English Français العربية

comdirect

السجل الرسمي الإنتاجية

Read-only access to comdirect accounts, transactions, depots, orders and postbox documents.

الشيفرة المصدرية الموقع التوثيق

ماذا يمكنك أن تفعل مع comdirect؟

  • Safe login: push TAN confirmed in your client; stops before comdirect's lock after five unconfirmed
  • Credentials in the OS keychain, read-only tools with truthful annotations
  • Answers on the server: cash flow and spending per month, counterparty or your own
  • Clean data: transfers between your own accounts are kept out of spending, PayPal payments show the merchant,
  • Typed Python client for your own scripts

التثبيت

أضف هذا إلى إعدادات MCP في عميلك (Claude Desktop: claude_desktop_config.json، وCursor: ‏.cursor/mcp.json، ويستخدم VS Code وغيره الصيغة نفسها «mcpServers»).

PYPI package comdirect-mcp
Claude Code 
claude mcp add comdirect -e 'COMDIRECT_CLIENT_ID=<your comdirect_client_id>' -e 'COMDIRECT_CLIENT_SECRET=<your comdirect_client_secret>' -e 'COMDIRECT_USERNAME=<your comdirect_username>' -e 'COMDIRECT_PASSWORD=<your comdirect_password>' -e 'COMDIRECT_MCP_PUSH_TAN_WAIT=30' -e 'COMDIRECT_MCP_UNMASK_IBANS=false' -e 'COMDIRECT_MCP_MASK_NAMES=false' -e 'COMDIRECT_ENV_FILE=<COMDIRECT_ENV_FILE>' -e 'COMDIRECT_MCP_CACHE_TTL=60' -e 'COMDIRECT_MCP_MAX_DOCUMENT_BYTES=10485760' -e 'COMDIRECT_MCP_CATEGORIES=<COMDIRECT_MCP_CATEGORIES>' -e 'COMDIRECT_MCP_SKIP_ELICITATION=false' -e 'COMDIRECT_MCP_LOG_FILE=<COMDIRECT_MCP_LOG_FILE>' -e 'COMDIRECT_MCP_LOG_LEVEL=INFO' -- uvx comdirect-mcp==0.6.1
إعداد JSON (Claude Desktop وCursor وVS Code) 
{
    "mcpServers": {
        "comdirect": {
            "command": "uvx",
            "args": [
                "comdirect-mcp==0.6.1"
            ],
            "env": {
                "COMDIRECT_CLIENT_ID": "<your comdirect_client_id>",
                "COMDIRECT_CLIENT_SECRET": "<your comdirect_client_secret>",
                "COMDIRECT_USERNAME": "<your comdirect_username>",
                "COMDIRECT_PASSWORD": "<your comdirect_password>",
                "COMDIRECT_MCP_PUSH_TAN_WAIT": "30",
                "COMDIRECT_MCP_UNMASK_IBANS": "false",
                "COMDIRECT_MCP_MASK_NAMES": "false",
                "COMDIRECT_ENV_FILE": "<COMDIRECT_ENV_FILE>",
                "COMDIRECT_MCP_CACHE_TTL": "60",
                "COMDIRECT_MCP_MAX_DOCUMENT_BYTES": "10485760",
                "COMDIRECT_MCP_CATEGORIES": "<COMDIRECT_MCP_CATEGORIES>",
                "COMDIRECT_MCP_SKIP_ELICITATION": "false",
                "COMDIRECT_MCP_LOG_FILE": "<COMDIRECT_MCP_LOG_FILE>",
                "COMDIRECT_MCP_LOG_LEVEL": "INFO"
            }
        }
    }
}

