Grasshopper vs. Slash: The First US Banks With MCP Servers for AI Agents

The Model Context Protocol, an open standard for connecting AI assistants to external data and tools, has moved from a developer curiosity into actual bank products faster than most banking infrastructure typically changes. Two companies have now shipped MCP servers that let an AI agent talk directly to a business bank account, and they took meaningfully different approaches to how much the agent is allowed to do.

Grasshopper Bank: First, and Deliberately Narrow

Grasshopper Bank, a directly chartered national bank, partnered with banking-technology vendor Narmi to launch what Forbes and The Financial Brand both reported as the first Model Context Protocol server deployed by a U.S. bank, in August 2025. The integration is built specifically around Claude and is scoped to read-only access: a connected agent can answer natural-language questions about account balances and transaction history, but it cannot initiate a payment, move money, or take any action on the account.

That narrow scope is a reasonable first move for a chartered bank introducing an entirely new access pattern to customer financial data. It proves the underlying concept, natural-language queries against real account data through a standard protocol, without exposing any new attack surface on the money-movement side. We've referenced this integration in our Grasshopper Bank vs. Mercury comparison, where it stands out as a genuine infrastructure differentiator against Mercury's more conventional dashboard-and-API model.

Slash: Seven Months Later, Read and Write

Slash, a business banking fintech that reached unicorn status with a $1.4 billion valuation in an April 2026 funding round, went further. Its MCP server, live since March 2026, is explicitly read-and-write. Per Slash's own announcement, a connected agent, through Claude, ChatGPT, Cursor, or any MCP-compatible client, can create virtual cards and set spend limits, send payments across ACH, wire, RTP, or crypto rails, create and send invoices, and query transaction data directly.

That is a genuinely different risk posture than Grasshopper's read-only design, and Slash's own materials address it directly: agents can draft and submit actions, but nothing executes without the account holder's explicit sign-off, and card numbers are tokenized so a connected agent never has direct access to raw card data. Slash frames this specifically as protection against prompt injection, stating that an agent never has unilateral control over funds, so a manipulated or compromised agent conversation can't directly drain the account without a human approving the specific action.

Separately, Slash also launched a distinct, proprietary in-app assistant called Twin in April 2026, accessible through chat, Slack, or text. Twin appears to be a separate branded product layer built on top of Slash's own infrastructure rather than the MCP integration itself, worth not conflating the two if you're evaluating either specifically.

Comparing the Two

What This Means, and What to Watch

Neither of these integrations has been independently audited by a banking regulator or reviewed at length by major financial-technology press; both are self-announced by the companies involved, through their own blogs and product documentation. That doesn't make the claims false, we verified both against primary company sources directly, but it does mean this is genuinely new infrastructure without years of adversarial testing behind it yet, and a business evaluating either should treat it accordingly: useful, real, and worth watching, not yet a fully proven category with an established security track record the way API-based banking access has built up over the past decade.

For a company deciding whether AI-agent banking access is worth adopting today, the practical distinction is straightforward: Grasshopper's read-only model is close to zero-risk since an agent literally cannot move money, useful if you just want faster, natural-language access to your own account data. Slash's read-and-write model is materially more useful for actually automating financial operations, but it requires trusting both the human-approval gate and the underlying tokenization to hold up as promised, a reasonable bet given the stated safeguards, but a genuinely different risk decision than Grasshopper's.

This is educational information, not personalized financial or security advice. AI-agent banking integrations are new and evolving quickly; review each provider's current security documentation directly before connecting an agent to a real account.