Been looking into MCP integrations and the banking side is pretty interesting.

I can see the value in connecting Claude to a business account to check transactions, track expenses or flag payments that need attention.

But giving an agent permission to actually move money feels like a completely different thing.

Personally I'd be fine with read-only access but anything involving transfers or payments should need approval.

Anyone here experimenting with financial MCP servers?

How much access would you trust an agent with?

Is there a video tutorial that I can watch? I saw there's a new update that changes everything, like stateless or something. I don't know much. How do I start?

hey! im exploring different ways to let my ai agents interact with email and mcp seems like an interesting option. Really looking into searching emails, replying messages and getting notified when new emails come in would be very useful. for those who are building with ai agents fo you prefer to have a seperate inbox for it or just letting in go directly to your own inbox, any good thoughts as well for an alternative email inbox ideal for ai agents? been hearing multiple mentions of agentmail, hostinger agentic mail and nylas, pros and cons?

I built vibe-testing because an agent saying 'done' wasn't enough when a route, form, or signed-in flow could still be broken. It scans a web app's source for routes and controls, runs browser checks with Playwright, and saves an HTML report with screenshots, request evidence, and a per-route pass/fail/change summary. It also runs from the CLI for people who don't want an MCP setup.

The useful part for my own workflow is the second run. After a code change, the report calls out routes that regressed or recovered, so I can inspect the specific flow instead of reading a fresh wall of green checks. The tool itself makes zero LLM calls; your editor agent can decide which scenario to test, while the local runner records what happened. Explicit assertions still matter: a completed click path alone can't prove the business outcome was right.

It's MIT licensed. Install with `npx vibe-testing@latest init`, or inspect the code and setup here: https://github.com/AishwaryShrivastav/vibe-testing

If you use Playwright MCP already, I'm curious whether source-aware route discovery and between-run reports solve a real gap for you. A report from one actual app, including what it missed, would help me prioritize the next fixes.

Hey, I’ve been working on ClosedMCP and wanted to share it here.

I want all the people in my company to share MCPs and build MCPs with 0 effort and make sure everything is in control visibility over all the different MCP we use…
so I created ClosedMCP.
It’s a single MCP service that exposes and manages securely any MCP service you want.
You can add your own MCP providers, existing ones and also use the serverless MCP feature to create on-demand MCP server with 0 effort!!

“Create chat MCP and give share it with Arnold”

Everyone's talking about tool list size, so I measured mine. My MCP server gives agents blockchain data: 40 tools, and the whole list comes to about 8,000 tokens. Roughly 200 tokens a tool, so size isn't my problem.

What I can't measure is choice. Some of my tools sit close together: one for bridge transfers across the whole network, another for one address's bridge transfers. In one case the error from the wrong tool names the right one. But my logs only show calls that fail, not the ones that quietly pick a worse tool and still answer.

I've also mixed two styles. Most tools do one job. A few are merged, like one validator tool with three views instead of three separate tools. I don't know which style agents handle better.

- At what tool count did you see selection get worse?
- Merge into fewer tools with a mode, or keep one job per tool?

Saw the thread here about tool results too big for the context, and it's the same problem I keep hitting from the other side.

The setup: an agent (Claude, Gemini, ChatGPT, Codex, whatever you connect) drafts a trading rule. It shouldn't grade its own homework, so the backtest runs in an engine the model can't touch, no look-ahead, options filled at the price you could actually have traded, the bid or the offer, not a midpoint. What comes back is a verdict: LIVE, SHADOW or SHELF.

What I haven't settled is what that tool should return. A full backtest is a long list of trades. Hand the model the whole list and it burns the context, then starts picking out the good months to argue with the verdict. Hand it only the verdict word and it can't tell why a rule failed, so it nudges parameters until something passes, which is overfitting with extra steps.

Where I lean right now: the verdict, the one or two numbers that drove it, and a way to page through the trades if the agent really wants them. I'm not sure the paging doesn't bring the cherry-picking straight back.

How Quantradin fits: I built Quantradin so an AI can write a strategy without also being the one that decides it works. You connect your AI or paste the rule, the engine grades it on real past prices, and whatever survives runs as a paper bot. Free, paper money only, nothing real at stake. quantradin.com

For those of you with tools that return big analytical results: do you summarise on the server, paginate, or let the model ask for slices? And did the model get worse at its job once it could see the raw rows?

I built an MCP for financial planning (US tax payers) and published it as a Claude Connector.

