---
name: iblai-connect-jack-henry
description: "Read and write Jack Henry data through the jXchange (SOAP and REST-Legacy), Banno Consumer API and Admin API, SymXchange and expose it to an ibl.ai agent as an MCP tool. Use when the user asks an agent to work with Jack Henry data, or to set up a Jack Henry MCP connection on ibl.ai."
metadata:
  kind: guide
---

# Jack Henry connector for AI agents

> A starting point maintained on ibl.ai at https://ibl.ai/developer/connectors/jack-henry — not part of the iblai/vibe repository. Checked against Jack Henry & Associates' documentation on October 20, 2026; test it against your own Jack Henry setup before you rely on it.

Jack Henry provides core processing (SilverLake, CIF 20/20, Core Director, Symitar) and the Banno digital banking platform to U.S. banks and credit unions. Holds accountholder accounts, transactions, transfers and payments.

## Auth & conventions

- **API:** jXchange (SOAP and REST-Legacy), Banno Consumer API and Admin API, SymXchange (Mixed). jXchange is the SOAP service layer for Jack Henry bank cores. The Banno Consumer API gives OAuth/OIDC-protected access to a signed-in user's accounts, transactions and transfer accounts.
- **Base URL:** https://{CONSUMER_API_ENVIRONMENT}/a/consumer/api/v0/ (Banno; https://api.banno.com/a/consumer/api/v0 for Banno Mobile only)
- **Access:** Issued by your administrator. A jackhenry.dev account gives demo credentials. For live Banno data the FI's admin creates an External Application in Banno People. jXchange credentials: clients via the For Clients Portal, FIN members via Vendor Relations.
- **Auth:** OAuth 2.0 authorization code with OpenID Connect (Banno); OAuth 2.0 client credentials with signed JWT (jXchange). Each Banno endpoint names its scope. jXchange moves to OAuth at jx.jackhenry.com with scope https://jackhenry.com/jx/service-gateway.write; mandatory for new setups from Apr 30 2026, legacy login ends Apr 30 2028.
- Keep Jack Henry credentials in environment variables or the ibl.ai credential store. Never print a token in chat and never commit one to a file.
- Destructive or outward-facing calls are marked **Confirm with the user first** — do.

## Reads

- **Accounts** — GET /users/{user_id}/accounts returns active and inactive accounts with a fetchedDate.
- **Transactions** — GET /users/{user_id}/accounts/{account_id}/transactions; each has lastUpdated. See the Data Refresh guide for real-time data.
- **External transfer accounts** — GET /users/{userId}/transfers/accounts/external (scope transfers.accounts.readonly).
- **Unmasked account number** — GET .../transfers/accounts/external/{externalTransferAccountId}/number (scope transfers.unmaskednumber.readonly).
- **Core records via jXchange** — SOAP services per core provider (SilverLake, CIF 20/20, Core Director); see each provider guide.

## Writes

- **Link external account** — POST /users/{userId}/transfers/accounts/external (scope transfers.accounts.readwrite) adds an account for money movement. **Confirm with the user first.**
- **Remove external account** — DELETE .../transfers/accounts/external/{externalTransferAccountId}. **Confirm with the user first.**
- **Rename external account** — PUT .../transfers/accounts/external/{externalTransferAccountId}/name.

## Expose it to an ibl.ai agent (MCP)

Jack Henry & Associates did not publish an MCP server of its own when this skill was checked. Host a small MCP server that wraps the calls above, then register it below.

First install the ibl.ai platform skills and connect your organization (writes `IBLAI_ORG`, `IBLAI_USERNAME` and `IBLAI_API_KEY` to `.env`):

```bash
npx skills add iblai/vibe --all
# then, in your coding agent:
/iblai-api-login
```

Every call below sends `Authorization: Api-Token $IBLAI_API_KEY`.

1. **Register the server** — `POST https://api.iblai.app/dm/api/ai-mentor/orgs/$IBLAI_ORG/users/$IBLAI_USERNAME/mcp-servers/` with `name`, `url`, `transport` (`sse` | `websocket` | `streamable_http`) and `auth_type` (`none` | `token` | `oauth2`). Capture the returned `id`.
   - Jack Henry supports per-user OAuth: `auth_type=oauth2` with `auth_scope=user` and a linked `oauth_service` makes each person connect their own account in the chat. It needs an `auth_{provider}` credential in the organization's credential store first.
2. **Create the connection** — `POST https://api.iblai.app/dm/api/ai-mentor/orgs/$IBLAI_ORG/users/$IBLAI_USERNAME/mcp-server-connections/` with `server`, `scope` (`platform` | `mentor` | `user`), `auth_type`, and either `credentials` + `authorization_scheme` or a `connected_service` id for OAuth. Credentials are masked on read; never send a masked value back.
3. **Enable it on the agent** — `GET https://api.iblai.app/dm/api/ai-mentor/orgs/$IBLAI_ORG/users/$IBLAI_USERNAME/mentors/{agent_id}/settings/`, add `mcp-tool` to `tool_slugs` and the server id to `mcp_servers`, then `PATCH` the full lists back. They are replaced, not merged.

Full reference: https://ibl.ai/developer/platform/mcp/mcp-connections and the `/iblai-api-agent-mcp` skill.

## Example prompts

- "List my accounts and their balances as of the last refresh"
- "Show this month's transactions on my savings account over $200"
- "Which external transfer accounts are linked to this user?"
- "Rename my linked Ally account to 'Emergency fund'"

## Guardrails

- Accountholder accounts, transactions and unmasked account numbers are GLBA nonpublic personal information. Card data reached through payment APIs is PCI cardholder data.
- Request the narrowest Jack Henry scopes or role the task needs, and prefer a read-only credential for agents that only answer questions.
- Return the fields the user asked for, not whole records; do not paste personal data into chat that the user did not request.
- Before any write, show the user exactly what will change and wait for a yes.
- Page through large result sets and back off on rate-limit responses instead of retrying in a loop.

## References

- Jack Henry Developer (jackhenry.dev): https://jackhenry.dev/
- Banno Consumer API: Getting Started: https://jackhenry.dev/open-api-docs/consumer-api/getting-started/
- jXchange: Getting Started: https://jackhenry.dev/jxchange-soap/getting-started/
- This connector on ibl.ai: https://ibl.ai/developer/connectors/jack-henry
- ibl.ai MCP server connections: https://ibl.ai/developer/platform/mcp/mcp-connections