bankmcp 0.1.2 → 0.1.4

package/README.md

@@ -187,7 +187,7 @@ service to others. This project does not change those terms.
 | `create_watch`, `list_watches`, `delete_watch`, `check_watches` | background rules with webhook notifications |
 
 **Prompts**: `connect-bank`, `monthly-summary`, `build-budget`,
-`subscription-audit`, `unusual-transactions`.
+`savings-scan`, `subscription-audit`, `unusual-transactions`.
 
 **Watches** run on the server. Rules: balance below or above an amount, a
 single debit over an amount, an incoming or outgoing payment matching a name,

package/dist/lib/data.js

@@ -17,10 +17,15 @@ export function simplifyTransaction(t) {
 }
 export function simplifyBalances(balances) {
     const byType = (types) => balances.find((b) => types.includes(b.balance_type));
-    const booked = byType(["CLBD"]) ?? byType(["ITBD"]) ?? byType(["CLAV"]);
+    // Preference order: closing booked, interim booked, closing available, interim
+    // available, expected, then whatever the bank sent. Some banks (Revolut, for
+    // one) report a single ITAV balance and nothing else; an account must never
+    // vanish from a total because of the label its bank chose.
+    const booked = byType(["CLBD"]) ?? byType(["ITBD"]) ?? byType(["CLAV"]) ?? byType(["ITAV"]) ?? byType(["XPCD"]) ?? balances[0];
     const available = byType(["XPCD"]) ?? balances.find((b) => /avail/i.test(b.name ?? "") || /avail/i.test(b.balance_type));
     return {
         booked: booked ? round2(Number(booked.balance_amount.amount)) : undefined,
+        booked_type: booked?.balance_type,
         available: available && available !== booked ? round2(Number(available.balance_amount.amount)) : undefined,
         currency: (booked ?? balances[0])?.balance_amount.currency,
         reference_date: (booked ?? balances[0])?.reference_date,

package/dist/lib/local.js

@@ -2,6 +2,7 @@
 // page and receives the bank redirect. Enable Banking requires https redirect
 // URLs, so a self-signed certificate is created on first run.
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { X509Certificate } from "node:crypto";
 import { join } from "node:path";
 import { createServer as createHttpsServer } from "node:https";
 import selfsigned from "selfsigned";
@@ -9,17 +10,46 @@ import { config } from "./config.js";
 import { createApp } from "./app.js";
 let server;
 let starting;
+/** Browsers reject server certificates valid for more than 398 days; earlier versions issued 10-year ones. */
+export function certificateStillGood(pem, now = Date.now()) {
+    try {
+        const x = new X509Certificate(pem);
+        const from = Date.parse(x.validFrom);
+        const to = Date.parse(x.validTo);
+        const day = 86_400_000;
+        return to - from <= 398 * day && to - now > 30 * day;
+    }
+    catch {
+        return false;
+    }
+}
 async function certificate() {
     const certPath = join(config.dataDir, "localhost-cert.pem");
     const keyPath = join(config.dataDir, "localhost-key.pem");
-    if (existsSync(certPath) && existsSync(keyPath))
-        return { cert: readFileSync(certPath, "utf8"), key: readFileSync(keyPath, "utf8") };
+    if (existsSync(certPath) && existsSync(keyPath)) {
+        const cert = readFileSync(certPath, "utf8");
+        if (certificateStillGood(cert))
+            return { cert, key: readFileSync(keyPath, "utf8") };
+        console.error("[bank] replacing the stored localhost certificate (too long-lived or about to expire)");
+    }
+    // Apple caps TLS server certificate lifetime at 398 days; Chrome on macOS
+    // defers to the system verifier and rejects anything longer as ERR_CERT_INVALID,
+    // which offers no click-through. Stay just under the limit.
     const notAfterDate = new Date();
-    notAfterDate.setFullYear(notAfterDate.getFullYear() + 10);
+    notAfterDate.setDate(notAfterDate.getDate() + 397);
     const pems = await selfsigned.generate([{ name: "commonName", value: "localhost" }], {
         keySize: 2048,
         notAfterDate,
-        extensions: [{ name: "subjectAltName", altNames: [{ type: 2, value: "localhost" }, { type: 7, ip: "127.0.0.1" }] }],
+        // selfsigned defaults to sha1, which browsers reject outright as
+        // ERR_CERT_INVALID with no click-through. macOS additionally requires
+        // basicConstraints and an extendedKeyUsage of serverAuth.
+        algorithm: "sha256",
+        extensions: [
+            { name: "basicConstraints", cA: false, critical: true },
+            { name: "keyUsage", digitalSignature: true, keyEncipherment: true, critical: true },
+            { name: "extKeyUsage", serverAuth: true },
+            { name: "subjectAltName", altNames: [{ type: 2, value: "localhost" }, { type: 7, ip: "127.0.0.1" }] },
+        ],
     });
     mkdirSync(config.dataDir, { recursive: true });
     writeFileSync(certPath, pems.cert, { mode: 0o600 });

