MCP — the Model Context Protocol — is an open standard for connecting an AI assistant to a specific source of information, with your permission. It is a plug socket, not a product. What matters for your money is what the thing on the other end of the plug is allowed to do: an MCP server can be built so it can only ever read, which means an assistant using it can answer questions about your finances and cannot touch them. That is a design decision, not a property of the protocol, so it is worth checking rather than assuming.
The problem MCP solves
An assistant knows an enormous amount about money in general and nothing at all about yours. It can explain what a Lifetime ISA is. It cannot tell you whether you paid into one this year. That gap is not a knowledge problem, it is a plumbing problem — the information exists, it is just not connected to anything.
Until recently there were two workarounds, both poor. You could paste in a statement, which works once, ages immediately, and dumps far more than you intended into a conversation. Or a provider could build a bespoke integration with one specific assistant, which meant every combination of app and assistant needed its own bridge built by hand. The result was that almost nothing was connected to anything.
MCP replaces both with a standard. One side is the client: the assistant. The other is the server: whatever holds the information, in this case an app that already has your categorised financial data. Because both sides implement the same open protocol, any client can talk to any server without either having been built for the other. That is the entire idea, and its ordinariness is the point — it is the same reason a plug fits a socket without the appliance manufacturer having phoned the electricity company.
What an MCP server actually is
An MCP server is a small program that publishes a list of things it can do, and then does those things when asked. The list is explicit. An assistant connected to a server can see exactly what is on offer and nothing else exists to be discovered.
The items on that list are the crux of the whole safety question. A server exposing get spending by category and get account balances can be asked for spending and balances. A server exposing make a payment can be asked to make a payment. There is no general power that comes with being connected; there is only the list.
This is why “is it connected to an assistant?” is close to a meaningless question and “what is on the list?” is the right one. Two products can both be MCP servers for your finances and differ completely in what they permit.
MCP is a protocol, like HTTPS or email. It is neither safe nor unsafe on its own. Asking whether MCP is secure is like asking whether a plug socket is dangerous: it depends entirely on what has been wired into it, and by whom. The useful questions are always about the specific server, not the standard.
How this differs from the alternatives
It is easier to see what MCP is by putting it next to the things it replaces.
| Approach | How current | What you expose | Can it act? |
|---|---|---|---|
| Pasting a statement | Stale from the moment you paste | Everything in the file, including rows you did not think about | No |
| Screen scraping | Live | Your banking credentials — the whole account | Depends; often yes |
| Handing over an API key | Live | Whatever that key permits, usually everything | Usually yes |
| A read-only MCP server | Live | Only the named items on the list | No — if built that way |
Screen scraping deserves particular attention because it is still around. It works by having software log into your online banking as you, using credentials you have handed over. Everything that account can do, that software can do. UK Open Banking exists in large part to make this unnecessary, and you should decline any product that asks for your banking password. There is more on that in our guide to what UK apps can and cannot do with your data.
Why it matters for money specifically
Three things change when an assistant can read your actual position rather than reason about a hypothetical one.
Answers stop being generic
“Can I afford a £900 holiday in March?” is unanswerable in the abstract and entirely answerable if the thing answering can see your committed costs, your typical discretionary spending and what is already earmarked. The improvement is not that the assistant became cleverer. It is that the question became well-posed.
The data stays current
A pasted statement describes a moment that has passed. A live connection means the answer on the 3rd and the answer on the 28th are different, which for anything to do with cash flow is the difference between useful and misleading.
Scope becomes something you can inspect
With a pasted file, you exposed whatever happened to be in it. With a defined server, there is a published list, and the list is the boundary. That is a better position to consent from, because you can read what you are agreeing to before you agree to it.
The trust model, honestly
A connection through MCP involves at least three parties, and it is worth being clear about who sees what.
- Your bank holds your accounts and authenticates you. Under Open Banking it never gives your credentials to anybody; it releases a limited, revocable data feed to a regulated provider.
- The app running the MCP server holds your categorised data and decides what the server exposes. This is where the read-only guarantee lives or fails.
- The assistant receives whatever it asks for from that list, and the resulting conversation sits with the assistant's provider under their terms.
That last point is the one people underrate. A read-only server means your money cannot be moved. It does not mean the conversation is private from the company that runs the assistant. If your financial position appearing in a chat log is a problem for you, that is a real consideration and no server design solves it — it is a question about the assistant, not the connection.
Equally, a live connection does not make an assistant correct. It can still misread a transfer as income or summarise a period it has partial data for. Grounding improves the raw material; it does not remove the need to sanity-check anything you are about to act on.
Where earmarkIQ Context fits
earmarkIQ Context is an MCP server for your own earmarkIQ data. The list it publishes covers accounts and balances, spending by category, subscriptions and their price changes, net worth and property equity, and your payday allocation plan. That list is the whole surface area.
It is read-only by construction. No capability to move money, make a payment, change a setting or amend anything exists within it — and because “we promise not to” is worth very little, this is enforced structurally: a test in our build fails if any mutating capability is ever added. Every access is recorded, and you can revoke the connection yourself from your earmarkIQ account at any time, which takes effect immediately and leaves your bank connections and the app untouched.
Claude is verified as working with it. Because MCP is an open standard, other MCP-capable assistants can connect the same way, though we have not verified each one individually and will not claim otherwise.
An assistant connected through Context cannot move money, because nothing in Context can. earmarkIQ does not initiate payments at all today. Payment initiation sits within the permissions earmarkIQ operates under as an Appointed Representative of Finexer Ltd (FRN 925695), and is on the roadmap, but the capability is not enabled. If it is ever switched on, it will be a payment you start and confirm yourself, authenticated at your own bank — not something an assistant can trigger.
What to ask about any MCP server
The protocol is not the thing to interrogate. The server is. Four questions cover most of it:
- What is on the list? It should be published, specific, and shorter than “your financial data”.
- Does anything on it change state? If yes, that is a different product with a different risk profile, whatever else it also does.
- How is read-only enforced? A policy can be changed; an absent capability cannot be invoked. Ask which one you are relying on.
- Can you revoke it yourself, and see what was accessed? Both should be true, and neither should require contacting anyone.
If you want the longer version of that reasoning, including how to weigh it up before connecting anything, we have written it up in should you connect your bank account to an AI assistant?.
Frequently asked questions
About earmarkIQ
earmarkIQ is a UK personal finance app for iOS and the web. It is an FCA Appointed Representative of Finexer Ltd (FRN 925695) and ICO registered (CSN2001882). It connects to UK bank accounts through read-only Open Banking, categorises spending automatically, builds a payday allocation plan, and tracks subscriptions, property equity and net worth. Website: earmarkiq.app