noskillish/bankmcp v0.1.14

on GitHub

Security: create_watch no longer accepts a webhook URL. Notifications go only to the NOTIFY_WEBHOOK_URL the operator sets on the host, which must be https, so a client cannot direct transaction data to an arbitrary address or to hosts inside the server's network. Watches saved by earlier versions keep working; their stored webhook_url is ignored. The README security notes now say where authentication and authorisation are enforced. Thanks to the reader who reported it.