package/dist/lib/mcp.js

@@ -1,7 +1,7 @@
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { registerTools } from "./tools.js";
 import { registerPrompts } from "./prompts.js";
-export const VERSION = "0.1.2";
+export const VERSION = "0.1.4";
 export function createServer() {
     const server = new McpServer({ name: "bank", version: VERSION }, {
         instructions: [

package/dist/lib/prompts.js

@@ -23,6 +23,19 @@ export function registerPrompts(server) {
 3. When I say I am done, call consent_status and list_accounts. Summarise what got linked.
 4. Suggest a short label for each account based on its name and product, and offer to set them with set_account_label so I can refer to accounts by name.
 
+${accountsContext()}`));
+    server.registerPrompt("savings-scan", {
+        title: "Savings scan",
+        description: "For the vague 'how am I doing?' question. A 90-day scan that returns at most three findings ranked by money at stake and urgency: about to run short, a needless cost, or a regular payment that changed. Each with a concrete action. Not a monthly category review.",
+    }, () => text(`Give me a 90-day money-saving scan: prevent harm or leave me better off. At most three findings.
+
+1. Call list_accounts with include_balances, then get_transactions on each current account for the last 90 days (follow continuation keys). Skip loan and mortgage accounts for spending findings; note their booked balance only if cash is tight. Do not fetch any other window. If a range comes back empty, say the bank returned nothing.
+2. Work out each account's role from what flows through it: everyday account (salary in, cards and bills out), transfer or holding account (mostly moves between my own accounts), savings, or liability. Use the role so you do not misread things: a transfer account running low means "top up", not "short before payday". Do not lead with the role; offer set_account_label only as a follow-up. Do not invent accounts I have not linked; if a payee suggests one (a card bill, a rent payment), say so.
+3. Main currency is the one my income arrives in and my cards are paid from, not an empty travel wallet. Quote and rank in it. Do not invent exchange rates. If a charge was billed in another currency, keep the billed currency; show both only for a currency-fee finding.
+4. Scan for: (a) running short: project the next low point from the usual cadence of income and bills, and flag overdraft or failed-payment risk if the booked balance looks tight. (b) needless cost: duplicates (same name, same amount, days apart), recurring charges that look forgotten or are new, a merchant whose amount stepped up, avoidable currency or card fees. (c) changed without asking: a regular debit rose, a regular credit shrank or missed, a new regular payment appeared. For each: amount at stake per month or per year, urgency (cash-tight first), confidence (low when names are vague or the history is short).
+5. Output at most three findings, most expensive or most urgent first, and say in one line if you dropped others. Each finding: one sentence of fact, the amount, the confidence, then one concrete action (cancel, query this charge, top up before a date, connect the account a bill suggests). Give an estimated monthly or yearly saving when the finding is a cost; for running short, give a date instead. If nothing is worth doing, say so in one line and ask one useful question.
+6. Offer, not perform: subscription-audit for the full recurring table, unusual-transactions if I suspect something is wrong beyond these three, build-budget if I want a plan.
+
 ${accountsContext()}`));
     server.registerPrompt("monthly-summary", {
         title: "Monthly summary",