متغيرات البيئة

  • COMDIRECT_CLIENT_ID سري comdirect API client id (or stored in the OS keychain via `comdirect-mcp configure`)
  • COMDIRECT_CLIENT_SECRET سري comdirect API client secret (or stored in the OS keychain via `comdirect-mcp configure`)
  • COMDIRECT_USERNAME سري comdirect Zugangsnummer (or stored in the OS keychain via `comdirect-mcp configure`)
  • COMDIRECT_PASSWORD سري comdirect PIN (or stored in the OS keychain via `comdirect-mcp configure`)
  • COMDIRECT_MCP_PUSH_TAN_WAIT Seconds to wait for the push TAN approval if the client cannot show a confirmation dialog
  • COMDIRECT_MCP_UNMASK_IBANS Set to true to return counterparty IBANs unmasked
  • COMDIRECT_MCP_MASK_NAMES Set to true to replace counterparty names with stable pseudonyms
  • COMDIRECT_ENV_FILE Path to a dotenv file with the credentials (opt-in; prefer the OS keychain)
  • COMDIRECT_MCP_CACHE_TTL Seconds the server keeps bank results within a session; 0 disables the cache
  • COMDIRECT_MCP_MAX_DOCUMENT_BYTES Size limit for postbox documents in bytes
  • COMDIRECT_MCP_CATEGORIES Path of the category rules file (default ~/.config/comdirect-mcp/categories.toml)
  • COMDIRECT_MCP_SKIP_ELICITATION Set to 1 to skip the login confirmation dialog and wait for the push TAN approval instead
  • COMDIRECT_MCP_LOG_FILE File the server appends its log to (default stderr)
  • COMDIRECT_MCP_LOG_LEVEL Log level of the server

التوثيق

مأخوذ من ملف README للمشروع على GitHub ويُحدَّث أسبوعيًا. تفتح الروابط على GitHub.

المحتويات
  1. comdirect-mcp
  2. Warnung (auf Deutsch, weil comdirect)
  3. Features
  4. Quickstart
  5. Python library
  6. More

comdirect-mcp

Read-only MCP server and typed Python client for the comdirect REST API. Let Claude, GitHub Copilot or a local model look at your accounts, transactions, depot and postbox. You approve the login in the photoTAN app, and no tool can move money.

[!WARNING] Unofficial, not affiliated with comdirect. It handles your banking credentials, and every tool result goes to the model behind your MCP client: with a cloud assistant your financial data leaves your computer. For the most privacy use a local model. See SECURITY.md.

Warnung (auf Deutsch, weil comdirect)

Leute, hier geht es um euer Geld. Nutzt das nur, wenn ihr den Code versteht und die Risiken kennt. MIT-Lizenz: Jeder darf damit machen, was er/sie will (auch ihr, comdirect 👀), aber ohne Gewährleistung und ohne Haftung.

Transparenz: Ein Teil des Codes stammt von Opus 5.5 und gpt-6.1-sol, ich habe reviewed, getestet und weise genickt. Genau deshalb: Code verstehen.

Der Server nutzt nur lesende Endpunkte, aber Fehler passieren trotzdem: comdirect kann die API ändern, Dependencies können kompromittiert werden, und 2FA ist kein Freifahrtschein. Deshalb:

  • Nur lokal auf dem eigenen Rechner nutzen, Zugangsdaten niemandem geben.
  • Zugangsdaten in den OS-Schlüsselbund (comdirect-mcp configure). Eine .env enthält das Passwort im Klartext: niemals committen.
  • Updates nicht blind einspielen: Version pinnen, Änderungen anschauen.

MCP-Server: Hängt ihr ihn an einen Cloud-Client, verlassen eure Daten euren Rechner und können in Logs landen. Verwendungszwecke und Dokumente können Prompt-Injections enthalten. Also nur in Umgebungen nutzen, denen ihr vertraut.

Wer seine Kontoauszüge eh schon in ChatGPT kopiert: Macht, was ihr wollt, aber auf eigene Verantwortung!

Features

  • Safe login: push TAN confirmed in your client; stops before comdirect's lock after five unconfirmed challenges; revokes the session on logout and shutdown
  • Credentials in the OS keychain, read-only tools with truthful annotations
  • Answers on the server: cash flow and spending per month, counterparty or your own categories, subscriptions with yearly costs, portfolio allocation
  • Clean data: transfers between your own accounts are kept out of spending, PayPal payments show the merchant, payment texts are cleaned up, IBANs masked
  • Typed Python client for your own scripts

The API returns account transactions of the last 180 days only.

