Skip to main content
Glama
OnurByte

TurkishBankMCP

by OnurByte

TurkishBankMCP

TurkishBankMCP tamamen açık kaynak ve MIT lisanslı bir proje

Şu an sadece Garanti BBVA için hazır

Başka banka kullanıyorsan kendi providerını ekleyebilirsin

Arada Kobaküs yok başka aggregator yok direkt Garanti

Amaç basit

Hermes OpenClaw veya başka bir MCP istemcisi hesap bilgini ve hesap hareketlerini okuyabilsin

Para gönderme ödeme başlatma EFT kart yönetme satın alma gibi şeyler yok

Kodda bunlara ait tool da yok

Garanti tarafında ne lazım

Garanti Developer Portal hesabı aç

Manage -> Applications -> Add Application yolundan yeni app oluştur

API Management kısmında sadece şunları seç

  • Account Information

  • Account Transactions

Başka ödeme transfer tahsilat API'si ekleme

Authentication kısmında callback URL HTTPS ve dışarıdan erişilebilir olmalı

Scope alanına OOB

Type alanına Confidential

Submit edince Client ID ve Client Secret geliyor

App önce Pending Approval olur

Garanti onayladıktan sonra canlı isteklere geçebilirsin

OAuth tarafını TurkishBankMCP kendi yapıyor

Garanti'nin resmi token endpointi hazır tanımlı

https://apis.garantibbva.com.tr/auth/oauth/v2/token

client_credentials ile token alıyor

Token hiçbir MCP cevabında gösterilmiyor

Related MCP server: saldo-mcp

Neden endpointleri env içine yazıyoruz

Garanti public sayfasında Account Information ve Account Transactions ürünlerinin varlığını gösteriyor

Ama bu ürünlerin gerçek endpoint path request method ve body şeması login arkasındaki API ekranında görünüyor

O yüzden burada path uydurmuyoruz

Portal sana ne gösteriyorsa aynısını .env içine koyuyorsun

Bu daha güvenli ve production için daha doğru

.env

Önce

cp .env.example .env

Sonra

GARANTI_CLIENT_ID=
GARANTI_CLIENT_SECRET=
GARANTI_REDIRECT_URI=https://senin-domainin.com/callback

GARANTI_ACCOUNT_INFORMATION_URL=
GARANTI_ACCOUNT_INFORMATION_METHOD=
GARANTI_ACCOUNT_INFORMATION_CONTENT_TYPE=application/json
GARANTI_ACCOUNT_INFORMATION_BODY_TEMPLATE=

GARANTI_ACCOUNT_TRANSACTIONS_URL=
GARANTI_ACCOUNT_TRANSACTIONS_METHOD=
GARANTI_ACCOUNT_TRANSACTIONS_CONTENT_TYPE=application/json
GARANTI_ACCOUNT_TRANSACTIONS_BODY_TEMPLATE=

Transaction URL veya body içinde şu alanları kullanabilirsin

{{accountRef}}
{{from}}
{{to}}
{{direction}}
{{minAmount}}
{{maxAmount}}
{{page}}
{{pageSize}}

Mesela Garanti dokümanı account id ve tarihleri query string içinde istiyorsa URL template kullanırsın

Body içinde istiyorsa body template kullanırsın

Kod GET ve POST destekliyor

JSON ve form-urlencoded body destekliyor

Client Secret dosyada dursun istersen

.env içine secret yazmak zorunda değilsin

GARANTI_CLIENT_SECRET_FILE=.secrets/garanti-client-secret

Dosya içindeki secret token yenilenirken tekrar okunur

İlk test

Kurulum

git clone git@github.com:OnurByte/TurkishBankMCP.git
cd TurkishBankMCP
npm install
cp .env.example .env
npm run check
npm run build

MCP Inspector aç

npm run inspect

İlk önce

bank_provider_status

Sonra

bank_test_connection

Bu sadece OAuth bağlantısını test eder

Başarılıysa

{
  "provider": "garanti-api-store",
  "oauth": "ok",
  "readOnly": true
}

görürsün

Access tokenı göstermez

Sonra

bank_list_accounts

ve

bank_list_transactions

ile gerçek API'yi test edebilirsin

MCP tool'ları

bank_provider_status
bank_test_connection
bank_list_accounts
bank_get_balances
bank_list_transactions

