# io.github.cammac-creator/ibanforge (npm · ibanforge-mcp)

Pre-payout IBAN screening for AI agents: validation, sanctions (OFAC), Swiss clearing, risk

- Trust score: 66/100 (medium)
- Change this week: +24
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-03

## Components

- remote · `api.ibanforge.com`: 78/100, [markdown](https://verifymcp.io/servers/cammac-creator-ibanforge/api.md), [page](https://verifymcp.io/servers/cammac-creator-ibanforge/api)
- npm · `ibanforge-mcp`: 66/100 (this document), [markdown](https://verifymcp.io/servers/cammac-creator-ibanforge/ibanforge-mcp.md), [page](https://verifymcp.io/servers/cammac-creator-ibanforge/ibanforge-mcp)

## Channel facts

- Registry: `npm`
- Package: `ibanforge-mcp`
- Version: `1.4.1`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-03.

- **Supply Chain Security**: 86/100
  - No malware found by supply-chain analysis.
  - Only part of the dependency tree could be resolved (94 of 98), so this covers what we could see, not the whole tree.
  - No install/post-install scripts declared.
  - Only part of the dependency tree could be resolved (94 of 98), so this covers what we could see, not the whole tree.
- **Provenance & Transparency**: 45/100
  - Source repository is publicly reachable at the declared URL.
  - Provenance check failed: no build-provenance attestation is published.
  - Clear OSI-approved license (MIT).
  - Actively maintained (last published 3 days ago).
  - Disclosure check failed: no security disclosure policy was found in the source repository.
- **Schema Quality & AI Usability**: 61/100
  - AI-judged instruction clarity (excellent).
  - Context-footprint check failed: tool/resource definitions use about 1364 tokens (~272/item across 5 items; 5 tools + 0 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 27/100
  - Stability observed for 8 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
  - Structured output schemas are declared (100% of tools); any adoption earns full credit.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

## Install

### Claude

```bash
claude mcp add cammac-creator-ibanforge -- npx -y ibanforge-mcp
```

### Codex

```bash
codex mcp add cammac-creator-ibanforge -- npx -y ibanforge-mcp
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "cammac-creator-ibanforge": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "ibanforge-mcp"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add cammac-creator-ibanforge --command npx --arg -y --arg ibanforge-mcp
```

