starling-bank-mcp

The server handles sensitive financial data and API access tokens. Access tokens and private keys for payment signing are loaded from environment variables, which is a good practice to avoid hardcoding. Input schemas are validated using Zod, reducing risks from malformed inputs. However, the configurable `STARLING_BANK_BASE_URL` environment variable could allow redirection to a malicious API if the environment is compromised. The HTTP transport option explicitly warns that it lacks authentication and should only be used behind a reverse proxy or in a secured setup, indicating a potential network risk if this warning is ignored.