Hepsi read-only olarak işaretli

Hermes

Build aldıktan sonra

mcp_servers:
  turkish_bank:
    command: "node"
    args:
      - "/absolute/path/to/TurkishBankMCP/dist/index.js"

Sonra mesela

Bugünkü hesap hareketlerime bak
ne kadar para geldi ne kadar çıktı söyle
tekrarlayan harcamaları bul
bana kısa bir finans özeti çıkar
hiçbir finansal işlem yapma

diyebilirsin

Şu an Garanti response şeması public dokümanda yayınlanmadığı için MCP bankadan gelen Account Information ve Account Transactions cevabını bozmadan döndürüyor

İlk gerçek response geldiğinde normalizerı o gerçek şemaya göre sabitlemek daha doğru

Güvenlik

Portal app'ine sadece Account Information ve Account Transactions yetkisi ver

Client Secret ve token MCP tool çıktısına girmez

401 gelirse token bir kere otomatik yenilenir

429 ve geçici 5xx hatalarında kontrollü retry var

Endpoint URL'sinde transfer payment EFT tahsilat kredi kart yönetimi gibi ifadeler varsa config güvenlik için reddedilir

TurkishBankMCP içinde ödeme veya transfer tool'u yok

Hermes'e ayrıca sınırsız shell ve filesystem yetkisi verirsen o ayrı güvenlik sınırı

Sıkça sorulan sorular

Bu proje ücretsiz mi

Evet proje tamamen açık kaynak ve ücretsiz

Garanti API Store'un canlı kullanım şartları ise Garanti'nin onayına bağlı

Başka banka kullanıyorum ne yapacağım

Bu sürüm sadece Garanti için hazır

Başka banka kullanıyorsan kendi providerını ekleyebilirsin

Banka şifremi girmem gerekiyor mu

Hayır bu entegrasyon internet bankacılığı şifresiyle çalışmıyor

Developer Portal üzerinden verilen Client ID ve Client Secret kullanılıyor

AI para gönderebilir mi

Bu MCP üzerinden hayır

Ödeme transfer EFT veya kart yönetim tool'u yok

Token Hermes'e gider mi

Hayır

Token sadece provider içinde kullanılıyor

Neden endpoint URL'sini kendim yazıyorum

Çünkü Garanti ürün endpointlerini ve request şemasını portal içindeki API dokümanında gösteriyor

Public sayfada bunların path'i yayınlanmıyor

Callback URL şart mı

Garanti'nin kendi FAQ dokümanına göre evet

HTTPS ve dışarıdan erişilebilir olmalı

Önce sadece OAuth test edebilir miyim

Evet bank_test_connection bunun için var

App'e başka Garanti API'leri ekleyebilir miyim

Bu proje için ekleme

Sadece Account Information ve Account Transactions seçmek en güvenlisi

Response neden normalize edilmiyor

Garanti'nin gerçek response şemasını görmeden alan adı uydurmak istemiyoruz

İlk canlı veya sandbox response ile normalizer eklenebilir

Projeye katkı verebilir miyim

Tabii

Repo açık kaynak

Kaynaklar

Lisans

MIT

Available Tools

5 tools
bank_get_balancesC
Read-onlyIdempotent

Read account information from Garanti. This uses the same Account Information product because the public portal does not document a separate balance API.

ParametersJSON Schema
NameRequiredDescriptionDefault
pageNo
pageSizeNo

TDQS

C2.6/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With annotations already declaring readOnlyHint=true, idempotentHint=true, and destructiveHint=false, the description adds some context by explaining that the tool uses the Account Information product due to the lack of a separate balance API. This gives insight into the implementation but does not disclose return format, pagination behavior, or other relevant traits.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single sentence, front-loaded with the purpose, and contains no filler. Every part earns its place, even though it is short.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool has no output schema, and the description does not explain what return data to expect (e.g., balance amounts, account identifiers, or formatting). It also lacks any mention of pagination despite page/pageSize parameters. For a simple read tool this is incomplete; the why clause about the Account Information product does not fill the gap.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters1/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate, but it provides no information about the page and pageSize parameters. The schema only gives type and numeric constraints, which do not add semantic meaning. The description says nothing about pagination or how these parameters affect results.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose3/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a clear verb ('Read') and resource ('account information'), but it is vague about 'account information'—the tool name implies balances, yet the description does not mention balances explicitly. It also does not distinguish this from the sibling tool bank_list_accounts, which likely also reads account information.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides no guidance on when to use this tool versus alternatives. It only explains that it uses the same Account Information product because no separate balance API exists, which is contextual background rather than usage direction. No exclusions or alternative tool references are given.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

bank_list_accountsD
Read-onlyIdempotent

Call Garanti Account Information and return its read-only response.

