Sandbox / simulated — not a real bank. Balances, accounts and transactions on this site are synthetic demo data. This is not a real bank or a real customer.
Sign in

Security

What Banker MCP does and does not do with access and data. This page describes the design of the software in this version.

Read-only by construction

The bank adapter interface has no method that moves money or changes an account. There is nothing to switch on by mistake.

No passwords

Sign-in is Google or passkeys (WebAuthn). We never see or store a password.

Keys stored as hashes

API keys are shown once and kept only as a SHA-256 hash. Revoke any key instantly.

Card data stays with Paystack

Checkout is hosted by Paystack. Webhooks are verified by HMAC-SHA512 signature and processed once.

Every access is counted

Each authenticated request is written to a usage ledger with the key, tool, bank, outcome and whether data was simulated.

Strict browser policy

The site loads no third-party scripts, fonts or trackers, and sets a same-origin content security policy.

Not claimed

This service has not yet been independently audited or penetration-tested, and holds no third-party certification. We will publish those results here when they exist.