bankmcp 0.1.3 → 0.1.5

package/README.md

@@ -71,6 +71,12 @@ Your browser will warn once about the certificate on localhost, which the
 server made for itself because Enable Banking requires https for the bank
 redirect. Continue past it. Say "connect my bank" and log in at your bank.
 
+To avoid the warning altogether, use a certificate your browser already
+trusts: [mkcert](https://github.com/FiloSottile/mkcert) makes one with
+`mkcert localhost 127.0.0.1`; point `TLS_CERT_PATH` and `TLS_KEY_PATH` at the
+two files and the server uses them instead of generating its own. BankMCP™
+itself does not touch your system's trust store.
+
 State lives in `~/.bankmcp`. Delete the folder to forget everything.
 
 ### On a server
@@ -286,20 +292,26 @@ Requires Node 24 or newer (runs TypeScript directly, no build step).
 ## Layout
 
 ```
-src/server.ts         Express: /mcp behind OAuth, OAuth endpoints, /callback, status page
-src/auth.ts           single-user OAuth provider, password login page
-src/mcp.ts            McpServer factory (tools + prompts + instructions)
+src/stdio.ts          entry point for npx bankmcp: stdio server plus the localhost https side
+src/server.ts         entry point for a hosted deployment: OAuth, /mcp, callback, status page
+src/app.ts            the Express app shared by both entry points
+src/local.ts          localhost https server and self-signed certificate for local mode
+src/mcp.ts            McpServer factory (tools, prompts, instructions)
 src/tools.ts          the MCP tools
 src/prompts.ts        the MCP prompts
 src/watcher.ts        background rule checks and notifications
+src/auth.ts           single-user OAuth provider
+src/setup.ts          first-run setup: validates and stores id, key and password
+src/pages.ts          the HTML pages: setup, sign-in, connected, status, privacy, terms
+src/config.ts         environment and data-directory configuration
 src/enablebanking.ts  JWT signing and a thin typed API client
 src/store.ts          the JSON state file
 src/data.ts           shaping balances and transactions for an assistant
-src/stdio.ts          local entry point (stdio, used by `npx bankmcp`)
-src/local.ts          localhost https server for setup and the bank redirect in local mode
-src/app.ts            the Express app shared by both modes
 src/cli.ts            check, hash-password, watch
-plugin/               Claude Code plugin with the bank skill
+bin/bankmcp.js        the npx entry; dispatches to stdio or cli
+scripts/              build-mcpb.sh (Claude Desktop bundle), local-chat.ts (Ollama bridge)
+plugin/               Claude Code plugin: setup and deploy skills, bank skill
+docs/                 landing page (GitHub Pages, bankmcp.dk)
 ```
 
 ## What this is, and is not

package/bin/bankmcp.js

@@ -5,4 +5,12 @@ if (major < 24) {
   console.error(`BankMCP needs Node 24 or newer (you have ${process.versions.node}).`);
   process.exit(1);
 }
-await import("../dist/lib/stdio.js");
+// A bare `bankmcp` is the stdio server an MCP client launches. Anything with
+// arguments is a command for the person at the keyboard, and those look in the
+// same place the local server keeps its state.
+if (process.argv.length > 2) {
+  process.env.BANKMCP_LOCAL ??= "1";
+  await import("../dist/lib/cli.js");
+} else {
+  await import("../dist/lib/stdio.js");
+}

package/dist/lib/cli.js

@@ -94,6 +94,6 @@ switch (command) {
         break;
     }
     default:
-        console.log("Usage: node src/cli.ts <hash-password [password] | check | watch [--force]>");
+        console.log("Usage: bankmcp <hash-password [password] | check | watch [--force]>");
         process.exit(command ? 1 : 0);
 }

package/dist/lib/local.js

@@ -2,24 +2,60 @@
 // page and receives the bank redirect. Enable Banking requires https redirect
 // URLs, so a self-signed certificate is created on first run.
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { X509Certificate } from "node:crypto";
 import { join } from "node:path";
 import { createServer as createHttpsServer } from "node:https";
 import selfsigned from "selfsigned";
-import { config } from "./config.js";
+import { config, tlsOptions } from "./config.js";
 import { createApp } from "./app.js";
 let server;
 let starting;
+/** Browsers reject server certificates valid for more than 398 days; earlier versions issued 10-year ones. */
+export function certificateStillGood(pem, now = Date.now()) {
+    try {
+        const x = new X509Certificate(pem);
+        const from = Date.parse(x.validFrom);
+        const to = Date.parse(x.validTo);
+        const day = 86_400_000;
+        return to - from <= 398 * day && to - now > 30 * day;
+    }
+    catch {
+        return false;
+    }
+}
 async function certificate() {
+    // An explicitly configured certificate wins, so anyone who would rather use
+    // one their browser already trusts (mkcert and friends) can point at it
+    // instead of trusting the generated one. `server.ts` already honours these.
+    const configured = tlsOptions();
+    if (configured)
+        return configured;
     const certPath = join(config.dataDir, "localhost-cert.pem");
     const keyPath = join(config.dataDir, "localhost-key.pem");
-    if (existsSync(certPath) && existsSync(keyPath))
-        return { cert: readFileSync(certPath, "utf8"), key: readFileSync(keyPath, "utf8") };
+    if (existsSync(certPath) && existsSync(keyPath)) {
+        const cert = readFileSync(certPath, "utf8");
+        if (certificateStillGood(cert))
+            return { cert, key: readFileSync(keyPath, "utf8") };
+        console.error("[bank] replacing the stored localhost certificate (too long-lived or about to expire)");
+    }
+    // Apple caps TLS server certificate lifetime at 398 days; Chrome on macOS
+    // defers to the system verifier and rejects anything longer as ERR_CERT_INVALID,
+    // which offers no click-through. Stay just under the limit.
     const notAfterDate = new Date();
-    notAfterDate.setFullYear(notAfterDate.getFullYear() + 10);
+    notAfterDate.setDate(notAfterDate.getDate() + 397);
     const pems = await selfsigned.generate([{ name: "commonName", value: "localhost" }], {
         keySize: 2048,
         notAfterDate,
-        extensions: [{ name: "subjectAltName", altNames: [{ type: 2, value: "localhost" }, { type: 7, ip: "127.0.0.1" }] }],
+        // selfsigned defaults to sha1, which browsers reject outright as
+        // ERR_CERT_INVALID with no click-through. macOS additionally requires
+        // basicConstraints and an extendedKeyUsage of serverAuth.
+        algorithm: "sha256",
+        extensions: [
+            { name: "basicConstraints", cA: false, critical: true },
+            { name: "keyUsage", digitalSignature: true, keyEncipherment: true, critical: true },
+            { name: "extKeyUsage", serverAuth: true },
+            { name: "subjectAltName", altNames: [{ type: 2, value: "localhost" }, { type: 7, ip: "127.0.0.1" }] },
+        ],
     });
     mkdirSync(config.dataDir, { recursive: true });
     writeFileSync(certPath, pems.cert, { mode: 0o600 });