ParametersJSON Schema
NameRequiredDescriptionDefault
pageNo
pageSizeNo

TDQS

D1.7/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true, idempotentHint=true, and destructiveHint=false. The description adds only the phrase 'read-only response,' which repeats the annotation rather than adding new behavioral context such as pagination behavior, response format, or error handling.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness2/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single short sentence, which is concise, but it lacks substance. It does not earn its place because it provides minimal value; a clearer, slightly longer description could be more useful without being verbose.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With two optional parameters, no output schema, and no parameter descriptions, the description is incomplete. It does not clarify what the tool returns, how pagination works, or any constraints, making it insufficient for an agent to fully understand the tool's behavior.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters1/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema has 0% description coverage, and the description does not explain the 'page' and 'pageSize' parameters. It fails to convey that these likely control pagination, leaving the agent without any clue about how to set them.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose2/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description says 'Call Garanti Account Information and return its read-only response,' which is vague and doesn't clearly state that the tool lists accounts. It lacks a specific verb like 'list' or 'fetch' tied to the resource, and it doesn't differentiate from siblings like bank_get_balances or bank_list_transactions.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines1/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no guidance on when to use this tool versus alternatives. The description does not mention any context, prerequisites, or exclusions, leaving the agent without enough information to decide between this and sibling tools.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

bank_list_transactionsB
Read-onlyIdempotent

Call Garanti Account Transactions for an account and date range. No payment or transfer endpoint is available to this MCP.

ParametersJSON Schema
NameRequiredDescriptionDefault
toYesISO date-time
fromYesISO date-time
pageNo
pageSizeNo
directionNo
maxAmountNo
minAmountNo
accountRefYes

TDQS

B3.1/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint, idempotentHint, and destructiveHint, so the safety profile is covered. The description adds a behavioral limitation ('No payment or transfer endpoint is available to this MCP') but does not disclose pagination behavior, auth requirements, or what data is returned. This is acceptable but not enriching.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise, with two sentences that each provide relevant information. The first sentence states the core function and scope, while the second adds a system limitation. It is appropriately sized and does not waste words, though the phrasing 'Call Garanti Account Transactions' is slightly awkward.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool has 8 parameters and no output schema, the description is incomplete. It does not describe what the tool returns (e.g., a list of transactions), nor does it mention pagination, filtering behaviors, or the meaning of ambiguous parameters like direction or min/maxAmount. It relies heavily on annotations and schema, which are insufficient for this complexity.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is only 25%, with only 'ISO date-time' provided for from/to and no explanations for page, pageSize, direction, minAmount, maxAmount, or accountRef. The description mentions 'account and date range' which adds some meaning to three params, but the majority of parameters remain unexplained, and the description does not compensate for the low coverage.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states the tool calls Garanti Account Transactions for an account and date range, which clearly identifies the resource and scoping. The verb 'Call' is somewhat generic, but combined with the name 'bank_list_transactions', the purpose is unambiguous and distinct from siblings like bank_get_balances.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides limited guidance on when to use this tool, only noting that no payment or transfer endpoint is available. It does not explicitly mention alternatives like bank_get_balances for balances or bank_list_accounts for accounts, so the usage context is only partially communicated.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

bank_provider_statusA
Read-onlyIdempotent

Show Garanti API Store configuration status without exposing credentials.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With annotations already declaring this a read-only, idempotent, non-destructive operation, the description adds value by emphasizing that credentials are not exposed. This is a meaningful safety guarantee beyond the annotations. However, it does not describe the exact nature of the status output or any rate limits.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, concise sentence that directly states what the tool does and a key safety property. No wasted words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool is simple with no parameters and no output schema, but the description adequately conveys its purpose and safety. It does not detail the exact return format, but for a status-check tool, this is not a critical omission given the sibling tool context.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has zero parameters, so the baseline score is 4. There is no schema coverage issue, and the description does not need to explain parameter behavior since none exist.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's function with a specific verb ('Show') and a specific resource ('Garanti API Store configuration status'), which distinguishes it from sibling tools focused on connections, accounts, balances, and transactions. The addition of 'without exposing credentials' also signals its unique safety scope.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The usage context is implied by the name and description—it is for checking configuration status—but there is no explicit guidance on when to use this tool versus alternatives like bank_test_connection. No mention of exclusions or prerequisites.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

