{
  "markdown": "# T-Bank MCP\n\n<!-- mcp-name: io.github.icyberdeveloper/tbank-mcp -->\n\n**T-Bank (Т-Банк) MCP** — mobile banking API server for Claude Code, Codex, ChatGPT, and other MCP-capable agents.\n\n[![PyPI](https://img.shields.io/pypi/v/tbank-mcp?style=flat-square)](https://pypi.org/project/tbank-mcp/)\n[![Install MCP Server](https://cursor.com/deeplink/mcp-install-dark.svg)](https://cursor.com/install-mcp?name=tbank&config=eyJjb21tYW5kIjoidGJhbmstbWNwIn0%3D)\n[![Install in VS Code](https://img.shields.io/badge/VS_Code-Install_Server-0098FF?style=flat-square&logo=visualstudiocode&logoColor=white)](https://insiders.vscode.dev/redirect?url=vscode%3Amcp%2Finstall%3F%257B%2522name%2522%253A%2522tbank%2522%252C%2522command%2522%253A%2522tbank-mcp%2522%257D)\n[![Install in VS Code Insiders](https://img.shields.io/badge/VS_Code_Insiders-Install_Server-24bfa5?style=flat-square&logo=visualstudiocode&logoColor=white)](https://insiders.vscode.dev/redirect?url=vscode-insiders%3Amcp%2Finstall%3F%257B%2522name%2522%253A%2522tbank%2522%252C%2522command%2522%253A%2522tbank-mcp%2522%257D)\n\nThe buttons register the `tbank-mcp` command — run `pip install tbank-mcp` first.\n\n## Features\n\n- **90 tools**: accounts, cards, documents, operations, grocery ordering, cinema and\n  concert tickets, train and flight booking, hotel search, orders, transfers\n  (including payment by bank requisites, from a scanned invoice QR), messenger,\n  investments\n- **A skill for every vertical**, entered through the `tbank` router skill: grocery\n  order, tickets, travel, transfer, bill pay, cards & documents, messenger, budget\n  analysis, invest advisor, login\n- **Pinned CA trust**: system store + the Russian Trusted Root CA (Минцифры), which no\n  OS ships and every `*.t-bank-app.ru` host needs — that is most of the hosts this\n  MCP talks to. Shipped in `tbank_mcp/ca/roots/`, pinned by SHA-256. Leaf/intermediate rotation\n  needs no action; a root rotation is a PEM drop into `tbank_mcp/ca/roots/` (or `TBANK_EXTRA_CA`).\n  The verify bundle is (re)generated from that material into\n  `~/.local/share/tbank-mcp/bundle.pem`; `TBANK_CA_BUNDLE` relocates it — it is a\n  write target, not a curated input, so extra roots go in via `TBANK_EXTRA_CA`.\n  Certificates are never learned from the network — see the header of `tbank_mcp/tls.py`.\n- **Grocery checkout**: search → cart → order → pay (proven end-to-end)\n- **Secure login**: password/PIN stay OUT of the LLM context (local CLI or env var)\n\n## Quick Install\n\n### As a Claude Code plugin (server + every skill in one step)\n\n```bash\n/plugin marketplace add icyberdeveloper/tbank-mcp\n/plugin install tbank@tbank-mcp\n/reload-plugins\n```\n\nThere is no store to be admitted to — a marketplace is just a git repo with a\n`.claude-plugin/marketplace.json`, and anyone can host one.\n\nThe venv and the Python dependencies are created on the server's first start by\n`bin/tbank-mcp`: a plugin manifest cannot run install steps (`install` is not a\nfield in the schema), so the launcher does it once and every later start goes\nstraight to the server. Only the grocery checkout needs a browser, and 150 MB is\nnot something to download behind your back — install it yourself if you want that\nflow:\n\n```bash\n~/.claude/plugins/cache/tbank-mcp/tbank/*/.venv/bin/python -m playwright install chromium\n```\n\n### From PyPI\n\n```bash\npip install tbank-mcp\ntbank-mcp-login +7XXXXXXXXXX   # first login: SMS code + password in YOUR terminal, not the LLM\nclaude mcp add tbank -- tbank-mcp\ntbank-mcp-skills               # optional: the Claude Code skills, into ~/.claude/skills\n```\n\nThe `tbank-mcp` console script starts the stdio server; the pinned CA roots, the\nflows reference and the skills all ship inside the wheel, so it runs from anywhere.