Next free-source huntWe check for new free data every weekday.
OSINTMCP serverFirst audited Nov 13, 2026

io.github.cammac-creator/ibanforge

Check the bank behind an IBAN before you pay: bank-code check, BIC with source, bank-level sanctionsThe vendor's description, from its MCP Registry listing.

Passed public checksAudited Nov 13, 2026

Every public check ran and passed. Public audit: we connect as an AI client would, list the tools and check what they say. We do not run them. How we audit

Does it work?
YesConnected in 235 ms.
Sign-up?
None neededIt answered without any account or key.
Can it change things?
YesSome tools say they can change things. Your AI client should ask you first.
Endpointhttps://api.ibanforge.com/mcp

Source code Website Streamable HTTP · protocol 2025-11-25 · server version 1.10.0

What we checked, the evidence, and the tools it offers.

What we checked

Security

  • Passed: Connections are encrypted (HTTPS).

  • Passed: No hidden instructions found in tool text.

Safety labels

  • Note: 3 tools are labelled as able to change things.

    Expected for tools that send, write or buy. Your AI client should ask before calling them.

    • send_feedback
    • request_api_key
    • poll_api_key
  • Passed: Every tool says whether it only reads or can change things.

Tools

  • Note: Some tool text is long, so it uses more of the AI's working memory.

    • validate_iban (5,880 characters)
  • Passed: 11 tools listed.

  • Passed: Every tool describes its inputs with a valid schema.

Protocol

  • Passed: The MCP handshake works (Streamable HTTP).

  • Passed: Protocol version 2025-11-25 (latest).

  • Passed: Unknown requests are refused.

Connection

  • Passed: The server responds.

Tools (11)

As the server describes them. The labels are the server's own: it says whether each tool only reads or can change things.

  • validate_ibanVerify whether an IBAN from any of the 89 IBAN countries is valid AND enrich it with bank, compliance and routing data. USE WHEN: the user mentions an IBAN, asks to validate an IBAN and identify the…Read-only
  • batch_validate_ibanValidate up to 100 IBANs in a single call. Paid per call in USDC via x402, it costs $0.002 per IBAN instead of $0.005 per validate_iban call; on an API key or a credit pack each IBAN uses one request…Read-only
  • lookup_bicResolve a BIC / SWIFT code into the underlying bank: name, country, city, LEI, and registered head-office address (where available). USE WHEN: the user already has a BIC/SWIFT (8 or 11 chars, alphanu…Read-only
  • check_complianceRun a pre-flight compliance triage on an IBAN before sending a SEPA / cross-border payment. USE WHEN: the user is about to send a payment / payout / refund and wants to triage risk first, asks whethe…Read-only
  • validate_payment_referenceValidate a structured payment reference and, when an IBAN is supplied, decide whether the two may legally travel together. USE WHEN: assembling a payment instruction from an invoice, a QR-bill or a r…Read-only
  • check_swiss_qr_billCheck a Swiss QR-bill payload, the text a QR-bill's code carries (starts with SPC), rule by rule, each finding citing the SIX document it comes from. USE WHEN: an agent, an ERP or an accounting tool…Read-only
  • check_postal_addressCheck a structured ISO 20022 postal address against a payment rail's published address rules, rule by rule, each verdict citing the document it comes from. USE WHEN: assembling a payment instruction…Read-only
  • lookup_ch_clearingResolve a Swiss BC-Nummer / IID (1 to 5 digits) into the underlying institution. USE WHEN: the user mentions a Swiss bank by BC-Nummer or IID, pastes a CH or LI IBAN clearing code, asks routing detai…Read-only
  • send_feedbackReport a problem or a need directly to the IBANforge operators: incorrect validation result, stale or missing BIC/bank data, latency, or anything blocking you from using or PAYING for the service (mi…Can change things
  • request_api_keyStart the process that gives your human a free IBANforge API key, without any e-mail address. The key does not unlock this session: it works once your human puts it in the MCP client configuration an…Can change things
  • poll_api_keyCollect the API key once a human has approved the request opened by request_api_key. USE WHEN: you have called request_api_key and shown the code to your human. HOW TO CALL IT: leave `device_code` em…Can change things

Audit history

  1. Nov 13Passed

What we sent

Every request in this audit, with the answer and how long it took. We never send credentials and never call a tool.

RequestAnswerTime
initializeHTTP 200235 ms
initializedHTTP 202167 ms
tools/listHTTP 200162 ms
resources/listHTTP 200103 ms
prompts/listHTTP 200122 ms
unknown-methodHTTP 200110 ms

Run this server, or disagree with the result?

Fix the issue and it shows in the next weekly audit, or email us to ask for a re-audit or to dispute a finding. Read how we audit for what each check means.