package/dist/lib/mcp.js

@@ -1,7 +1,7 @@
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { registerTools } from "./tools.js";
 import { registerPrompts } from "./prompts.js";
-export const VERSION = "0.1.3";
+export const VERSION = "0.1.5";
 export function createServer() {
     const server = new McpServer({ name: "bank", version: VERSION }, {
         instructions: [

package/dist/lib/server.js

@@ -6,6 +6,15 @@ import { createApp } from "./app.js";
 import { setupAvailable } from "./setup.js";
 const app = createApp({ remote: true });
 const tls = tlsOptions();
+// In local mode config.baseUrl is https://localhost:PORT, but this entry point
+// only speaks TLS when a certificate is configured. Serving plain http while
+// advertising https leaves the setup page and the bank redirect unreachable,
+// so say what is wrong instead of starting into a broken state.
+if (config.localMode && !tls) {
+    console.error(`[bank] BANKMCP_LOCAL=1 makes the public URL ${config.baseUrl}, but no TLS certificate is configured, so this process can only serve http.\n` +
+        `[bank] Run the stdio entry point instead (npx bankmcp), which terminates TLS itself, or set TLS_CERT_PATH and TLS_KEY_PATH.`);
+    process.exit(1);
+}
 const httpServer = tls ? createHttpsServer(tls, app) : createHttpServer(app);
 httpServer.listen(config.port, () => {
     console.log(`[bank ${new Date().toISOString()}] listening on ${tls ? "https" : "http"}://0.0.0.0:${config.port}, public URL ${config.baseUrl}`);

package/dist/lib/store.js

@@ -4,6 +4,10 @@
 import { mkdirSync, readFileSync, renameSync, writeFileSync, existsSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { config } from "./config.js";
+/** How long a started-but-unfinished bank login stays interesting. */
+export const PENDING_AUTH_TTL_MS = 60 * 60 * 1000;
+/** True while a pending authorization is recent enough to still be completed. */
+export const pendingAuthIsLive = (p, now = Date.now()) => Date.parse(p.started) >= now - PENDING_AUTH_TTL_MS;
 const empty = () => ({
     version: 1,
     sessions: {},
@@ -109,9 +113,8 @@ export class Store {
     // --- Pending bank authorizations ---
     addPendingAuth(p) {
         this.update((d) => {
-            const cutoff = Date.now() - 60 * 60 * 1000;
             for (const [k, v] of Object.entries(d.pending_auth))
-                if (Date.parse(v.started) < cutoff)
+                if (!pendingAuthIsLive(v))
                     delete d.pending_auth[k];
             d.pending_auth[p.state] = p;
         });

package/dist/lib/tools.js

@@ -2,7 +2,7 @@ import { randomUUID } from "node:crypto";
 import { z } from "zod";
 import { config, isConfigured } from "./config.js";
 import { eb, EnableBankingError } from "./enablebanking.js";
-import { store } from "./store.js";
+import { pendingAuthIsLive, store } from "./store.js";
 import { daysAgo, daysLeft, describeAccount, isoDate, simplifyBalances, simplifyTransaction } from "./data.js";
 import { runWatches } from "./watcher.js";
 const MAX_CONSENT_DAYS = 180;
@@ -135,7 +135,11 @@ export function registerTools(server) {
                 accounts: s.accounts().filter((a) => a.session_id === session.id).length,
             });
         }
-        const pending = Object.values(s.data.pending_auth).map((p) => ({ bank: p.bank.name, started: p.started }));
+        // Expired ones are only swept when the next login starts, so filter here
+        // too; listing logins that can no longer be completed just misleads.
+        const pending = Object.values(s.data.pending_auth)
+            .filter((p) => pendingAuthIsLive(p))
+            .map((p) => ({ bank: p.bank.name, started: p.started }));
         return json({ banks, pending_logins: pending, hint: banks.length ? undefined : "No bank connected yet. Use start_consent." });
     }));
     server.registerTool("disconnect_bank", {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "bankmcp",
-  "version": "0.1.3",
+  "version": "0.1.5",
   "description": "BankMCP™: self-hosted, read-only MCP server that lets any AI assistant (Claude, ChatGPT, Mistral, Cursor, or a local model) answer questions about your own bank accounts via open banking (Enable Banking, PSD2)",
   "license": "MIT",
   "type": "module",