\n`tbank-mcp-login` is the same login CLI as the repo's `login_cli.py` — both write\nthe session to the same file the server reads. `tbank-mcp-skills` installs the\nskills for Claude Code (default `~/.claude/skills`, `--target` for elsewhere) and,\nunlike a plain `cp`, first removes stale copies under retired names — re-run it\nafter upgrades. The grocery checkout browser stays opt-in here too:\n`python -m playwright install chromium`.\n\n### Manually (clone, no plugin)\n\n```bash\ngit clone https://github.com/icyberdeveloper/tbank-mcp.git\ncd tbank-mcp\npython -m venv .venv && . .venv/bin/activate\npip install -e .\npython -m playwright install chromium\n\n# MCP server:\nclaude mcp add tbank -- ./.venv/bin/python -m tbank_mcp.server\n\n# Skills — a COPY, so it does not follow the repo. Re-run after every pull, or\n# the installed skills quietly describe an older version of these tools. The\n# installer also removes stale copies under RENAMED skill names, which a plain\n# cp never does — the agent would keep loading the stale one:\n.venv/bin/tbank-mcp-skills\n```\n\n## 🔒 Login — the password never reaches the agent\n\nThe password and the PIN are secrets, and they are **not put into the model's\ncontext**. Logging in is done by a local script, or through an environment variable.\n\n### Option 1 (recommended): the local CLI\n\nThe script asks for the password itself, via `getpass`, so it is never echoed to the\nterminal and never passes through the agent. Its prompts are in Russian, as shown:\n\n```bash\ncd tbank-mcp\n\n.venv/bin/python login_cli.py +7XXXXXXXXXX\n# [1/3] login(+7XXXXXXXXXX) ...\n#     SMS отправлена\n# [2/3] SMS-код: ****                     ← the code from the SMS (hidden input)\n# [3/3] Пароль (не отображается): ****    ← your password (hidden input)\n#\n# ✓ ГОТОВО! Сессия сохранена: ~/.local/share/tbank-mcp/session.json (права 0600).\n#   MCP читает этот же файл — путь совпадает без ручной настройки.\n```\n\nOr with the password in the environment, for CI and scripts:\n\n```bash\nTBANK_PASSWORD=\"your-password\" .venv/bin/python login_cli.py +7XXXXXXXXXX\n```\n\nThen **start Claude Code**. The agent picks up the saved session and works without\nthe password, which never enters the LLM context.\n\n### Option 2: through the agent (convenient, but the LLM sees the password)\n\nIf you are content to hand the password to the agent:\n\n```\n> login(+7XXXXXXXXXX)\n> [SMS code] 1234\n> confirm_otp(\"1234\")\n> [bank asks password]\n> confirm_password(\"YourPassword\")\n```\n\n⚠️ **Note:** the password ends up in the model's context and in call logs. For an\naccount you care about, use Option 1.\n\nBoth options need the SMS code typed in either way, so there is no unattended\nlogin. `TBANK_PASSWORD` (and `TBANK_PIN`) are read **only** by the login CLI\n(`tbank-mcp-login` / `login_cli.py`) — the\nenv example above — and never by the MCP server or the LLM. `TBANK_PHONE` is not\nread anywhere: the phone is always a command-line argument.\n\n> **Работа с MyT (рабочий календарь и парковка) переехала** в отдельный MCP:\n> [tbank-myt](https://github.com/icyberdeveloper/tbank-myt). Другой аккаунт, другая\n> сессия, свой `login_cli.py` — здесь их больше нет.\n\n## Other agents (Codex, ChatGPT, Hermes, OpenClaw)\n\n```jsonc\n{\n  \"mcpServers\": {\n    \"tbank\": {\n      \"command\": \"/path/to/tbank-mcp/.venv/bin/python\",\n      \"args\": [\"-m\", \"tbank_mcp.server\"],\n      \"cwd\": \"/path/to/tbank-mcp\"\n    }\n  }\n}\n```\n\nWith a `pip install tbank-mcp` the whole entry shrinks to `\"command\": \"tbank-mcp\"` —\nno paths, no cwd.