FinZot can walk you through creating a plan from scratch, figuring out when to retire, optimizing taxes (e.g. Roth conversions) and much much more.

Once connected, ask Claude “Use FinZot to create a plan from scratch. I make $... and want to retire in....”

Harness:

FinZot is backed by an incredibly detailed financial planning engine equaling or surpassing what most paid advisor tools offer in many areas (e.g. federal/state/local taxes, lot level taxes like a regular brokerage account, RSU stock comp, roth conversion optimizer, monte carlo etc). The planning engine was originally a project to learn Rust and is many years in the making.

Accuracy

AI is more likely to go off the rails when it does not have enough context for a given task. 

FinZot keeps track of which documentation Claude has been given within every conversation. Claude can't change a part of your plan until it has requested the docs for that part. For example, it can't configure an HSA until it has read the documentation on HSA or query the state tax results table until it has read the schema and documentation for the state tax table.

Cost:

FInZot’s free plan has a tool call limit. Once you hit the limit FinZot will prompt you to upgrade to a paid FinZot plan. The tool call limit should be enough to give it a solid try. If it is not please let us know.

Separately Claude’s free plan runs out of usage too quickly to be useful. The harness includes ways for Claude to load only the information it needs, but financial planning is complex and Claude tends to request a lot of context.

Hey everyone, I'm a solo founder. I sell private label on Amazon EU, and I got tired of running my account across ten different reports. So I built something for myself, and now I'm opening it up.

It pulls everything you need to manage an Amazon account into your own AI agent (Claude, ChatGPT or Cursor): PPC, organic rank, Brand Analytics, inventory and margin. The best part is that you add your own skills, your own rules, and the agent applies them to all that data.

Example: for one keyword, the agent sees how much you spent on ads, what it brought in, and that its organic rank went up 10 spots. Your skill checks that against your rules and tells you whether to push the change or not. Nothing touches Amazon until you approve it.

I'm not asking you to buy anything. If you know someone doing Amazon FBA, please share this with them. I'd really appreciate honest feedback too, here in the thread.

Thanks for reading 🙏

The situation I kept running into with MCP servers and agents: the write tool returns success, the host moves on, and the thing isn’t actually there. So then for example the event never landed on the calendar, the draft isn’t in the mailbox, the booking has no record and so on. Also nothing errored, so no log or trace flags it.

The fix I landed on: instead of trusting the write, check it with a read.

You map each write tool to its read counterpart (e.g. create_event → get_event)

After the write, the new id gets passed to the read on the same request

Read returns the thing → found

Write “succeeded” but the read comes back empty → miss

If there’s no read mapped, I just record that the job ran and how long it took. So I don’t invent a check.

Then two cases turned out to need different hooks:

MCP servers. A host (Cursor, Claude Code, etc.) calls a tool on your server. I wrap it in-process with observe(), which records the tool name, latency, and error. Nothing is proxied; hosts keep calling your URL directly.

Personal agents (someone texts the agent, it does calendar/mail/booking work). There’s no public MCP URL to watch, so Agent() wraps the dispatcher. After each job it looks for the matching list/get call on the same machine.

Btw the read check runs locally, so it never signs into anyone's Google, and it only keeps job name, latency, and found/miss. If the wrapper fails, the tool still runs.

Do you verify writes at all, or rely on the tool’s own success response? Maybe somebody has different approach or can suggest more info for me to look into? Open to any discussion.

(I built this into my tool called AgentStatus as “Live Traffic”. I'll drop the write-up in comments)

I was using an agent to hunt down good prices on something I wanted to buy. The answers sounded great. Then I actually checked them, and a lot of the prices were weeks old. The agent couldn't get into most of the pages, so it went with an old search snippet, or just guessed, and told me all of it with total confidence. I almost bought at some pretty horrible prices because of this.

That's the bit that gets me. When your agent can't read a page, it doesn't say so. It fills the gap from memory, and memory is old by definition.

So I measured how much of the web an agent actually gets to see. I picked 150 sites before opening any of them (shops, travel, jobs, news, a few government sites) and only counted a read if the real page came back. Results on a search page, a price on a product page, the actual article.

1. A plain fetch, which is roughly what most agent web tools do, got 73 of 150. Half the web, gone.
2. The best free tool on its own (Jina Reader) got 110, and the best paid one (Zyte) got 129.
3. Every tool missed different sites. That was the weird part, every kind of bot wall had a different winner.
4. Trying them in order, cheapest first, got 144. With free tools only it got 132, which is more than the best paid tool on its own.

