@vonzio/plugin-teller

Bank data for vonzio agents via the Teller API. Gives agents 5 read-only MCP tools — list enrollments, list accounts, get balance, list transactions, get account details — over an operator-provisioned mTLS client certificate.

Install + approve (operator)

npm install @vonzio/plugin-teller

1. Declare it in VONZIO_PLUGINS (the env list of plugins to load).
2. Env config (all optional except where noted): | Var | Purpose | |---|---| | TELLER_APP_ID | Teller application id (enables the Connect button) | | TELLER_ENVIRONMENT | sandbox | development | production (default sandbox) | | TELLER_API_BASE | defaults to https://api.teller.io | | TELLER_SIGNING_PUBKEY | optional base64 Ed25519 key for strict Connect-callback verification |
3. Provision the mTLS cert in the operator policy (vonzio-plugins.json). Mount your Teller client cert + key on the host and point the policy at them:

   "@vonzio/plugin-teller": {
     "version": "0.1.1",          // match the installed package version
     "approved_hash_sha256": "<from: vonzio plugin approve>",
     "approved_capabilities": [
       "http.outbound", "secrets.mtls", "integrations.read.decrypted",
       "integrations.write", "mcp.register", "auth.gate"
     ],
     "approved_outbound_hosts": ["api.teller.io"],
     "mtls_secrets": {
       "teller-client": {
         "cert": "/run/secrets/teller/cert.pem",
         "key":  "/run/secrets/teller/key.pem"
       }
     }
   }

4. Approve + restart:

   vonzio plugin approve @vonzio/plugin-teller

How it works

• mTLS: the client cert/key never enter plugin memory — ctx.secrets.mtls("teller-client") returns an opaque ref the plugin passes to ctx.http.fetch({ mtls }); core presents the cert server-side (SSRF-checked, host-allowlisted to api.teller.io).

• Connect: /v1/integrations/teller/{config,callback} (auth-gated) drive the Teller Connect popup and persist enrollments to user_integrations (type teller).

• Agent tools: the MCP server at /v1/integrations/teller/mcp is injected into each agent task with a per-task token resolved via ctx.mcpSessions.

• Dashboard row: the Settings → Integrations row is styled to match the host dashboard, using the design-system CSS the dashboard already loads for bundled plugin frontends (--vz-* tokens + vz-btn classes).

Compatibility

Requires the @vonzio/plugin-api 1.1 contract (manifest apiVersion: "1.1"), shipped by npm package @vonzio/plugin-api@^0.2.0. The contract version (1.1) and the npm package version (0.2.x) are independent axes. Under this contract the MCP server filters enrollments by the running agent's profile (scope / profile_ids), so per-profile scoping is honoured.