\n\n### Use with Cursor\n\nClick the **Install MCP Server** button above, or open the **Customize** page from\nCursor's sidebar to add the server, or create `~/.cursor/mcp.json` (global) /\n`.cursor/mcp.json` (per-project):\n\n```json\n{\n  \"mcpServers\": {\n    \"tbank\": { \"command\": \"tbank-mcp\" }\n  }\n}\n```\n\nCursor renders MCP elicitation, so the payment-confirmation buttons work in chat.\n\n### Use with Cherry Studio\n\n**Settings → MCP → MCP Servers → Add**: type `stdio`, command `tbank-mcp`, no\narguments. Save, enable the server, wait for the healthy status.\n\n> Cherry Studio does not render MCP elicitation yet (open request\n> [CherryHQ/cherry-studio#9145](https://github.com/CherryHQ/cherry-studio/issues/9145)),\n> so reading works but the money tools refuse to execute there — by design, not by\n> accident.\n\n### Use with Goose\n\nCLI: `goose configure` → **Add Extension** → **Command-line Extension**, name\n`tbank`, command `tbank-mcp`. Desktop: sidebar → **Extensions** → **Add custom\nextension**, same values.\n\nGoose renders elicitation in both Desktop and CLI; its confirmation forms time out\nafter 5 minutes, so answer payment confirmations promptly.\n\nReading works in any MCP client. **Paying needs a client that renders MCP\nelicitation** — the money tools confirm the sum with a button the user presses\n(«Перевести/Отмена», «Оплатить …?»), and a client without that capability is refused\nbefore anything is sent (`grocery_checkout` refuses there at any threshold; its\n`dry_run=True` preview, which creates nothing, still works). Hermes/Telegram and\nClaude Code (≥ 2.1.76) render it; Claude Desktop does not. See\n`TBANK_CONFIRM_ABOVE` under Security.\n\n## Tools\n\nEach tool's docstring is the reference — this table is only a map of the surface.\nThe docstrings, the skills and everything the tools print are in Russian: the bank is\nRussian and so is the person reading the answer.\n\n| Group | Tools |\n|---|---|\n| **Login** | `login`, `confirm_otp`, `confirm_password`, `confirm_pin` |\n| **Session** | `refresh_session`, `session_status`, `keepalive`, `push_unread_count` |\n| **Reads** | `list_accounts`, `list_operations`, `spending_categories`, `operations_histogram`, `get_data` |\n| **Cards & accounts** | `list_cards`, `card_limits`, `card_requisites`, `card_operations`, `account_requisites` |\n| **Documents** | `documents`, `bank_documents`, `insurance_policies`, `payment_receipt` |\n| **Grocery** | `grocery_stores`, `grocery_search`, `grocery_plan_order`, `grocery_add_to_cart`, `grocery_set_cart`, `grocery_cart`, `grocery_checkout`, `payment_attempts`, `grocery_order_status`, `grocery_order_cancel` |\n| **Nutrition** | `grocery_good_info`, `grocery_rank` |\n| **Orders** | `orders`, `order_details`, `travel_order_details` |\n| **Afisha** | `afisha_catalog`, `afisha_places`, `place_schedule`, `place_info` |\n| **Tickets** | `cinema_search`, `cinema_schedule`, `cinema_seats`, `concert_schedule`, `concert_hall`, `cinema_book`, `ticket_pay`, `ticket_cancel`, `ticket_qr` |\n| **Search** | `search_app` |\n| **Travel search** | `train_search`, `train_calendar`, `flight_search`, `flight_offer`, `flight_history` |\n| **Travel booking** | `train_seats`, `train_book`, `train_pay`, `train_refund`, `flight_seats`, `flight_book` |\n| **Hotels** | `hotel_search`, `hotel_info` |\n| **Trips** | `trips`, `travel_payment_options`, `travel_ticket_file` |\n| **Marketplace** | `shop_search`, `shop_cart` |\n| **Messenger** | `messenger_conversations`, `messenger_messages`, `messenger_file`, `messenger_send`, `messenger_unread` |\n| **Money** | `transfer_sbp_resolve`, `transfer`, `payment_qr`, `transfer_requisites`, `payment_commission`, `pay_bill`, `payment_providers`, `confirm_payment`, `payment_status` |\n| **Invest** | `invest_accounts`, `invest_portfolio`, `invest_operations`, `invest_securities` |\n| **Utility** | `flows`, `diagnostics`, `debug_report` |\n\n`get_data(section)` covers dozens of read sections: subscriptions, credit_schedule, statements, loans, invest_accounts, pension, etc. (`invest_portfolio` is a tool of its own, not a section — see the docstring for the full list.)