package/dist/lib/server.js

@@ -6,6 +6,15 @@ import { createApp } from "./app.js";
 import { setupAvailable } from "./setup.js";
 const app = createApp({ remote: true });
 const tls = tlsOptions();
+// In local mode config.baseUrl is https://localhost:PORT, but this entry point
+// only speaks TLS when a certificate is configured. Serving plain http while
+// advertising https leaves the setup page and the bank redirect unreachable,
+// so say what is wrong instead of starting into a broken state.
+if (config.localMode && !tls) {
+    console.error(`[bank] BANKMCP_LOCAL=1 makes the public URL ${config.baseUrl}, but no TLS certificate is configured, so this process can only serve http.\n` +
+        `[bank] Run the stdio entry point instead (npx bankmcp), which terminates TLS itself, or set TLS_CERT_PATH and TLS_KEY_PATH.`);
+    process.exit(1);
+}
 const httpServer = tls ? createHttpsServer(tls, app) : createHttpServer(app);
 httpServer.listen(config.port, () => {
     console.log(`[bank ${new Date().toISOString()}] listening on ${tls ? "https" : "http"}://0.0.0.0:${config.port}, public URL ${config.baseUrl}`);

package/dist/lib/store.js

@@ -4,6 +4,10 @@
 import { mkdirSync, readFileSync, renameSync, writeFileSync, existsSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { config } from "./config.js";
+/** How long a started-but-unfinished bank login stays interesting. */
+export const PENDING_AUTH_TTL_MS = 60 * 60 * 1000;
+/** True while a pending authorization is recent enough to still be completed. */
+export const pendingAuthIsLive = (p, now = Date.now()) => Date.parse(p.started) >= now - PENDING_AUTH_TTL_MS;
 const empty = () => ({
     version: 1,
     sessions: {},
@@ -109,9 +113,8 @@ export class Store {
     // --- Pending bank authorizations ---
     addPendingAuth(p) {
         this.update((d) => {
-            const cutoff = Date.now() - 60 * 60 * 1000;
             for (const [k, v] of Object.entries(d.pending_auth))
-                if (Date.parse(v.started) < cutoff)
+                if (!pendingAuthIsLive(v))
                     delete d.pending_auth[k];
             d.pending_auth[p.state] = p;
         });

package/dist/lib/tools.js

@@ -2,7 +2,7 @@ import { randomUUID } from "node:crypto";
 import { z } from "zod";
 import { config, isConfigured } from "./config.js";
 import { eb, EnableBankingError } from "./enablebanking.js";
-import { store } from "./store.js";
+import { pendingAuthIsLive, store } from "./store.js";
 import { daysAgo, daysLeft, describeAccount, isoDate, simplifyBalances, simplifyTransaction } from "./data.js";
 import { runWatches } from "./watcher.js";
 const MAX_CONSENT_DAYS = 180;
@@ -135,7 +135,11 @@ export function registerTools(server) {
                 accounts: s.accounts().filter((a) => a.session_id === session.id).length,
             });
         }
-        const pending = Object.values(s.data.pending_auth).map((p) => ({ bank: p.bank.name, started: p.started }));
+        // Expired ones are only swept when the next login starts, so filter here
+        // too; listing logins that can no longer be completed just misleads.
+        const pending = Object.values(s.data.pending_auth)
+            .filter((p) => pendingAuthIsLive(p))
+            .map((p) => ({ bank: p.bank.name, started: p.started }));
         return json({ banks, pending_logins: pending, hint: banks.length ? undefined : "No bank connected yet. Use start_consent." });
     }));
     server.registerTool("disconnect_bank", {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "bankmcp",
-  "version": "0.1.2",
+  "version": "0.1.4",
   "description": "BankMCP™: self-hosted, read-only MCP server that lets any AI assistant (Claude, ChatGPT, Mistral, Cursor, or a local model) answer questions about your own bank accounts via open banking (Enable Banking, PSD2)",
   "license": "MIT",
   "type": "module",