The way I see it, everyone's agent is running on roughly the same models now. The edge is whether yours is working off what's on the page today, or off whatever it remembers. A price that dropped this morning or the docs for a version that came out last week don't exist for your agent if it can't open the page.

Frankensurf is what I ended up building. It's one read call for your agent (MCP server or Python), sitting in front of 28 tools. It tries a plain fetch first and only climbs to stealth browsers, or paid APIs if you let it, when a site blocks it or the page comes back empty. It remembers what worked on each site, so most reads cost nothing.

Still not perfect. The slowest tenth of reads take about 26 s because sometimes it really does have to try a lot of things, and a few sites still beat every tool I've got.

Setup for Claude Code, Codex, Cursor and the rest: https://frankensurf.dev/docs/agents/ Repo (my project, free and open source): https://github.com/yail259/frankensurf

Fully open source, lmk if it's useful!

Most of us have MCP servers spread across three or four clients, each added by copy-pasting JSON from a README. I wanted one command that reads all of them at once, so mcp-guard v0.9 adds scan:

uvx mcp-guard-audit scan

It finds the config files of Claude Desktop, Claude Code (including per-project servers in ~/.claude.json), Cursor, VS Code, Windsurf (now Devin Desktop), Zed, Continue and Cline/Roo, runs the same checks as inspect on each one, and groups the results by client, then by server. A server configured in two clients is reported once. Here is the output on a demo machine (fake configs, fake token):

```

Claude Desktop

~\AppData\Roaming\Claude\claude_desktop_config.json

shell

CRITICAL command-execution: shell

filesystem

HIGH broad-filesystem-scope: C:\

memory no finding

Cursor

~\.cursor\mcp.json

github

HIGH hardcoded-secret: env GITHUB_PERSONAL_ACCESS_TOKEN=<redacted, 40 chars>

shell same server as Claude Desktop > shell (~\AppData\Roaming\Claude\claude_desktop_config.json), findings shown there

Windsurf

~\AppData\Roaming\devin\mcp_config.json

remote-notes

MEDIUM insecure-transport: http://notes.example.com\[…\]

3 config files, 6 server entries, 5 distinct servers, 4 findings, highest risk CRITICAL. Static check of the configs only: no server was started.

```

What it does not do: it starts nothing and makes no network call. It reads the config files and nothing else, so it says what the configs declare, not what the processes can actually reach (that's a sandbox's job). A config with no finding means nothing alarming in the config, not a confined server.

Two things came with it. Secrets never show up in the output: tokens are reported by length, and URLs in findings now keep only the scheme and host, because people put tokens in URL paths and query strings. And --json and --sarif (SARIF 2.1.0, validated against the OASIS schema) let you drop the scan into CI or GitHub code scanning. It exits 0 by default; add --fail-on high to make it fail.

I checked every config path against each client's current docs. A few I couldn't confirm (Claude Desktop on Linux, ~/.claude.json on Windows, VS Code profile mcp.json, the old Windsurf and Cline locations). If your client keeps its config somewhere scan doesn't look, tell me where and I'll add it.

Repo (MIT): https://github.com/ianewsfr-a11y/mcp-guard

Release notes: https://github.com/ianewsfr-a11y/mcp-guard/releases/tag/v0.9.1

Question for you: how many MCP clients do you actually have configured, and did you know what was in each of them?

with a few servers connected there are usually 2 or 3 tools whose description is basically "search documents". most clients prefix them by server so the names don't clash, but the model still picks off the description, and a call to the wrong one looks normal in the log

anyone found a fix that isn't just turning servers off per project?

I've been thinking about what my websites should tell an AI agent when it visits. That became a small tool called Pagegloss.

You enter your site URL, review the description and links it finds, add any useful guides, and copy the generated code into your site. It exposes that information through read-only WebMCP tools.

Free, no signup. I wanted this to be something you could try without creating another account.

Browser and agent support is still early. I'm treating it as a small experiment in preparing for that shift, not a way to get more AI search traffic.

https://pagegloss.app

If you try it, I'd like to know where the setup gets confusing.

I'm trying to understand the value proposition of mcp apps for existing saas products or applications that already have a web UI.

Suppose an mcp tool returns a link to a some visualisation (maybe a chart, graph, etc) created/updated in an existing saas application, and the mcp host has a built-in browser that can open and display it to the user. In that case, what does an mcp apps offer that the browser-based approach doesn't?

is the main advantage of mcp apps the ability to render a purpose built UI inline in the host, with standardized communication between the ui, mcp server, and host? or are there other significant benefits that justify building a separate mcp App when the application already has a fully functional ui?