bank_test_connectionA
Read-onlyIdempotent

Test Garanti OAuth client_credentials authentication. The access token is never returned.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A4.1/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The annotations already mark the tool as read-only and idempotent. The description adds meaningful context with 'The access token is never returned,' disclosing a security-relevant behavior that is not fully captured by the annotations. It does not contradict the annotations, and it offers a helpful guarantee about output behavior.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is exceptionally concise: two short sentences that front-load the purpose and then add a key behavioral note. Every word earns its place, with no filler or repetition of schema/annotation information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema, the description has the burden of explaining what the tool returns or how results are presented. It clearly states what is not returned (the token) but does not describe what is returned on success or failure. For a test tool, specifying outcome semantics (e.g., boolean, status message, exception behavior) would make it more complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has no parameters (100% schema coverage with an empty properties object). The baseline for zero parameters is 4, and there is no parameter information needed from the description. The description appropriately focuses on behavior rather than nonexistent inputs.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose: 'Test Garanti OAuth client_credentials authentication.' The verb 'Test' plus the specific resource ('Garanti OAuth client_credentials authentication') distinguishes this from sibling data tools like bank_list_accounts, bank_get_balances, and bank_list_transactions. The added note about the access token never being returned further clarifies that this is a pure authentication check, not a credential retrieval.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage—this tool should be used to verify OAuth authentication—but it does not explicitly say when to use it versus alternatives or when not to use it. With sibling tools like bank_provider_status, more explicit guidance on when to choose this test over a provider status check would be beneficial.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.

  1. 5 tool updatesv0.4.0
    • First observedbank_get_balances
    • First observedbank_list_accounts
    • First observedbank_list_transactions
    • First observedbank_provider_status
    • First observedbank_test_connection

TDQS

B3/5.0
Disambiguation3/5

bank_list_accounts and bank_get_balances overlap significantly since both read account information, with bank_get_balances explicitly noting it uses the same Account Information product. bank_provider_status and bank_test_connection are both connectivity-related but distinguishable as status vs. authentication test. Other tools are distinct.

Naming Consistency4/5

All tools share the bank_ prefix and most follow a verb_noun pattern (test_connection, list_accounts, get_balances, list_transactions). However, bank_provider_status uses a noun_noun construction, which is a minor deviation from the otherwise consistent pattern.

Tool Count5/5

Five tools is well-scoped for a read-only banking data server. Each tool serves a clear functional area (status, auth test, accounts, balances, transactions), and no tool feels superfluous.

Completeness4/5

The server covers the core read-only operations for banking data: accounts, balances, and transactions, plus connection testing. It lacks payment/transfer functionality, but the description explicitly states these are unavailable in the underlying API, so the surface is appropriate for the stated purpose with minor gaps.

Maintenance

ActivityMaintained
ResponsivenessSyncing

Resources

Unclaimed servers have limited discoverability.

Looking for Admin?

If you are the server author, to access and configure the admin panel.

Related MCP Connectors

Related MCP Servers

  • A
    license
    B
    quality
    D
    maintenance
    MCP server for Isbank (Is Bankasi) developer API (Turkey). Enables access to accounts, balances, transactions, exchange rates, transfers, and credit cards via OAuth 2.0 authentication.
    8
    14
    MIT
  • A
    license
    Not graded
    quality
    B
    maintenance
    A read-only MCP server that securely connects Swedish/Nordic bank accounts to AI assistants, keeping all financial data local and encrypted.
    21
    MIT
  • A
    license
    A
    quality
    B
    maintenance
    A read-only MCP server for Trading 212 accounts, enabling AI assistants to query balances, positions, orders, dividends, pies, and instruments without trading capabilities.
    12
    1
    MIT
  • A
    license
    Not graded
    quality
    B
    maintenance
    A read-only MCP server exposing Brazilian Open Finance personal financial data from Pluggy to MCP clients, enabling listing of connections, accounts, transactions, credit card bills, investments, and loans without moving money.
    MIT

Latest Blog Posts

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/OnurByte/TurkishBankMCP'

If you have feedback or need assistance with the MCP directory API, please join our Discord server