\n\nGrocery tools (`grocery_search`, `grocery_plan_order`, `grocery_add_to_cart`, `grocery_set_cart`, `grocery_cart`, `grocery_checkout`) require `app_id` + `point_id` taken from `grocery_stores()` — there's no silent default store, so add/cart/checkout always operate on the same cart, instead of reporting an empty one right after something was added to a different store's.\n\n## Skills\n\n| Skill | What it does |\n|---|---|\n| `tbank` | **Entry point** — what the bank can do and which skill handles it |\n| `tbank-grocery-order` | Recipe → search → cart → show it → checkout (the tool's own button confirms the sum) |\n| `tbank-tickets` | Cinema/concert: search → showtime → seats → book → pay |\n| `tbank-travel` | Trains and flights: search → seats → book → pay → refund; hotels and marketplace: search only |\n| `tbank-bill-pay` | Service bills — utilities, taxes, fines: catalogue → provider fields → commission preview → pay |\n| `tbank-transfer-money` | P2P, SBP (СБП), account transfers |\n| `tbank-cards-documents` | Cards, limits, requisites, passport and other documents |\n| `tbank-messenger` | Bank chats and support |\n| `tbank-budget-analyzer` | Spending analysis, subscription audit, savings tips |\n| `tbank-invest-advisor` | Portfolio, P&L, rebalancing, tax optimization |\n| `tbank-login` | Multi-step login, session management |\n\n## Example requests\n\nAsk in Russian — the tools answer in Russian. Everything below was run against the\nlive bank.\n\n**Кино и афиша**\n```\nЧто идёт в кино сегодня?\nКупи два билета на «Майкла» на завтра в Каро 11 около 20:00 в центре зала\nОтмени заказ\nПокажи последние 5 моих заказов\n```\n\n**Деньги**\n```\nПокажи мои счета\nПереведи 10 рублей Алёне на +79991234567\nКакие последние 5 операций?\nПокажи реквизиты счёта\n```\n\n**Продукты**\n```\nХочу оливье, собери корзину с минимальным КБЖУ\nХочу оливье, собери корзину с минимальной ценой\nХочу оливье, собери корзину из премиум продуктов\nНайди самый дешёвый картофель за килограмм\nОтмени заказ\n```\n\n**Карты и документы**\n```\nПокажи реквизиты основной карты\nКакие лимиты по основной карте?\nПокажи реквизиты моего паспорта\nКогда истекает мой загранпаспорт?\n```\n\n## Tests\n\nNo pytest — the tests are standalone scripts. Run them all:\n\n```bash\n.venv/bin/python tests/run_all.py            # every file, under a minute, offline\n.venv/bin/python tests/run_all.py transfer   # only files matching \"transfer\"\n```\n\nEach runs in its own process, and the runner redirects the attempt/event journals to\na temp directory so a test run never writes to `~/.local/share/tbank-mcp/`.\n\nEverything needed is in the repo: request contracts are pinned against scrubbed\nfixtures in `tests/fixtures/` (real structure and protocol values, synthetic personal\ndata), so the suite is meaningful on a clean clone. Where the original Burp capture is\npresent the tests additionally check the fixtures have not drifted from it.\n\n## Security\n\n- **`session.json`** — canonical path `~/.local/share/tbank-mcp/session.json`\n  (override with `TBANK_SESSION`), mode 0600, owner-only. It holds tokens. Both\n  the login CLI and the MCP server read the same file, so there is nothing to\n  configure. On start-up the MCP logs the path, size and permissions only — never a\n  token or a cookie.