What is a financial MCP server?
A financial MCP server is a service that exposes your portfolio to an AI assistant through the Model Context Protocol, a common interface for connecting assistants to external data. The assistant reads only what you authorise, through a login you complete yourself, and the access can be revoked at any time.
Assistants can now read an application directly, without copying and pasting. The mechanism behind that is a protocol with an unhelpful name, surrounded by a lot of confusion about what it does and does not allow.
What the protocol actually standardises
Before MCP, every assistant that wanted to read an application needed a bespoke integration, written once per assistant and per application. The Model Context Protocol replaces that matrix with a common vocabulary: a server declares the tools it offers, the assistant lists them and calls the ones it needs (1).
The word server is misleading here. Nothing is installed on your machine. A financial MCP server is an endpoint your assistant calls over HTTPS, run by the application that already holds your data.
What changes when the data is financial
Two things. Sensitivity first: a net worth is not a weather forecast, and every tool call is a disclosure. Then the gap between reading and writing. Reading tells the assistant something; writing changes your records, and a mistaken write is not undone by closing the conversation.
Implementations diverge on exactly this point. Some are read-only by design. Others allow writes behind an explicit confirmation you have to answer yourself. The difference is worth checking before you connect anything.
How the connection is authorised
A financial MCP server does not take a password. It uses OAuth 2.1 with PKCE: your assistant sends you to the application, you log in there, and the application hands back a token limited to what you agreed to. The assistant never sees your credentials.
Most clients also register themselves, through dynamic client registration (2). That is why connecting usually means pasting one URL rather than creating an API key by hand. The consent that results is scoped and revocable, from the application, without touching the assistant.
What it is not
It is not a bank connection. The protocol says nothing about where the numbers came from: a server can be fed by an aggregator, or by holdings you entered yourself. That choice belongs to the application, not to MCP.
It is not an agent working in the background either. The server answers when your assistant calls it, during your conversation, and does nothing between two questions. And the tool list you see is filtered: what your client cannot support, or what you did not grant, simply does not appear.
MCP is plumbing, and plumbing is worth understanding before you connect it to your money. What matters is not the protocol itself but the three decisions each application makes on top of it: where the data comes from, whether writing is possible, and how consent is given and withdrawn.
Frequently asked questions
Do I need to install anything?
No. A financial MCP server runs at the application that holds your data. You paste its URL into your assistant, authorise the connection once, and nothing is installed on your machine.
Can the assistant move money?
No. MCP connects an assistant to data and to the actions an application chooses to expose. A wealth tracking app exposes readings and, at most, entries you confirm. None of that touches a bank account.
What happens when I revoke access?
The token stops being accepted immediately. The assistant keeps whatever it already displayed in the conversation, but it can no longer read anything new. Revocation happens in the application, not in the assistant.
Does it require connecting my bank?
No, and this is the most common confusion. The protocol says nothing about the origin of the data. An application whose holdings are declared by the user exposes them exactly like one that aggregates bank accounts.
Can a coding agent connect too?
Yes. Any MCP client that speaks OAuth can, whether it is a chat assistant or a coding agent such as Claude Code or Cursor. The server does not tell them apart.
Sources
Sources checked on August 11, 2026.
Go further
Ready to take control of your wealth?
Join Finvygo for free and start tracking all your assets in one place.
Create my free account