LABSCO SUMMARY

Strong Customer Authentication is part of the tool contract rather than a wall the agent runs into.

Operations that can move money say so in their own descriptions, poll inline, and then hand back a structured pending response carrying a session token, so the flow resumes through a status check and a retry instead of failing outright — which is what makes a scripted transfer to a trusted beneficiary complete without a human at the terminal. Irreversible actions are labelled as irreversible, and the ones needing a partner-only scope say which scope, so an agent finds out from the description rather than from a 403.

What it is

An independent, open-source toolkit for the Qonto banking API — a CLI, an MCP server and a library, running locally on your own credentials. It is not affiliated with Qonto, who publish their own hosted server; this one exists to automate the bank rather than to chat with it, including headless from a script or a CI job, and it supports several organisations from one setup through named profiles.

What you get

Accounts and money movement: account_list, account_create, account_update and account_close, transaction_list filtered by side, status and emission or settlement dates, statement_list, and internal_transfer_create between two accounts in the same organization.
SEPA transfers with payee verification attached: transfer_create against an existing beneficiary or an inline one, transfer_cancel, transfer_proof as a PDF, transfer_verify_payee and transfer_bulk_verify_payee, and bulk_transfer_create, which resolves the verification proof itself when it is not supplied.
Recurring transfers created with a frequency and a first execution date, then listed, shown and cancelled.
International payments: intl_eligibility, intl_currencies, intl_quote_create for a rate, intl_beneficiary_requirements and intl_transfer_requirements for the fields a given corridor demands, and intl_transfer_create against a quote.
Cards as a full lifecycle: card_create with its spending limits, options and restrictions set upfront, card_bulk_create for up to 50, lock and unlock, report lost, report stolen and discard — each marked irreversible — separate tools for limits, nickname, options and restrictions, card_appearances, and card_iframe_url for a secure view of the PAN, CVV and expiry.
Client billing end to end: client records, quote_create and quote_send, and a client invoice lifecycle of create, update, finalize — which assigns the number and moves it from draft to unpaid — send by email, mark and unmark paid, cancel, delete, and file uploads attached to the invoice.
Supplier invoices created by uploading files from the filesystem, listed with filters, plus credit notes.
Requests as an approval flow: request_list, request_approve and request_decline, with request_create_flash_card, request_create_virtual_card and request_create_multi_transfer, which carries a whole batch of transfers in one request.
The surrounding estate: attachments on transactions, payment links with their payments, methods and connection status, Qonto Terminal payments, labels, teams, memberships and invitations, insurance contracts, the product catalogue, e-invoicing settings, and webhook subscriptions.
diagnose, a read-only healthcheck against the configured profile returning per-check status of ok, warn, fail or skip with detail and suggested actions.

Requirements

Node.js 24 or newer, a Qonto business account with API access, and a configured profile — run diagnose first, it is the read-only check that the configuration works. Which half of this surface you get depends on the credential: an API key covers most reads and many writes but is production-only, while cards, teams, webhooks, e-invoicing, payment links, insurance, international transfers, recurring transfers and the sandbox need OAuth. Someone must be able to answer a Strong Customer Authentication challenge, since operations that move money or change cards may raise one — the tool polls inline for 30 seconds and otherwise hands back a session to resume from. The project is licensed AGPL-3.0, which constrains how anything built on it may be distributed.

Setup effort

One command plus a key — npx qontoctl mcp, then supply credentials

See installation options

USE CASES

Checking the setup before trusting it with money

Run the read-only healthcheck; it reports each check as ok, warn, fail or skip with a suggested action, which is faster than discovering a missing scope mid-transfer.

diagnoseorg_showaccount_list

Paying a supplier you have never paid before

Verify the payee first, create the transfer, and resume through the authentication session if one is raised.

transfer_verify_payeetransfer_createsca_session_show

Issuing a card that already has its limits on it

Create it with the spending limits, options and restrictions set in the same call rather than tightening them afterwards.

card_createcard_update_limitscard_update_restrictions

Sending money outside the SEPA zone

Check eligibility and the currency, get a quote for the rate, find out which fields that corridor demands, then create the transfer against the quote.

intl_eligibilityintl_quote_createintl_transfer_requirementsintl_transfer_create

Billing a client from quote through to payment

Send the quote, turn it into an invoice, finalise it so it takes a number, email it, and mark it paid when the money lands.

quote_sendclient_invoice_createclient_invoice_finalizeclient_invoice_sendclient_invoice_mark_paid

Matching a month of transactions to their paperwork

List the transactions, see which have attachments, and upload the missing receipts against them.

transaction_listtransaction_attachment_listtransaction_attachment_add

Clearing the queue of what the team has asked for

List the pending requests and approve or decline each one, with the authentication step handled where it is raised.

request_listrequest_approverequest_decline

128 tools

Counted once with only startup setup. Other versions, modes or optional credentials may expose a different list.