\n- **Password / PIN** — not in git, not in the code, and not in the LLM context if you\n  use the login CLI (`tbank-mcp-login` / `login_cli.py`).\n- **No secrets in the repo.** Two kinds of committed material look secret-adjacent and\n  are not: `tbank_mcp/ca/roots/*.pem` are public CA root certificates, shipped on purpose and\n  pinned by SHA-256 in `tbank_mcp/tls.py`; `tests/fixtures/*.json` are request contracts\n  scrubbed from a real capture — real structure and protocol values, synthetic\n  account, phone, address and device ids. The captures themselves are gitignored and\n  never leave the machine.\n- **`events.jsonl` + `attempts.jsonl`** — redacted diagnostics in\n  `~/.local/share/tbank-mcp/`. They carry step, http_status, blame, amount and order\n  id, and never tokens, cookies, addresses, phone numbers, emails or account numbers.\n  Safe to share while debugging; the `diagnostics` tool reads them.\n- **`calls.jsonl`** — one line per tool call, so it can be seen how an agent uses\n  this MCP: the tool, its arguments, the duration, and the FIRST LINE of the answer,\n  which is what the agent actually read. Held to the same promise as the files above:\n  arguments that are free text a person wrote (a chat message, a transfer note) or a\n  credential are measured, never stored; long digit runs — account, card, order and\n  payment ids — are replaced in the recorded line, both to keep them out and because\n  the report groups by that line. The `debug_report` tool reads it. On by default;\n  `TBANK_TRACE=0` disables it, `TBANK_TRACE_FILE` moves it, and it rotates at 5 MB.\n- **`TBANK_CONFIRM_ABOVE`** — the ruble threshold from which the paying tools\n  that debit on the spot (`transfer`, `transfer_requisites`, `pay_bill`,\n  `ticket_pay`, `grocery_checkout`, `train_pay`, `flight_book`)\n  show the confirmation button — an MCP elicitation dialog («Перевести/Отмена»,\n  «Оплатить …?», «Оформить заказ на N ₽?») rendered by the client (default `0`:\n  every payment asks). It is a server-side setting, not a tool argument. Clients\n  without elicitation are NOT waved through: at or above the threshold the tool\n  refuses («ПЛАТЁЖ НЕ ВЫПОЛНЕН…») before anything is journalled or sent — no\n  button, no payment. Hermes/Telegram and Claude Code (≥ 2.1.76) render\n  elicitation; Claude Desktop does not (reads work there, paying does not).\n  Below a positive threshold nothing is asked and the payment proceeds in any\n  client — **except `grocery_checkout`, which refuses a client without elicitation\n  at any threshold**: it is the one paying tool that must load the checkout page to\n  learn its sum at all, and doing that means asking the store to hold a\n  delivery slot, so it says no before doing that work rather than after.\n  `grocery_checkout(dry_run=True)` — a preview that creates nothing — still works\n  in any client.\n- **Device profile.** Payments carry a 3DS/anti-fraud block whose device facts —\n  screen size, locale, timezone, hardware model — default to the device the traffic\n  was captured from. Override them with `TBANK_DEVICE_SCREEN_HEIGHT` / `_WIDTH` /\n  `TBANK_DEVICE_LANGUAGE` / `TBANK_DEVICE_TIMEZONE` / `TBANK_DEVICE_MODEL` so your\n  payments do not describe someone else's phone.\n- **Request-shape switches.** Two divergences from the captured app are corrected\n  behind env vars, so a rollback is one variable and no re-login (neither touches\n  `session.json`):\n  - `TBANK_QUERY_PROFILE=legacy` — restores sending `wuid` to every host and\n    injecting `vendor`/`client_version` on every read. The app sends `wuid` only to\n    `www.tbank.ru` under `/api/common/`, and the other two only on the OIDC\n    authorize call, so the default is now the scoped form.