MCP server for IBANforge — IBAN validation, BIC/SWIFT lookup, Swiss BC-Nummer (1,100+ SIX entries, refreshed monthly), EMI/vIBAN classification, SEPA + VoP reachability and compliance risk scoring.
ibanforge-mcp provides 11 well-named, domain-specific tools with clear descriptions and detailed input schemas. Tool names follow verb_noun conventions (validate_iban, lookup_bic, check_compliance) and are specific to their domain. Descriptions are substantive and include pricing information, aiding agent decision-making. All tools have explicit JSON Schema input definitions with type declarations and parameter descriptions. However, output schemas are not documented in the visible source, the mcp.json file defines inputs only. No tool annotations (readOnlyHint/destructiveHint/idempotentHint) are present, and error handling guidance is absent from the tool definitions. The server's main limitation is STDIO-only transport, which caps protocolReadiness but does not directly impact definition quality.
Validate up to 100 IBANs in one call, with the same enrichment as a single validation. Cost: $0.002 USDC per IBAN (e.g. 100 IBANs = $0.20).
Pre-flight compliance triage on an IBAN or a BIC: bank-level sanctions screening, FATF jurisdiction flag, SEPA Instant reachability, VoP participation and a 0-100 risk score. Cost: $0.02 USDC.
Check a structured ISO 20022 postal address against one payment rail's published rules (sps, hvps_plus or fedwire), each finding citing its source document. Cost: free.
Check a Swiss QR-bill payload (the SPC text inside the QR code): header, creditor IBAN and QR-IBAN range, QRR/SCOR/NON reference checksums and pairing, amount, currency, and whether the addresses are structured (type S) or still combined (type K), with a proposed structured form. Cost: free.
Resolve a BIC/SWIFT code into the institution behind it: legal name, country, city, LEI and registered address where published. Cost: $0.003 USDC.
Output schemas not documented. Tools return data but the mcp.json file does not specify response field structures, types, or what data agents should expect. LLMs cannot plan downstream tool calls or extract chaining IDs without knowing what fields are returned.
No tool annotations (readOnlyHint, destructiveHint, idempotentHint). Tools like send_feedback and request_api_key have side effects but are not marked as destructive/write. Agents cannot distinguish safe retries from irreversible operations.
check_compliance parameter validation incomplete. The 'required' array is empty but the description says 'never both' iban and bic. This is an undocumented mutual-exclusion constraint that must be enforced and clearly stated.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-22 | C | 69 | 2026-07-28+ | v2 |
Resolve a Swiss BC-Nummer / IID into the institution, its seat address, its BIC and its full payment-rail participation including QR-IID. Cost: $0.003 USDC.
Collect the key once a human has approved the request opened by request_api_key. Handed over exactly once, with the config line to paste. Cost: free.
Open a key request a human approves in a browser, with no e-mail address and no account. Show the code and the link to your human, then call poll_api_key. Cost: free.
Report incorrect data or claim an x402 refund, without opening an account. Cost: free.
Validate one IBAN and enrich it with the issuing bank, BIC, EMI/vIBAN class, SEPA + VoP reachability, risk indicators and Swiss BC-Nummer. Cost: $0.005 USDC.
Check a structured payment reference (RF/ISO 11649, Swiss QRR, Belgian OGM/VCS, Finnish viitenumero) against the dated document that publishes its rule. Cost: free.
No error handling guidance in tool definitions. Descriptions lack recovery paths (e.g. 'If IBAN is invalid, call validate_payment_reference to check the reference format'). Error responses will not guide agents to self-correct.
request_api_key and poll_api_key have vague parameter descriptions. 'Leave empty' is ambiguous, does it mean null, empty string, or omit the field? Formal types and clear defaults are needed.
check_postal_address 'address' parameter is documented as an object but the schema lacks a properties definition. The nested structure (strt_nm, bldg_nb, pst_cd, etc.) is described in text only, not in the schema. LLMs must infer structure from prose.