`account_close`

Close a bank account. SCA: this operation may require Strong Customer Authentication; the tool polls inline by default (wait=30s) and falls back to a structured pending response so the caller can continue via sca_session_show + sca_session_token.

INSTALLATION

Connect your client

Server setup

Setup

Create ~/.qontoctl.yaml with your Qonto credentials — an api-key section holding organization-slug and secret-key, or an oauth section holding client-id and client-secret for an OAuth app

TERMINAL

npx qontoctl diagnose

npx

TERMINAL

npx qontoctl mcp

MCP Clients

Claude Desktop, Cursor, Windsurf

JSON

{
  "mcpServers": {
    "qontoctl": {
      "command": "npx",
      "args": [
        "qontoctl",
        "mcp"
      ]
    }
  }
}

Claude Code

CLAUDE CODE · TERMINAL

claude mcp add qontoctl -- npx qontoctl mcp

QontoCtl

Strong Customer Authentication is part of the tool contract rather than a wall the agent runs into.

What it is

What you get

Requirements

Setup effort

Checking the setup before trusting it with money

Paying a supplier you have never paid before

Issuing a card that already has its limits on it

Sending money outside the SEPA zone

Billing a client from quote through to payment

Matching a month of transactions to their paperwork

Clearing the queue of what the team has asked for

128 tools

account_close

account_create

account_iban_certificate

account_list

account_show

account_update

attachment_show

attachment_upload

beneficiary_add

beneficiary_list

beneficiary_show

beneficiary_trust

beneficiary_untrust

beneficiary_update

bulk_transfer_create

bulk_transfer_list

bulk_transfer_show

card_appearances

card_bulk_create

card_create

card_discard

card_iframe_url

card_list

card_lock

card_report_lost

card_report_stolen

card_show

card_unlock

card_update_limits

card_update_nickname

card_update_options

card_update_restrictions

client_create

client_delete

client_invoice_cancel

client_invoice_create

client_invoice_delete

client_invoice_finalize

client_invoice_list

client_invoice_mark_paid

client_invoice_send

client_invoice_show

client_invoice_unmark_paid

client_invoice_update

client_invoice_upload

client_invoice_upload_show

client_list

client_show

client_update

credit_note_list

credit_note_show

diagnose

einvoicing_settings

insurance_create

insurance_remove_document

insurance_show

insurance_update

insurance_upload_document

internal_transfer_create

intl_beneficiary_add

intl_beneficiary_list

intl_beneficiary_remove

intl_beneficiary_requirements

intl_beneficiary_update

intl_currencies

intl_eligibility

`account_close`

`account_create`

`account_iban_certificate`

`account_list`

`account_show`

`account_update`

`attachment_show`

`attachment_upload`

`beneficiary_add`

`beneficiary_list`

`beneficiary_show`

`beneficiary_trust`

`beneficiary_untrust`

`beneficiary_update`

`bulk_transfer_create`

`bulk_transfer_list`

`bulk_transfer_show`

`card_appearances`

`card_bulk_create`

`card_create`

`card_discard`

`card_iframe_url`

`card_list`

`card_lock`

`card_report_lost`

`card_report_stolen`

`card_show`

`card_unlock`

`card_update_limits`

`card_update_nickname`

`card_update_options`

`card_update_restrictions`

`client_create`

`client_delete`

`client_invoice_cancel`

`client_invoice_create`

`client_invoice_delete`

`client_invoice_finalize`

`client_invoice_list`

`client_invoice_mark_paid`

`client_invoice_send`

`client_invoice_show`

`client_invoice_unmark_paid`

`client_invoice_update`

`client_invoice_upload`

`client_invoice_upload_show`

`client_list`

`client_show`

`client_update`

`credit_note_list`

`credit_note_show`

`diagnose`

`einvoicing_settings`

`insurance_create`

`insurance_remove_document`

`insurance_show`

`insurance_update`

`insurance_upload_document`

`internal_transfer_create`

`intl_beneficiary_add`

`intl_beneficiary_list`

`intl_beneficiary_remove`

`intl_beneficiary_requirements`

`intl_beneficiary_update`

`intl_currencies`

`intl_eligibility`

`intl_quote_create`

`intl_transfer_create`

`intl_transfer_requirements`

`label_list`

`label_show`

`membership_invite`

`membership_list`

`membership_show`

`org_show`

`payment_link_connect`

`payment_link_connection_status`

`payment_link_create`

`payment_link_deactivate`

`payment_link_list`