Starling Bank
io.github.domdomeggPublished by GitHub account domdomeggv1.2.1Updated Oct 24, 2026
Allow AI systems to view and control your Starling Bank account via MCP.
Overview
Lets an AI assistant read and control a Starling Bank account through the Starling developer API, including sending payments.
- What you can do
- A local MCP server that connects to the Starling Bank developer API to expose account management and transaction tools. It lets an assistant view account details and transactions and, when a signing key is configured, initiate payments. It is a third-party integration and is not affiliated with Starling Bank.
- When to use it
- Use it when you want an assistant to check balances, review transactions, or prepare and send payments from your own Starling account. It is only relevant if you already bank with Starling and are willing to grant an AI system access to that account.
- Requirements
- Runs locally over stdio, typically via npx with the npm package starling-bank-mcp, or as an MCP bundle. Requires a Starling Developers account linked to your bank account and a personal access token set as STARLING_BANK_ACCESS_TOKEN. Sending payments additionally needs STARLING_BANK_PRIVATE_KEY_PEM and STARLING_BANK_PRIVATE_KEY_UID. An optional HTTP mode uses MCP_TRANSPORT and PORT.
Installation
In SourceWeft
- Open Starling Bank in the dashboard and add it to a workspace.
- Enable the server for the chats that should use its tools.
Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.
Other MCP clients
Follow the launch instructions in the repository.
README
starling-bank-mcp
MCP server for Starling Bank API integration, providing tools to interact with Starling Bank's developer API for account management and transactions.
https://github.com/user-attachments/assets/c2b23c22-bd23-487e-a4f5-c62e02280052
This is a 3rd party integration, and is not affiliated with Starling Bank.
[!WARNING] At time of writing, models make frequent mistakes and are vulnerable to prompt injections. As this MCP server gives the model some control of your bank account, mistakes could be costly. Use with caution and at your own risk.
Installation
Follow the instructions on install-mcp, which generates the right config for your MCP client (Claude Code, Claude Desktop, Cursor, Cline, VS Code, and more).
You'll need a Starling Bank personal access token. To create one:
- Sign up for a Starling Developers account
- Link your Starling Bank account to your Starling Developer account
- Create the access token, selecting the scopes based on what you want the AI system to be able to access
Set it as STARLING_BANK_ACCESS_TOKEN (replacing the placeholder in the generated config). It'll probably begin something like eyJhbGciOiJQUzI1NiIsInppcCI6IkdaSVAifQ., and be moderately long.
If you want to be able to send payments, also see PAYMENT_SIGNING_SETUP.md.
Advanced: HTTP Transport
By default, the server uses stdio transport (for Claude Desktop, Cursor, etc.). You can also run it as an HTTP server:
The MCP endpoint will be available at http://localhost:3000/mcp.
[!WARNING] The HTTP transport has no authentication. Other processes on your machine—including websites in your browser—could potentially access the endpoint and control your bank account. Only use HTTP transport behind a reverse proxy or in another secured setup.
Contributing
Pull requests are welcomed on GitHub! To get started:
- Install Git and Node.js
- Clone the repository
- Install dependencies with
npm install - Run
npm run testto run tests - Build with
npm run build
Releases
Versions follow the semantic versioning spec.
To release:
- Use
npm version <major | minor | patch>to bump the version - Run
git push --follow-tagsto push with tags - Wait for GitHub Actions to publish to the NPM registry.
Source: README.md at commit cfc3faa
Tools
0Version history
1- v1.2.1LatestSep 16, 2026
Score
50% of the applicable checks met
How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.
- Reached in the last 30 days25 pts
Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.
- Auth declared10 pts
Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.
- Tools listed15 pts
Answer tools/list without a credential, or ship a package that starts in a sandbox without one.
- DescriptionRequired15 pts
- Logo10 pts
- Documentation15 pts
- License10 pts