Tool
login / logoutStart a session (push TAN) / end and revoke it
list_accounts, list_cards, get_wealth_overviewBalances of accounts, cards and all products
list_transactionsIndividual transactions
summarize_transactionsIncome, expenses and net per month, counterparty, type or category
find_recurring_paymentsSubscriptions, contracts and standing orders
list_depots, get_depot_positions, summarize_portfolioDepot positions and allocation
list_depot_transactions, list_orders, get_order, get_instrumentSecurities movements, order book, security data
list_documents, read_documentPostbox documents as text or PDF (reading marks them as read)

Prompts: monthly_review, find_subscriptions, tax_documents. Details: Tools reference.

Quickstart

You need uv, comdirect API access (Client ID and Secret) and photoTAN Push as default TAN method.

uvx comdirect-mcp@0.6.1 configure   # stores your credentials in the OS keychain

Add the server to your client, e.g. Claude Code:

claude mcp add --transport stdio --scope user comdirect -- uvx comdirect-mcp@0.6.1

or Claude Desktop, LM Studio and others:

{
  "mcpServers": {
    "comdirect": {
      "command": "uvx",
      "args": ["comdirect-mcp@0.6.1"]
    }
  }
}

Then ask, e.g. „Welche Abos zahle ich, und was kosten sie im Jahr?“ The assistant calls login and you approve the push in the app. VS Code, Ollama and more: Configure MCP clients · step by step: Getting started · problems: Troubleshoot.

Python library

from comdirect_mcp import ComdirectClient
from comdirect_mcp.utils import default_push_tan_callback

client = ComdirectClient(
    {"client_id": "...", "client_secret": "...", "username": "...", "password": "..."},
    {"push_tan_cb": default_push_tan_callback},
)
client.login()  # approve the push TAN, then press Enter
for account in client.list_accounts():
    print(account.id, account.balance, account.currency)

See Use the Python library.

More

Documentation · CHANGELOG · CONTRIBUTING · AGENTS.md for AI coding agents · MIT License

الأسئلة الشائعة

ما هو comdirect؟

Read-only access to comdirect accounts, transactions, depots, orders and postbox documents.

كيف أثبّت comdirect؟

يعمل على جهازك. في Claude Code: claude mcp add comdirect -e 'COMDIRECT_CLIENT_ID=<your comdirect_client_id>' -e 'COMDIRECT_CLIENT_SECRET=<your comdirect_client_secret>' -e 'COMDIRECT_USERNAME=<your comdirect_username>' -e 'COMDIRECT_PASSWORD=<your comdirect_password>' -e 'COMDIRECT_MCP_PUSH_TAN_WAIT=30' -e 'COMDIRECT_MCP_UNMASK_IBANS=false' -e 'COMDIRECT_MCP_MASK_NAMES=false' -e 'COMDIRECT_ENV_FILE=<COMDIRECT_ENV_FILE>' -e 'COMDIRECT_MCP_CACHE_TTL=60' -e 'COMDIRECT_MCP_MAX_DOCUMENT_BYTES=10485760' -e 'COMDIRECT_MCP_CATEGORIES=<COMDIRECT_MCP_CATEGORIES>' -e 'COMDIRECT_MCP_SKIP_ELICITATION=false' -e 'COMDIRECT_MCP_LOG_FILE=<COMDIRECT_MCP_LOG_FILE>' -e 'COMDIRECT_MCP_LOG_LEVEL=INFO' -- uvx comdirect-mcp==0.6.1. وفي العملاء الآخرين، الصق إعداد JSON من هذه الصفحة في إعدادات MCP الخاصة بهم.

هل يحتاج comdirect إلى مفتاح API؟

نعم. يتطلب COMDIRECT_CLIENT_ID, COMDIRECT_CLIENT_SECRET, COMDIRECT_USERNAME, COMDIRECT_PASSWORD، وتضبطها في إعداداته.

هل comdirect مفتوح المصدر؟

نعم. شيفرته متاحة على GitHub بترخيص MIT.

من يصون comdirect؟

ينشره mad4ms. يدرجه AI.tn لكنه لا يصونه ولا يوصي به.

من سجل MCP الرسمي. الإدراج ليس توصية: راجع شيفرة الخادم وصلاحياته قبل منحه الوصول إلى بياناتك.