Back to the lab

Let an AI read a bank account

A fake one. The agent talks to a real open-banking API through real MCP tools, but the bank is the aggregator’s sandbox and every transaction is synthetic. Connect it, ask, and watch each tool call.

Live demo on synthetic data — how this works

Sandbox bank · synthetic data onlyRead-only · nothing is paid or moved

Bank agent workspace

Checking the demo status…

  1. The live agent is switched off until the lab’s inference gates are verified. Connecting the bank and the MCP endpoint still work.

Fail-closed until the live gates pass.

The tools are the boundary

The model never sees credentials or the bank API. It only sees six read-only tools served over the Model Context Protocol. Anything not on that list, paying, moving money or editing details, is impossible by construction rather than by instruction.

  • list_banksWhich bank this sandbox demo connects to. Always the aggregator's Mock ASPSP; no real bank is reachable.
  • connect_statusWhether a sandbox bank is connected for this demo session, which bank, how many accounts and when the consent expires.
  • list_accountsThe synthetic accounts in the connected sandbox bank with their ids, names, types and currencies.
  • get_balancesCurrent balances for one account, by account id from list_accounts.
  • get_transactionsBooked transactions for one account, newest first. Optional ISO dates date_from and date_to; limit up to 100. Amounts are signed strings: debits negative.
  • summarize_spendServer-side summary of debits for one account or all accounts over a period (default last 90 days): totals by counterparty and by month, plus likely recurring payments. Prefer this over paging through get_transactions.
See why the tool list matters more than the prompt Check a real workflow’s authority boundaries
For the curious

The page calls a Next.js route that runs Claude through Vercel AI Gateway. That route connects to the MCP server with the AI SDK’s MCP client over Streamable HTTP, in-process, so the JSON-RPC exchange is genuine without leaving the function. The MCP server signs a short-lived RS256 JWT for Enable Banking and calls its account-information endpoints. Your connection lives in an opaque, httpOnly cookie for at most 24 hours and can be deleted with one click.

How this was built

Approach: a public MCP server with six read-only tools, a PSD2-style consent redirect to the sandbox Mock ASPSP, and a chat that reaches the tools over real MCP. Nothing is written to any bank.

Runtime model: Claude Opus 5 via Vercel AI Gateway when the lab’s live-inference gates are verified; otherwise none, and the chat stays switched off while the bank connection still works.

Limit: sandbox only. Real bank connections would need a privacy assessment, agent registration under the aggregator’s licence and a different consent story, so they are deliberately out of scope.

Build diary awaiting Arun’s notes. Empty fields below are intentional; no build story or time estimate has been invented.

Tools used
Claude Code, Next.js 16, TypeScript, mcp-handler, AI SDK, Enable Banking sandbox
Models used to build
Arun to add
Rough hours
Not recorded
What failed
Arun to add

Actual build prompts

can I build an MCP connection? I saw someone build a MCP connection to 2400 banks
not a pet project, a version that I can offer in my personal website