querying joint/flex accounts~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.