MCP servers in finance

The Model Context Protocol is an open standard that Anthropic introduced for connecting language models to tools and data. An MCP server describes what an agent can do in a system, for example read an account balance or create a refund, and the agent calls these tools in a fixed format. Anthropic has since handed MCP to the Agentic AI Foundation, a fund under the Linux Foundation that it co-founded with Block and OpenAI, and counts more than 10,000 active public MCP servers.

For a finance team the point is reuse. One server for a data provider works with every agent and assistant that speaks MCP, so the bank does not build a separate integration for each model.

Moody's offers an MCP server that lets an agent find rated entities, pull credit ratings and outlooks, search research and retrieve scorecards. LSEG and Microsoft announced an LSEG-managed MCP server so that customers can build agents in Copilot Studio on data they license through Workspace and Financial Analytics. The London fintech Bud Financial launched an MCP server for banks with enriched transactions and money management tools, with access scoped by the customer's consent.

On the payments side, Stripe documents an MCP server that reads and writes most of its API. Stripe asks a person to confirm certain write actions, such as refunds and outgoing payments, before they run, and warns against prompt injection when its server is combined with others.

Read access and write access carry different risks. An agent that reads ratings can at worst give a wrong summary; an agent that can create payments needs the same controls as a person with that authority. Stripe's model, with narrow agent keys and a human confirmation for money movements, is a pattern a bank can copy for its own servers.

Under DORA, an MCP server run by an outside provider is an ICT third-party service and belongs in the register of information. BaFin's guidance on ICT risks in the use of AI warns that API access to a language model can give attackers a path into the systems connected to it, which is what an MCP server does by design. The AI agent security page covers the attacks.

An MCP server is a program that exposes the tools and data of one system to AI agents through the Model Context Protocol. The agent is the client; it lists the tools on the server and calls them.

Moody's runs an MCP server for ratings and research, LSEG one for licensed data in Microsoft Copilot Studio, and Bud Financial one for enriched bank transactions. Stripe offers one for its payments API.

It depends on the rights the server grants. Read-only servers with licensed data are the usual start. Servers that can move money need narrow keys and a person who confirms payments, every call should be logged, and they fall under DORA's rules for ICT third parties.