bank-mcp: why it is not safe to use
We found no hidden code or write actions, but this skill stores sensitive bank API credentials and certificates locally, which warrants caution.
What we found
Our review of `bank-mcp` did not find hidden instructions, obfuscated code, install-time fetch or execute hooks, hardcoded secrets, or privileged system changes. The exposed MCP tools appear limited to read-only banking functions such as listing accounts, listing transactions, and checking balances. The documented data flow also indicates direct communication between the local MCP process, the user’s chosen bank API, and the MCP client, without a stated cloud relay or telemetry layer.
The reason for our warning is narrower: this skill stores and reads sensitive banking API credentials and certificates from the local filesystem under `~/.bank-mcp` so it can connect to a user’s bank accounts. That behavior matches the skill’s stated purpose, but it involves highly sensitive financial access material and should be clearly understood before installation.
What to do instead
Only use this skill if you are comfortable keeping banking credentials and certificates on the device where it runs. Review the local storage path and file permissions during setup, use a dedicated low-risk bank API account where possible, and avoid installing it on shared or unmanaged machines.
Source: https://github.com/elcukro/bank-mcp
We report what our security review found at the time we checked, with the goal of keeping people safe. Projects change; if a maintainer has since fixed this, we are glad to recheck it. Email hello@agentpod.com.