I understand that the response of the rendered component in MCP apps does not go the LLM model and results in lower token consumption but does that justify building MCP apps based visual components that mimic the actual product UI and interactive actions into the MCP layer ?

I'm looking hear from people who've built MCP Apps, especially for existing saas products with web UIs. Any suggestions or pointers would be greatly appreciated !

There was a good thread a while back about which MCP servers people actually use. I'm curious about a narrower slice: the ones that cost money.

Not the free ones, not the ones you installed once and forgot. The paid ones you'd notice if they disappeared tomorrow. Search APIs, scraping, image or video models, data enrichment, whatever.

Would love to see:

- the tool

- roughly what it costs you a month

- whether you pay per call or on a plan

My guess is most people have one or two paid tools they use constantly and a long tail they barely touch, but I'd like to know if that's true.

What's the one paid tool your agent would be useless without?

hey guys, does anyone have a spare claude guest pass? been using chatgpt lately but want to try claude code before subscribing. if anyone has one available, id really appreciate it. thank you

Disclosure: I built this (Digital Fortress). It's free and MIT licensed.

Problem: you review a server's tool descriptions once, when you first connect. After that, the server can reword a description or widen an input schema and nothing in the client flags it. OWASP's MCP Tool Poisoning page describes this trust gap.

mcp-tool-pin-check is one Python script (3.9+, standard library only). You save a `tools/list` response from a client you already use against a server you're authorized to assess. `pin` stores a normalized copy and a SHA-256 for each tool (name, description, inputSchema, annotations). `check` diffs a later export against that lockfile.

Real output from the repo's example notes server:

```text
MCP tool pin check
lock source: local-notes
pinned_at: 2026-10-08T00:00:00Z
result: drift

added (1):
+ create_note
removed (0):
(none)
changed (2):
~ get_note
description:
--- description (pinned)
+++ description (current)
@@ -1 +1 @@
-Return one note by its identifier.
+Fetch a single saved note using its identifier.

~ list_notes
schema:
[widened] property added: properties.limit (optional)
[widened] required removed: query
schema widened: yes
unchanged (0): (none)
```

What it doesn't do: it never opens a network connection, calls tools or starts a server. It doesn't decide whether a description is safe, only whether it changed. It also doesn't pin outputSchema yet.

Question for people running MCP in production: is outputSchema the next field worth pinning, or is something else more important?

https://github.com/digitalfortressaudit/mcp-tool-pin-check

Back in August I posted about the job search platform I started building with Claude to compete with Indeed because - frankly - I hate Indeed.

The web app now has 12,000 users, half of which came from Reddit.

We're also now averaging 83 interviews per 100 paying users who turn on autopilot.

But the question I got most after that post was some version of “can I just do this from inside Claude?”

So we built an MCP server. And it's incredibly easy to use.

What it does

You add one connector, sign in, and ask Claude for a job. Claude can then:

• search ~2M live roles we pull straight from employer career pages
• rank them against your resume
• write a tailored resume, cover letter and screening answers for each role
• submit the application on the employer’s own site (Workday, Greenhouse, Lever and others)
• check back later for recruiter replies

You can edit every single application using Claude, or you can just say screw it - turn on autopilot and just apply for me. And it will.

Does it work?

In the 30 days to Oct 8, our users got 90+ interview requests at 87 companies, and 80+ of those came from applications Dreamwork submitted. The MCP uses the same apply engine.
How Claude helped

Claude Code wrote nearly all of the MCP. The v2 server was a 12-PR series Claude Code put together in about a day, and the hosted version with OAuth was live four days later. Team of three; I’m the non-technical one and I’ve still written 200+ of the PRs.

The hardest design problem was trust. Two things we landed on:

• Read access is on, writes are on, and submitting stays off until you grant it on the consent screen
• You can control everything you can in the web app, with a few minor constraints in places where the UI is critical.

Free to try

It's free to get started, free to search the jobs database, free to have your agent set up notifications when new jobs become available.

You only pay when you want the automated submissions. That part requires a specialized back end agent and lots of tokens.

Setup

• Run command: npx -y u/dreamworkhq (→ www.reddit.com)/mcp
• The client is open source (MIT): github.com/dreamworkhq/mcp

Read more: https://www.dreamworkhq.com/agents