Skip to main content

​
Plans

MCP access requires an active Developer or Professional plan. Active trials, legacy accounts within their 7-day grace period, and grandfathered accounts also retain access. Brokerage data requires Professional or an active trial. Without an eligible plan, the OAuth consent screen offers View plans instead of Allow. Upgrade, then connect your AI client again.

​
Scopes

Grant only the permissions your AI needs on the OAuth consent screen. Reads require mcp:read; brokerage reads also require brokerage:read. Each write family has a separate permission:
  • connections:write: link and revoke connections.
  • syncs:write: create, change, and run syncs.
  • destinations:write: manage destinations.
  • categories:write: manage categories and mappings.
  • rules:write: manage rules and rulesets.
  • events:write: manage event destinations and redelivery.
The server filters the tool list to your scopes and refuses calls without the required permission. Enabling the admin toolset does not bypass these checks. API-key management is not available over OAuth; API-key clients need the appropriate key scopes.
At authorization, unknown scopes return invalid_scope. A dynamically registered client whose registered scope is only mcp:read can request any supported OAuth scope, whether registration omitted scope or explicitly requested mcp:read. A client registered with additional scopes can request only its registered set. You approve the requested permissions on the consent screen. Omitting scope from the authorization request asks only for mcp:read, not every permission available to the client.
Write tools change Redbark configuration and workflows, not your bank’s payment instructions.

​
Authentication and revocation

Hosted AI clients use OAuth access tokens and refresh them without storing your Redbark API keys. You can revoke a connected app from Settings > API & MCP. To change scopes, disconnect and reconnect the client, then grant the required permissions. API keys remain supported for manual setups. See setup for client configuration.

​
Data handling

Banking data is returned to your AI client when it calls a tool. Reads may pass through Redbark’s short-lived, encrypted connection gateway cache. Live banking and brokerage provider payloads are not written to the primary database or logs. Opt-in Documents stores uploaded files and extracted transactions. See caching for freshness, retention, purge, and opt-out behaviour. Your AI provider receives tool results, so its own data policies also apply.

​
Context argument

Tools advertise a context argument asking the AI for a brief statement of the user’s goal. The server accepts calls without it. When supplied, it is used for product analytics, not forwarded as an API argument. Keep banking data and sensitive details out of this field. Tool arguments, results, and error messages are not captured in MCP analytics.