\n  - `TBANK_ACCEPT_PROFILE` — `json` (default, and today's behaviour byte-for-byte)\n    | `auto` | a comma-separated host list. The app does not send\n    `application/json` to its native hosts; that string is the Apple URL-loading\n    default that appears when no Accept is set. The captured responses are\n    `application/json` either way, so this is fidelity rather than a fix — but 63\n    templates share the busiest host and there is no staging environment, so it is\n    OFF until driven live. Roll it out one host class at a time, cheapest first:\n    `webview`/`shortcuts`/`my-home` (unreachable or trivial reads) → `api-invest*`\n    (`invest_accounts`, `invest_portfolio`) → `api.t-bank-app.ru` starting with\n    `keepalive`, whose Content-Type demonstrably becomes `text/html` while its body\n    stays JSON → `www.tbank.ru` → the three lifestyle shelf paths. A regression has\n    one signature: `_unwrap` raising `HTTP_200` because the body no longer parses.\n    Compare `debug_report()` before and after each step.\n- Money tools (`transfer`, `transfer_requisites`, `grocery_checkout`, `ticket_pay`,\n  `pay_bill`, `train_pay`, `flight_book`, `confirm_payment`) require confirmation of a specific amount — \"buy it\"\n  is not a confirmation. That confirmation is the button the tool shows itself\n  (elicitation, see `TBANK_CONFIRM_ABOVE` above) with the real total — the agent\n  shows the details beforehand (recipient, requisites, cart, seats + fee) and does\n  not ask «да/нет» in text; `grocery_checkout` quotes the final sum itself and\n  charges exactly what the button named — and if that quote comes back unpriced\n  (empty cart, a preview the store refused, no finite positive total), it returns\n  the preview and charges nothing. A `/v1/pay` the bank holds at `WAITING_CONFIRMATION` is\n  resumed with `confirm_payment(attempt_id, otp)` and reconciled with\n  `payment_status(attempt_id)` — never by repeating the transfer, which would create a\n  second pending payment.\n- **Tool annotations.** Every tool declares what it does, in one table —\n  `TOOL_KINDS` in `tbank_mcp/server.py` — and a tool missing from it raises at import\n  rather than defaulting to anything. Three kinds: 67 are `readOnlyHint: true` and\n  may run without a prompt; 15 write something that costs nothing (a cart, a\n  booking, a message, an OTP, a token, a local file) and are marked\n  `destructiveHint: false`; 8 debit an account — `transfer`, `transfer_requisites`,\n  `grocery_checkout`, `ticket_pay`, `pay_bill`, `train_pay`, `flight_book`,\n  `confirm_payment` — and are the only\n  ones carrying `destructiveHint`, which\n  is what makes the host prompt before running them (the sum itself is then\n  confirmed by the tool's own elicitation button, see above). The line is drawn at money on purpose: a\n  booking expires by itself and a cart line is a rewrite away, so confirming those is\n  friction that teaches people to click through the one dialog that matters.\n  The 15 writers are not marked read-only, because they do modify things and that\n  flag states the opposite — if your client still prompts on them, allow them once\n  in the client rather than changing what the server claims.\n\n## Disclaimer\n\nFor personal use with your own T-Bank account. Not affiliated with T-Bank.\n",
  "bytes": 21484,
  "sha": "a2b7001f6de9edb529fe4016b492411f37efe8e6164c675a92c5f740b6b41968",
  "repo_slug": "icyberdeveloper/tbank-mcp",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/mcp_io_github_icyberdeveloper_tbank_mcp_8880a54c/readme"
}