Overview

This MCP (Model Context Protocol) server provides a lightweight bridge between Starling Bank accounts and applications that need secure, programmatic access to balances and transaction history. It implements a simple REST API that forwards authenticated requests to the Starling Bank API, while applying access controls and signing appropriate responses for use with LLMs or other model-driven systems that consume “model context” data.

The server is useful when you want to expose a constrained, auditable interface to a Starling account for third‑party services, chatbots, or internal tools without embedding full API tokens in every client. It centralises account credentials, enforces session policies, and formats account and transaction data in a predictable way for downstream consumers.

Features

Secure proxying of Starling Bank API calls (balances, transactions, account info)
Minimal REST endpoints designed for model-context integration
Session-based access / signed responses for auditability
Configurable via environment variables and suitable for Docker deployment
Simple JSON responses intended for easy parsing by LLMs and other agents
Lightweight Node.js implementation (installable and runnable locally)

Installation / Configuration

Prerequisites: Node 16+ and a Starling API token (personal API or business API as appropriate).

Clone and install:

git clone https://github.com/domdomegg/starling-bank-mcp.git
cd starling-bank-mcp
npm install

Create a .env file in the project root. Minimal example:

# .env
PORT=3000
STARLING_API_TOKEN=your-starling-api-token-here
STARLING_ACCOUNT_UID=your-account-uid
MCP_SIGNING_KEY=base64-or-hex-signing-key
SESSION_TTL_SECONDS=300

Environment variables

Variable	Purpose	Default
PORT	HTTP server port	3000
STARLING_API_TOKEN	Starling API token used to call Starling endpoints	(required)
STARLING_ACCOUNT_UID	UID of the account you want to expose	(recommended)
MCP_SIGNING_KEY	Key used to sign session tokens/responses	(required)
SESSION_TTL_SECONDS	How long MCP sessions are valid (seconds)	300

Run locally:

npm start
# or for development
npm run dev

Docker (example):

# Dockerfile example
FROM node:18-alpine
WORKDIR /app
COPY package*.json ./
RUN npm ci --only=production
COPY . .
ENV PORT=3000
CMD ["node", "server.js"]

Build and run:

docker build -t starling-mcp .
docker run -e STARLING_API_TOKEN=... -e MCP_SIGNING_KEY=... -p 3000:3000 starling-mcp

Security notes:

Treat STARLING_API_TOKEN and MCP_SIGNING_KEY as secrets. Use a secrets manager in production.
Limit network access to the MCP server and enable TLS termination (reverse proxy) in front of it.
Rotate keys periodically and revoke tokens in Starling if compromised.

Available Tools

The server exposes a compact set of REST endpoints. The exact paths may vary by implementation; substitute host and port as needed.

Common endpoints:

GET /health — simple health check
GET /accounts — list configured Starling accounts
GET /balances?accountId={id} — current balances for an account
GET /transactions?accountId={id}&from={YYYY-MM-DD}&to={YYYY-MM-DD} — transaction history
POST /mcp/session — create a signed session token for short-lived model access
POST /mcp/query — submit an MCP-style query that returns signed context (optional depending on repo version)

Example: fetch balances with curl

curl -H "Authorization: Bearer ${MCP_API_KEY}" \
  "http://localhost:3000/balances?accountId=${STARLING_ACCOUNT_UID}"

Example Node fetch:

import fetch from 'node-fetch';
const res = await fetch(`http://localhost:3000/transactions?accountId=${acct}&from=2026-01-01&to=2026-02-01`, {
  headers: { Authorization: `Bearer ${process.env.MCP_API_KEY}` }
});
const data = await res.json();
console.log(data);

Response examples (simplified):

Balances:

{
  "accountId": "abcd-1234",
  "available": 1234.56,
  "currency": "GBP",
  "updated": "2026-04-10T12:34:56Z"
}

Transactions:

{
  "accountId": "abcd-1234",
  "transactions": [
    { "id": "tx1", "date": "2026-04-09", "amount": -12.34, "description": "Coffee" },
    { "id": "tx2", "date": "2026-04-08", "amount": 1000.00, "description": "Salary" }
  ]
}

Use Cases

Chatbot financial assistant: integrate the MCP server as a secure data provider for a chatbot. The bot requests a signed context token from /mcp/session and calls /transactions to show recent spending without ever storing the Starling API token in the bot.
Personal finance dashboard: display account balances and recent transactions in a web dashboard that queries the MCP server rather than the bank API directly. The server can implement caching and rate-limiting.
Reporting & reconciliation: scheduled jobs pull transaction history from /transactions for accounting and generate reports. Centralised credentials simplify rotation and auditing.
LLM prompt enrichment: generate signed, time-limited context payloads containing a user’s recent transactions for an LLM to reason over, keeping raw bank credentials out of model prompts.

Troubleshooting & Tips

401 Unauthorized: check STARLING_API_TOKEN and MCP signing key validity. Ensure the Starling token has the expected permissions and the account UID matches.
Rate limits: Starling enforces rate limits. Add retries with backoff in clients or enable caching in the MCP server.
Logging: enable verbose logs in development to inspect request/response flows; avoid logging full tokens or sensitive account details.

For code-level details and the exact endpoint list, consult the repository source and the Starling Bank API docs. The MCP server is intended to be a small, transparent adapter—inspect and modify it to suit your security posture and integration needs.

Starling Bank MCP Server Balances and Transaction History