← Back to Documentation Hub

MCP Protocol Reference

Bancony uses the Model Context Protocol (MCP) to expose banking tools to the AI agent. This page documents the protocol implementation.

Connection

GET /mcp/sse

Server-Sent Events endpoint for MCP protocol. Establishes a persistent connection for receiving tool responses.

POST /mcp/messages

JSON-RPC message endpoint. Send tool calls and receive responses.

Authentication

Security Model

Bancony uses a secure authentication flow:

User → Auth Service: OAuth login, token returned as httpOnly cookie (XSS protection)
User → Agent (WebSocket): Cookie sent automatically by browser, never in URL
Agent → MCP Server: Token forwarded via HTTP headers (server-to-server)

MCP Server Headers

The Agent forwards authentication to MCP Server via HTTP headers on the SSE connection:

Header	Description	Example
`Authorization`	Bearer token (forwarded from cookie)	`Bearer eyJhbGc...`
`X-Bancony-Integration`	Bank integration to use	`menigademo`, `landsbankinn`
`X-Bancony-Culture`	Locale for responses	`en-GB`, `is-IS`

Note: Tokens are never exposed in URLs, localStorage, or JavaScript-accessible storage.

Available Methods

tools/list

Get all available banking tools and their schemas.

{
  "jsonrpc": "2.0",
  "method": "tools/list",
  "id": 1
}

tools/call

Execute a specific banking tool with parameters.

{
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "name": "get-accounts",
    "arguments": {
      "only_withdrawal_accounts": true
    }
  },
  "id": 2
}

Response Format

Tool responses follow JSON-RPC 2.0 format:

Success Response

{
  "jsonrpc": "2.0",
  "result": {
    "content": [
      {
        "type": "text",
        "text": "{\"accounts\": [...]}"
      }
    ]
  },
  "id": 2
}

Error Response

{
  "jsonrpc": "2.0",
  "error": {
    "code": -32000,
    "message": "Tool execution failed",
    "data": { "details": "..." }
  },
  "id": 2
}

Available Integrations

Integration	Description	Auth Method
`demo`	Demo bank for testing	Token
`menigademo`	Meniga Cloud API demo	Email/Password
`menigais`	Meniga Iceland production	Email/Password
`landsbankinn`	Landsbankinn (Iceland)	Electronic ID