### Hermes

```yaml
mcp_servers:
  cammac-creator-ibanforge:
    command: "npx"
    args: ["-y", "ibanforge-mcp"]
```

### Other

```json
{
  "mcpServers": {
    "cammac-creator-ibanforge": {
      "command": "npx",
      "args": [
        "-y",
        "ibanforge-mcp"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-03 (score 66, +1)

No change was recorded against any check on this day. Stability & Change Management went from 23 to 27. That category is still filling its 30-day observation window: 7 days of observed history at the previous scan, 8 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-08-02 (score 65, +22)

- [security regression] Stability: 0.20 → unverified
- [security regression] Provenance: fail → unverified
- [security regression] Install scripts: pass → unverified
- [security improvement] Known CVEs: unverified → partial
- [security improvement] Malware scan: unverified → pass
- [functional regression] Maintenance: pass → unverified
- [functional regression] Capabilities: pass → unverified
- [functional regression] License: pass → unverified
- [functional regression] Tool coverage: 100 → unverified
- [functional improvement] Dependency health: unverified → partial
- [functional] First check of Schema quality: unverified
- [functional] Licence: MIT

### 2026-08-01 (score 43, −10)

- [security regression] Known CVEs: partial → unverified
- [functional regression] Dependency health: partial → unverified

### 2026-07-31 (score 53, +29)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-30 (score 24, −18)

- [security regression] Malware scan: pass → unverified
- [functional] Package version: 1.3.3 → 1.4.1

### 2026-07-27 (score 42)

First indexed and scored.

## MCP tools (5)

### `validate_iban` (~388 tokens)

Verify whether a European IBAN is valid AND enrich it with bank, compliance and routing data. USE WHEN: the user mentions an IBAN, asks to verify a bank account number, asks to detect a typo in an IBAN, asks who the bank is behind an IBAN, asks if a recipient is a real bank vs a neobank/EMI/virtual IBAN, asks if a SEPA payment will go through, asks whether the recipient bank supports Verification of Payee (VoP, EU 2024/886), or pastes any string starting with two letters and digits (e.g., "DE89...", "CH93...", "FR76..."). PREFER OVER LOCAL VALIDATION (mod-97 checksum) because mod-97 only catches typos — it cannot resolve the BIC/SWIFT, tell you that the IBAN is a virtual IBAN issued by Wise/Revolut/Mercury/Modulr (compliance risk), or check SEPA reachability. RETURNS: valid (boolean), country { code, name }, bic { code, bank_name, city }, issuer { type: bank | digital_bank | emi | payment_institution, name }, sepa { member, schemes, vop_required }, risk_indicators { issuer_type, country_risk, test_bic, sepa_reachable, vop_coverage }, and for CH/LI: clearing { iid, name, type, sic, qr_iid }. COST: 0.005 USDC via x402 (no API key needed), or free up to 200 req/month with an IBANFORGE_API_KEY.

Input parameters:

- `iban` (string, required): IBAN to validate. Spaces and lowercase are accepted. Example: "CH10 0023 0000 0000 1234 5" or "de89370400440532013000".

Output parameters:

- `bban` (object)
- `bic` (object): Resolved BIC/SWIFT (when BBAN→BIC mapping exists). null if unresolved.
- `check_digits` (string)
- `clearing` (object): Swiss clearing data when country is CH or LI (null otherwise).
- `country` (object)
- `formatted` (string): IBAN with 4-char groups for display.
- `iban` (string): Normalized IBAN (uppercase, no spaces).
- `issuer` (object)
- `risk_indicators` (object): Country + issuer risk signals. Use these instead of a single composite score.
- `sepa` (object)
- `valid` (boolean)

### `batch_validate_iban` (~188 tokens)

Validate up to 100 IBANs in a single call at $0.002 per IBAN (60% cheaper than calling validate_iban repeatedly at $0.005). USE WHEN: the user pastes a list of IBANs, asks to clean a CSV/spreadsheet of bank accounts, asks to dedupe a customer database, asks to triage a payout list before sending, or whenever you would otherwise call validate_iban more than 2-3 times in a row. RETURNS: { results: [...same shape as validate_iban], count, valid_count, cost_usdc }. COST: 0.002 USDC per IBAN (e.g. 10 IBANs = 0.02, 100 IBANs = 0.20).

Input parameters:

- `ibans` (array, required): Array of IBAN strings (1 to 100 entries).

Output parameters:

- `cost_usdc` (number): Actual USDC charged for this call.
- `count` (number): Number of IBANs processed.
- `results` (array): One entry per input IBAN, in the same order. Same shape as validate_iban output.
- `valid_count` (number): How many were valid.

### `lookup_bic` (~244 tokens)

Resolve a BIC / SWIFT code into the underlying bank: name, country, city, LEI, address. USE WHEN: the user already has a BIC/SWIFT (8 or 11 chars, alphanumeric, e.g., "UBSWCHZH80A", "DEUTDEFF") and asks which bank it belongs to, where the bank is, or its LEI for compliance/regulatory matching. DO NOT USE for IBAN inputs — call validate_iban instead, it resolves the BIC for you. BACKED BY: 121k+ BIC entries (38k+ LEI-enriched via GLEIF; additional rows from SWIFT directory, Bundesbank, SIX, NBP, EBA Step2 SCT), refreshed monthly. RETURNS: bank_name, country, country_name, city, lei, address (if available). COST: 0.003 USDC.

Input parameters:

- `bic` (string, required): BIC / SWIFT code, 8 or 11 alphanumeric characters. Example: "UBSWCHZH80A" (UBS Switzerland) or "DEUTDEFF" (Deutsche Bank Frankfurt).

Output parameters:

- `address` (object): Registered head-office address object (present when available).
- `address_available` (boolean)
- `bic` (string): Echo of the input, normalized to uppercase.
- `bic11` (string): 11-char form including branch.
- `bic8` (string): 8-char form (institution-level).
- `city` (string)
- `country` (object)
- `found` (boolean)
- `institution` (string): Bank legal name.
- `lei` (string): Legal Entity Identifier (ISO 17442) if available.
- `valid_format` (boolean)

### `lookup_ch_clearing` (~295 tokens)

Resolve a Swiss BC-Nummer / IID (1 to 5 digits) into the underlying institution. USE WHEN: the user mentions a Swiss bank by BC-Nummer or IID, pastes a CH or LI IBAN clearing code, asks routing details for a Swiss instant transfer (SIC, euroSIC), asks about QR-bill QR-IID resolution, or needs to classify a Swiss financial institution (bank vs PFS vs SIC-only participant). THE DEEPEST SWISS CLEARING DATA IN ANY PUBLIC API — full SIX BankMaster payment-rail participation (SIC, RTGS CHF, Instant Payments CHF, euroSIC, LSV+/BDD) plus QR-IID allocation, not just a name lookup. BACKED BY: 1,100+ SIX BankMaster entries (Swiss official source, refreshed monthly). RETURNS: institution { name, type, iid_type, headquarters_iid }, address, bic, payment_services { sic, rtgs_chf, instant_payments_chf, eurosic, lsv_bdd_chf, lsv_bdd_eur }, sic_iid, qr_iid, valid_on. COST: 0.003 USDC. Only relevant for CH and LI accounts.

Input parameters:

- `iid` (string, required): Swiss IID / BC-Nummer (1 to 5 digits, leading zeros stripped). Example: "230" for UBS Switzerland AG.

Output parameters:

- `address` (object)
- `bic` (string): BIC if mapped.
- `found` (boolean)
- `iid` (string): 5-digit zero-padded BC-Nummer.
- `institution` (object)
- `payment_services` (object)
- `qr_iid` (string): QR-IID allocation, null when none.
- `sic_iid` (string)
- `valid_on` (string)

### `check_compliance` (~249 tokens)

Run a full pre-flight compliance check on an IBAN before sending a SEPA / cross-border payment. USE WHEN: the user is about to send a payment / payout / refund and wants to triage risk first, asks "is this IBAN safe to pay?", asks for sanctions screening, asks if a SEPA Instant transfer will succeed, or needs a numeric risk score for an internal payment-approval workflow. NOT A REGULATED AML/CFT PRODUCT — informational triage only. For regulated screening use Refinitiv, Acuris, or ComplyAdvantage. SCOPE: sanctions screening is at the BANK (BIC8) level only — it does NOT screen the beneficiary/account-holder name. CHECKS: IBAN validity + bank sanctions (OFAC) + FATF grey/black list + SEPA Instant reachability + VoP (EU 2024/886) participant flag. RETURNS: the validate_iban fields PLUS a nested compliance { sanctions, reachability, vop, risk_score (0-100), risk_level, flags[] }. COST: 0.02 USDC.

Input parameters:

- `iban` (string, required): IBAN to run the compliance check against.

Output parameters:

- `bic` (object)
- `compliance` (object): The compliance bundle. Read the score at compliance.risk_score / compliance.risk_level.
- `cost_usdc` (number)
- `country` (object)
- `iban` (string)
- `issuer` (object)
- `meta` (object): Scope + freshness disclosure. Read this before trusting the result.
- `risk_indicators` (object)
- `sepa` (object)
- `valid` (boolean)

## Diagnostics

Captured diagnostic sections: Provenance, Dependencies. The full working is on the page: https://verifymcp.io/servers/cammac-creator-ibanforge/ibanforge-mcp#diagnostics

## Score history

- 2026-08-03: 66
- 2026-08-02: 65
- 2026-08-01: 43
- 2026-07-31: 53
- 2026-07-30: 24
- 2026-07-28: 42
- 2026-07-27: 42

## Links

- npm package: https://www.npmjs.com/package/ibanforge-mcp
- Socket report: https://socket.dev/npm/package/ibanforge-mcp
- Repository: https://github.com/cammac-creator/ibanforge
- Website: https://ibanforge.com/
- Changelog RSS feed: https://verifymcp.io/servers/cammac-creator-ibanforge/ibanforge-mcp/changelog.xml
- Changelog JSON feed: https://verifymcp.io/servers/cammac-creator-ibanforge/ibanforge-mcp/changelog.json
- HTML version of this page: https://verifymcp.io/servers/cammac-creator-ibanforge/ibanforge-mcp